1. Who is responsible

Photizy is operated by Yeah Works, Unipessoal Lda, tax number PT507644387, Av. Prof. Dr. Carlos Ribeiro, 82, 2840-473 Seixal, Portugal. For anything related to your personal data, write toteam@photizy.com.

This policy covers the photizy.com website, the app at app.photizy.com and the galleries hosted at photographers' addresses like name.photizy.com.

2. Two different roles

For photographers' accounts, website visitors and newsletter subscribers, we are the data controller — we decide how and why the data is processed.

For the photos and client data inside a photographer's galleries (names, emails, selections, orders, delivery addresses), we act as a processor on behalf of the photographer, who is the controller. If you are a photographer's client and want to exercise your rights over that data, contact your photographer first; if you contact us, we will forward your request to them and help resolve it.

3. What we collect

Account data — name, email, password (stored only as a secure hash), gallery address (handle), language and currency preferences, and two-factor/passkey credentials if you enable them.
Billing data — plan, subscription status and Stripe identifiers. Card numbers are handled by Stripe and never touch our servers.
Content — the photos you upload and your gallery settings, stored to provide the Service.
Client data, on behalf of photographers — the name and email a client leaves when selecting photos or ordering, the photos selected or bought, and, for print orders, the delivery address collected at checkout.
Newsletter — the email address you subscribe with on photizy.com.
Technical data — IP address, browser information and server logs generated when you use the Service, used for security and troubleshooting.

4. Why we process it

To provide the Service (performance of a contract) — accounts, galleries, orders, support.
To bill you (contract and legal obligation) — subscriptions, invoices, tax records.
To keep the Service secure and improve it (legitimate interest) — logs, abuse prevention, aggregate usage.
To send the newsletter (consent) — only if you subscribed; every email includes an unsubscribe link.
To send service emails (contract) — email verification, order confirmations, trial and billing notices. These are not marketing and cannot be opted out of while you have an account.

5. Who we share it with

We do not sell personal data and we do not share it for advertising. We share it only with the providers we need to run the Service:

Stripe — payment processing, subscriptions and, for sales, the connection to the photographer's Stripe account.
Cloudflare — photo storage (R2) and content delivery network.
Hosting and email delivery providers — running our servers and delivering the emails described above.

We may also disclose data when the law requires it or to protect our rights, and, if the company is ever sold or merged, to the parties involved under the same protections.

6. International transfers

Some of our providers (such as Stripe and Cloudflare) process data in the United States. Those transfers rely on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, with UK and Brazilian equivalents where applicable.

7. How long we keep it

Account data and content — for as long as the account exists. After closure, content stops being available and is deleted.
Billing records — up to 10 years, as Portuguese tax law requires.
Newsletter email — until you unsubscribe.
Technical logs — for a short period, for security purposes.

8. Your rights

Depending on where you live — under the GDPR (EU), UK GDPR, Brazil's LGPD or US state laws such as the California CCPA — you have the right to access, correct, delete and receive a copy of your personal data, to restrict or object to its processing, and to withdraw consent at any time. We do not sell personal data, so there is nothing to opt out of under the CCPA's "sale or sharing" provisions.

To exercise any of these rights, email team@photizy.com. We will answer within the legal deadline. You can also complain to a supervisory authority: the CNPD in Portugal, the ICO in the United Kingdom, the ANPD in Brazil, or your local authority.

9. Cookies

We use only essential cookies: a session cookie and a security (CSRF) cookie, needed for login and forms to work, and a language cookie that remembers the version of the site you picked. Your theme preference is stored locally in your browser, and for the duration of a visit we keep in your browser which site or campaign brought you here, so that we know which channels work. We do not use advertising cookies or third-party analytics cookies, which is why you do not see a cookie banner.

10. Security

All traffic is encrypted in transit (HTTPS), passwords are stored as secure hashes, and accounts can be protected with two-factor authentication and passkeys. No system is perfectly secure; if a breach affects your data, we will notify you and the competent authority as the law requires.

11. Children

Photizy accounts are for adults (18+). Galleries may contain photos of minors taken by photographers in the course of their work — the photographer is responsible for having the necessary consent from parents or guardians.

12. Changes and contact

If we change this policy in a meaningful way, we will notify you by email or in the app before the change takes effect. Questions? Write to team@photizy.com — Yeah Works, Unipessoal Lda, Av. Prof. Dr. Carlos Ribeiro, 82, 2840-473 Seixal, Portugal.

Privacy Policy