Who we are
CuratePics is a client-gallery delivery platform for professional photographers. For the personal data in this policy, CuratePics is the data controller for account holders (photographers), and a data processor acting on the photographer’s instructions for the images and viewer data within their galleries.
In short: the photographer owns their client relationships and content; we process it on their behalf, in the EU, under a data-processing agreement.
What we collect
From photographers (our customers)
- Account details — name, email, studio name, and authentication credentials.
- Billing information — processed by our payment provider; we store only a token and invoice metadata, never full card numbers.
- Content you upload — photographs and the galleries, titles and settings you create.
- Usage & diagnostics — logs needed to run the service reliably (uploads, deliveries, errors).
From gallery viewers (your clients)
Client galleries require no account. A viewer opens a gallery from a private capability-token link. We do not ask viewers to register or hand over personal details to view or download their photos. Where a gallery is PIN-gated, we process only the access attempt, not an identity.
Legal basis for processing
- Contract — to provide the service you sign up for (hosting, delivery, downloads).
- Legitimate interests — to keep the service secure, reliable and abuse-free, balanced against your rights.
- Legal obligation — to meet accounting, tax and lawful-request requirements.
- Consent — for any optional communication; withdrawable at any time.
How we use data
We use personal data to operate the platform: to store and deliver galleries, verify uploads, send transactional emails (delivery, receipts, security), provide support, and improve reliability. We do not sell personal data, and we do not use your clients’ photographs to train models or for advertising.
Storage & EU residency
Personal data and content are stored and served from EU-jurisdiction infrastructure, with an EU-hosted application database. Data is encrypted in transit (TLS) and at rest.
Sub-processors
We keep the processing chain deliberately short and EU-first. Each sub-processor is bound by a data-processing agreement. The current, authoritative list — with purpose and region — is maintained on our Trust & security page and updated before any change takes effect.
Retention & deletion
We keep personal data only as long as needed to provide the service or meet legal obligations. Deletions are soft-deleted first and recoverable within a retention window before being permanently removed.
Your rights under the GDPR
Wherever you are, we extend the following rights to all users:
- Access — get a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request deletion, subject to legal retention.
- Portability — receive your data in a portable format.
- Restriction & objection — limit or object to certain processing.
- Complaint — lodge a complaint with your local supervisory authority.
To exercise any right, contact us below — we respond within statutory timeframes.
Contact & DPO
For any privacy question or to exercise a right, email privacy@curatepics.app. For contractual data-processing terms, request our Data Processing Agreement.
This policy may be updated; material changes will be notified in-app or by email, and the “last updated” date above will change.