Privacy Policy

Effective: February 1, 2026

This Privacy Policy explains what personal data Photo Bridge collects, how we use it, who we share it with, and the rights you have under global data-protection laws — including the EU / UK General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act as amended by the CPRA ("CCPA"), Brazil's LGPD, Canada's PIPEDA, South Africa's POPIA, Japan's APPI, Singapore's PDPA, Australia's Privacy Act, Nigeria's NDPR, and India's DPDPA.

Controller

The controller of your personal data is Photo Bridge. If you are an EEA / UK resident, our EU representative can be contacted at privacy@photobridge.app.

Data we collect

• Account data — name, email address, profile picture, password hash, sign-in provider identifiers.
• Content data — the photographs, videos, galleries, watermarks and metadata you upload.
• Payment data — Stripe customer ID, subscription state and payout account IDs. Photo Bridge never sees your card number.
• Usage data — page views, gallery-view logs, download counts, IP addresses (rolling 30 days), device and browser identifiers.
• Communication data — support tickets and their attachments.

Legal bases (GDPR)

• Contract — running the Service you asked for.
• Legitimate interests — securing the Service, preventing fraud, product analytics.
• Consent — cookies that aren't strictly necessary; marketing emails.
• Legal obligation — tax, accounting, response to lawful requests.

How we use your data

To operate the Service, secure your account, process payments, deliver client galleries, generate marketing videos, send transactional email, comply with law and improve the product. We do not sell or share your personal information for cross-context behavioural advertising within the meaning of the CCPA.

Sub-processors

We use a small set of vetted sub-processors: Stripe (payments), Emergent LLM (AI features), Google (auth), Resend (email), Cloudflare (CDN), Mongo Atlas / cloud storage (data at rest). Each is bound by a data-processing agreement. A current list is available on request.

International transfers

Data is stored in the United States. Where we transfer personal data out of the EEA / UK / Switzerland we rely on the EU Commission's Standard Contractual Clauses (2021/914) and the UK IDTA, supplemented by encryption in transit and at rest.

Retention

Account and content data are retained for the life of the account plus up to 90 days of backup rotation. Payment records are retained for 7 years to satisfy accounting law. Usage logs are retained for 30 days.

Your rights

Depending on where you live, you may have the right to access, correct, delete, port or restrict the processing of your data, to object to certain processing, and to withdraw consent at any time. EEA / UK residents can lodge a complaint with their local supervisory authority. California residents have additional rights under the CCPA including the right to opt out of "sales" or "sharing" (we do neither) and the right against automated decision-making. Brazilian residents can invoke every right under LGPD Art. 18. To exercise any right, email privacy@photobridge.app — we respond within 30 days.

Children

The Service is not directed to children under 16 (13 in the US). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

Security

We use TLS 1.2+ everywhere, at-rest encryption, hashed password storage (bcrypt), least-privilege access controls and regular penetration testing. No system is 100% secure — please use a strong, unique password and enable your identity provider's two-factor authentication.

Changes

Material changes are posted here at least 14 days before they take effect and — where required by law — notified by email.