Draft — to be reviewed before launch.
Data Processing Agreement
Parties and roles
Controller: the photographer or studio that holds the gallerypics account (“you”). You decide which photos and gallery details are uploaded and who they are shared with.
Processor: gallerypics (“we”), run by:
Subject matter and duration
We store your galleries and deliver them to the couples and guests you share them with. We process the data for as long as your studio has galleries with us, and until deleted data has been purged 30 days after its deletion.
Nature and purpose of the processing
- Storing the original photos you upload.
- Making thumbnails and web-size copies of each photo, with all metadata from the original file removed (including GPS).
- Showing your galleries to the people you give the link (and PIN) to, and letting them download photos as you allow.
- Creating the couple's private gallery link, which you share with them yourself.
- Counting PIN attempts by salted IP hash to stop PINs from being guessed.
Types of personal data
- Photos, which may show identifiable people, and the metadata in the original files (which may include a GPS location).
- Which photos are hidden from guests, and whether you or the couple hid them.
- The couple's names, the event date and venue.
- The couple's private gallery link. You create it in the dashboard and share it with the couple yourself; the database keeps only a hash of it.
- Salted hashes of guests' IP addresses, kept for about two hours.
- Guests' IP address and browser details, which Clerk (United States) receives because its sign-in script loads on gallery pages.
- IP addresses and requested page addresses (including the couple's private link) in the access logs of our hosting and network providers, Railway and Cloudflare, and in the sampled performance traces (one in ten) that go to Sentry.
Categories of data subjects
- Couples
- Guests who view a gallery
- People shown in the photos
Instructions and confidentiality
Copy to come — Processing only on your documented instructions; confidentiality of staff with accessSub-processors
We use these sub-processors:
| Company | Purpose | Location |
|---|---|---|
| Clerk | Sign-in and accounts for photographers and their team members. Its script also loads on gallery pages, so it receives guests' IP address and browser details | United States |
| Stripe | Subscription payments and invoices | United States |
| Cloudflare | Photo storage (R2), image delivery and network protection | EU (R2 storage); delivery and caching through its worldwide network |
| Railway | Hosting of the app, the background worker and the database | EU region |
| Sentry | Error reports and sampled performance traces | Copy to come — This processor's data region (Sentry: the region of the Sentry organization) |
The app, worker and database run in Railway's EU region; photos are stored in Cloudflare R2's EU jurisdiction; Cloudflare caches thumbnails and web-size copies (never originals) in its worldwide network for delivery. Clerk and Stripe are in the United States. See also the Privacy Policy.
Copy to come — Legal basis for transfers to Clerk and Stripe in the US (e.g. Standard Contractual Clauses)Copy to come — How photographers are told about new sub-processors and can objectSecurity measures
- Photos are kept in a private storage bucket with no public access.
- Gallery images are served only to viewers holding a signed, expiring access cookie for that gallery. Originals are never served by the image server; full-size downloads use links that expire after 5 minutes.
- All traffic is encrypted in transit (HTTPS).
- Gallery PINs are stored encrypted. The database stores couple links only as hashes.
- PIN attempts are rate-limited per gallery and per IP address.
- Access control: only members of your studio can open its dashboard; billing is limited to studio admins.
- Gallery pages and images tell search engines not to index them.
Personal data breaches
Copy to come — How and how fast photographers are told about a personal data breachAssistance
Copy to come — How gallerypics helps with data subject requests and impact assessments, and at what costDeletion at the end of the service
You can delete photos and galleries at any time in the dashboard. Deleted data can be restored for 30 days and is then permanently deleted from storage; a deleted gallery's page stops working at once. When your studio is deleted, all of its galleries are deleted and then permanently deleted after 30 days. We keep no backup copy of your photos.
Thumbnails and web-size copies can stay in Cloudflare's cache until it evicts them. Only someone with access to the gallery can fetch them. When a gallery is deleted, guests' and the couple's access to its images ends within 12 hours. Members of the photographer's own studio can still load cached images until they are evicted.