Picvelo Privacy Policy

This Privacy Policy describes the rules for processing personal data in the Picvelo service, a SaaS platform for photographers used to share photo galleries with end clients so that they can select photos.

This document has been drawn up in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: GDPR) and with the applicable provisions of Polish law.

1. Data controller

The controller of your personal data is:

• Name: Jakub Ciepielowski
• Address: Kaskadowa 17F, 43-300 Bielsko-Biała
• Contact: [email protected]

Referred to below in this document as: "Picvelo", "we" or the "Controller".

2. Contact

2.1 General contact

You can contact us on any matter concerning the processing of personal data:

• Email: [email protected]
• Postal address: Kaskadowa 17F, 43-300 Bielsko-Biała

2.2 Data Protection Officer (DPO)

The Controller has not appointed a Data Protection Officer, as none of the cases listed in Article 37(1) GDPR apply. For all data protection matters, use the contact address given in section 2.1.

3. Picvelo's two roles under the GDPR

Picvelo operates in two different roles depending on the type of data being processed:

3.1 Controller, photographer accounts

With regard to the data of photographers (Users) who register an account in the service, Picvelo is the controller of personal data. We collect and process:

• Identification and contact data: first name and surname or company name, email address
• Authentication data: password (stored as a bcrypt hash), 2FA keys (optional)
• Billing data: invoicing details (name, address, tax ID), subscription history, payment method (card details are stored solely by Stripe)
• Technical data: IP address, browser type, activity logs, HTTP headers
• Profile data: service preferences, gallery settings, SMTP configuration
• OAuth data (optional): identifier and email from Google, Facebook (Meta) or Apple services, if the user uses social login

3.2 Processor, data of photographers' end clients

With regard to the data of end clients (people who receive a link to a gallery and select photos), Picvelo acts as a processor on the instructions of the photographer (the controller), within the meaning of Article 28 GDPR.

In this role we process only the data entrusted to us by the photographer:

• First name and surname or nickname of the end client (if the photographer entered them)
• Email address of the end client (if the photographer provided it)
• IP address and technical data from the gallery browsing session
• Information about the photo selections made (list of IDs of selected photos, notes)
• Order data, if the client buys additional photos or the whole gallery in the gallery: the number and price of the photos, the amount, and the payment status and identifier. Full card data is processed solely by Stripe; Picvelo does not see it

Previews are generated from scratch, so they contain no EXIF metadata or GPS coordinates from the camera. Original files that the photographer makes available for the client to download retain the metadata assigned by the camera; the photographer is responsible for removing it if needed.

The photographer, as the controller, is responsible for the compliance of the processing of end client data with the GDPR. Picvelo processes such data solely in accordance with the concluded Data Processing Agreement (see Data Processing Agreement).

4. Purposes and legal bases of processing

4.1 Photographers' data (Picvelo as controller)

4.2 End clients' data (Picvelo as processor)

Processing takes place solely on the documented instructions of the photographer. The photographer, as the controller, is obliged to have their own legal basis in relation to end clients.

5. Data retention period

A detailed table of retention periods is available in the Data Retention Policy.

In short:

• Photographer account data: until the photographer deletes the account. Deleting the account in the panel erases the data immediately and permanently; there is no grace period or automatic deletion of accounts after a subscription ends (the account is then moved to the Free plan)
• Billing data / invoices: 5 years, in accordance with Article 86 of the Polish Tax Ordinance Act
• System logs: 90 days on a rotating basis
• End clients' data: deleted together with the gallery or the photographer's account. We delete it automatically only when the photographer's account continuously exceeds its plan's storage limit for 12 months (Terms and Conditions, section 6.2); we send a warning email 30 days in advance
• Policy acceptances and consents: 6 years from the end of the relationship

6. Data recipients and subprocessors

6.1 Categories of recipients

Your data may be shared with:

• Processors (subprocessors) providing services to Picvelo, only to the extent necessary to deliver the service
• Public authorities, solely on the basis of a legal obligation (e.g. tax authorities, law enforcement authorities acting on a final ruling)
• Stripe, to the extent of the data necessary to process payments

Picvelo does not sell personal data to third parties.

6.2 List of subprocessors

The current list of subprocessors is available at Subprocessors List.

Subprocessors are contractually obliged to protect data at a level at least equivalent to this Policy, in accordance with Article 28 GDPR.

7. Transfer of data outside the European Economic Area (EEA)

Some of Picvelo's subprocessors are established in, or process data outside, the EEA (mainly in the USA). Every such transfer is safeguarded by appropriate legal instruments:

Our support chat runs on Telegram. If you use it, the content of the conversation and the email address you provide in it reach Telegram Messenger, which processes data outside the EEA. If you would rather not do that, write to us by ordinary email at [email protected].

Standard Contractual Clauses (SCCs) are model contracts approved by the European Commission that ensure an adequate level of data protection (Commission Implementing Decision 2021/914). The Data Privacy Framework (DPF) is a certification mechanism for entities in the USA, recognised by the European Commission as ensuring an adequate level of protection (Decision 2023/1795).

International users

Picvelo is operated from Poland and its main servers are in the EU. If you use the service from outside the EEA, including from the UK or the USA, your personal data is transferred to and processed in the EU and, through the subprocessors above, in the USA. Transfers from the EEA to processors outside it rely on the adequacy decisions and Standard Contractual Clauses listed in the table above.

You can ask for information about the safeguards we rely on by writing to [email protected].

The core hosting (OVH SAS, France) remains within the EEA. Photo files may be stored in the Cloudflare R2 object storage service (transfer safeguarded by SCCs, see the table above).

8. Your rights

As a data subject, you have the following rights under the GDPR:

8.1 Right of access (Art. 15 GDPR)

You have the right to obtain confirmation from us as to whether we process your personal data and, if so, access to that data together with information about how it is processed.

8.2 Right to rectification (Art. 16 GDPR)

You have the right to request the immediate rectification of inaccurate personal data or the completion of incomplete personal data.

8.3 Right to erasure (Art. 17 GDPR)

You have the right to request the erasure of personal data (the "right to be forgotten") where: the data is no longer necessary for the purposes for which it was collected; you withdraw consent (where processing was based on consent); you lodge an effective objection; the data was processed unlawfully. This right does not apply, among other cases, where processing is necessary for compliance with a legal obligation.

8.4 Right to restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of processing in specific situations (for example where you contest the accuracy of the data or have lodged an objection).

8.5 Right to data portability (Art. 20 GDPR)

Where processing is based on consent or on a contract and is carried out by automated means, you have the right to receive your data in a structured, commonly used format (JSON, for you to download yourself from the panel in the Data export section) and to transfer it to another controller.

8.6 Right to object (Art. 21 GDPR)

You have the right to object at any time to processing based on the legitimate interest of the controller (Art. 6(1)(f)), including to profiling. Picvelo will cease processing unless it demonstrates compelling legitimate grounds which override your interests.

8.7 Right to withdraw consent (Art. 7(3) GDPR)

Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.

8.8 How rights are exercised

Please send requests to the email address: [email protected]. We reply without undue delay, no later than within 1 month of receiving the request (the deadline may be extended to 3 months in complex cases, of which we will inform you).

9. Right to lodge a complaint with a supervisory authority

If you believe that we process your data unlawfully, you have the right to lodge a complaint with a supervisory authority. In Poland this authority is:

President of the Personal Data Protection Office (PUODO) ul. Stawki 2, 00-193 Warsaw Telephone: +48 22 531 03 00 Email: [email protected] Website: uodo.gov.pl

PUODO is our lead supervisory authority. If you live or work in another EU or EEA country, or in the UK, you may also lodge a complaint with the data protection authority of your country (in the UK, the Information Commissioner's Office).

10. Automated decision-making

Picvelo does not use automated decision-making, including profiling, that would produce legal effects or similarly significantly affect natural persons within the meaning of Article 22 GDPR.

Service analytics (Google Analytics 4) serves statistical purposes and the improvement of the service only, and is not used to make decisions concerning individual users.

11. Cookies

Picvelo uses cookies and similar tracking technologies. Detailed information, including a list of all cookies, their purpose and how to manage them, is available in the Cookie Policy.

12. Signing in with Google, Facebook and Apple (OAuth)

You can register and sign in to the photographer panel with a Google, Facebook (Meta) or Apple account. This section describes what data we receive from those services, what we use it for, how long we keep it and who we share it with.

12.1 Data from your Google account

Picvelo requests only the openid, email and profile scopes. From your Google account we receive:

We do not read the profile picture, contacts, calendar, Google Drive files or any other data. We do not request scopes that Google classifies as sensitive or restricted. The Google access token is used only to read the data above once during sign-in and is not stored.

12.2 Storage and sharing

• The Google account identifier, e-mail address and name are stored in our database on a server in the European Union for as long as your Picvelo account exists (retention periods in section 5).
• We do not sell Google account data, do not share it for advertising purposes, and do not use it for profiling or for training artificial intelligence models.
• Access is limited to the subprocessors listed in section 6.2, only to the extent needed to run the service, for example the database hosting provider.

12.3 Revoking access and deleting data

• You can revoke Picvelo's access to your Google account at any time on the Google account permissions page.
• Deleting your Picvelo account also deletes the link to the Google account and the data received from it, under the rules in sections 5 and 8.3.
• To unlink Google sign-in without deleting the account, send a request to [email protected].

12.4 Compliance with Google policies

Picvelo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

12.5 Facebook and Apple

Facebook sign-in (email, public_profile scopes) and Apple sign-in (name, email) work the same way: we receive the account identifier at the provider, the e-mail address and, if shared, the name. Apple lets you hide your real address and pass a private relay address instead, which we fully support. We treat this data exactly like Google account data, as described in sections 12.2 and 12.3.

13. Data security

Picvelo applies appropriate technical and organisational measures ensuring a level of security appropriate to the risk, in accordance with Article 32 GDPR:

• Encryption in transit: HTTPS (TLS 1.2+) for all connections, HSTS
• Password encryption: the bcrypt algorithm with an appropriate cost factor
• Two-factor authentication (2FA): optional for photographers, based on TOTP
• Protection against attacks: Content Security Policy (CSP), CSRF protection, SQL prepared statements
• Access control: the principle of least privilege, access audit logs
• Backups: automatic daily backups of the database and configuration with 30-day retention
• Monitoring: critical error alert sent immediately via an internal technical channel, server logs, and automated checks of service uptime and backup freshness
• Security testing: automated static code analysis and dependency vulnerability checks on every code change (CI)

In the event of a personal data breach that may result in a risk to the rights and freedoms of natural persons, Picvelo will report it to PUODO within 72 hours (Art. 33 GDPR) and notify the affected persons where the risk is high (Art. 34 GDPR).

14. Changes to the Privacy Policy

Picvelo may update this Privacy Policy. We will give notice of significant changes:

• By email to the address assigned to the photographer's account, at least 14 days before the changes take effect
• By a message in the administration panel of the service
• By updating the date "Last updated" at the bottom of this document

Continued use of the service after the changes take effect means that you accept them. If you do not accept the changes, you may terminate the contract in accordance with the Terms and Conditions.

Archived versions of the Policy are available on request at: [email protected]

15. Additional information for California and other US residents

This section applies to residents of California and of other US states whose privacy laws give them specific rights.

• Data and purposes. The categories of data we collect, the purposes and the recipients are described in sections 3 to 6.
• No sale of personal data. Picvelo does not sell personal data.
• Advertising and analytics. With your consent, the Google Ads tag, Google Analytics and Microsoft Clarity may run on our public pages (see the Cookie Policy). Some US state laws treat advertising and analytics tags as "sharing" or "targeted advertising". You can refuse or withdraw consent at any time in the cookie settings at the bottom of the page.
• Your rights. Depending on where you live, you can ask us to tell you what personal data we hold about you, to give you a copy, to correct it and to delete it. We will not discriminate against you for exercising these rights. Send your request to [email protected]; we may need to verify your identity before acting on it.
• Authorised agents. You may use an authorised agent to submit a request; we may ask for proof of their authority.

This document was prepared on the basis of the legal situation as at 2026-05-26. Last updated: 2026-10-22.