Privacy policy

1. Who we are

The service at profotograaf.nl is operated by ProFotograaf, a Dutch sole proprietorship registered with the Chamber of Commerce under KVK 84222689 ("we", "us"). For questions about this policy, or to exercise any of the rights in section 11, write to [email protected].

2. Two roles, and why the difference matters

We handle personal data in two distinct capacities, and your rights differ between them.

• Towards photographers we are the controller. You sign up, we hold your account, your billing details and your content, and this policy governs that relationship.
• Towards a photographer's clients and website visitors we are a processor. If you are a couple who received a wedding gallery, the photographer decides what is collected and for how long. This policy tells you what we do on their behalf, but a request to delete that data goes to the photographer first. We will always help; see section 12. The terms for this role are in our data processing agreement.

3. What we collect

Account and sign-in. We do not run our own password login. Accounts are authenticated by our identity provider, which passes us your name, email address and an account identifier. We never see or store your password.

Your profile and website. Everything you type into your portfolio: display name, headline, biography, location, contact email, social links including an Instagram handle, and the text and layout of every page you publish.

Your photos and video. The files you upload, the smaller renditions we derive from them, and the technical metadata that travels inside them. Camera files often carry the time, the camera and sometimes GPS coordinates; we store the file as you gave it to us.

Your clients. The CRM records you create: name, email, phone, your own notes, bookings, quotes, invoices and the messages exchanged in the client portal. This is data about other people that you have entered. See section 2.

Visitors to your public pages. When someone submits a contact form on your site we store their name, email, message, browser user agent and IP address, so you can answer them and so we can defend against abuse. We remove that address and user agent twelve months after the message arrives; the message itself stays with you. Gallery visitors who comment or react leave a display name and the text they wrote.

Usage measurement. We count gallery views, portfolio views and downloads. Anonymous viewers are counted under a key derived by hashing their IP address together with their browser user agent; we do not keep the address itself in those records. The hash is keyed with a secret held on our servers and the key changes every calendar month, so a stored key cannot be turned back into an address and a visitor cannot be followed from one month to the next. Twelve months after a view or download we remove the key from the record. The date and the gallery remain, and the counts are built from those.

Billing. If you subscribe to a paid plan, our payment provider holds the card details; we never receive them. We store a customer reference, your billing email, the plan you are on and the status and history of your subscription.

Devices. If you pair the desktop uploader, we store a device name, platform, application version and hostname so you can see and revoke your own devices. Your own use of the app. We also record a visual replay of your sessions in the app: the pages you visit, where you click and how the screen looks as you use it, so we can diagnose bugs and understand which features actually get used. Password fields, payment details and the identity-provider's own widgets are excluded from every recording before it is ever captured.

4. Instagram

Connecting an Instagram account is entirely optional and off by default. Nothing in this section happens unless you connect one, and disconnecting reverses all of it. When you do connect, we ask Meta for the narrowest set of permissions that makes the feature work:

• Basic account access. We read your Instagram account identifier, username and profile picture, and store them on the connection record so the app can show you which account is linked. We do not read your existing posts, your follower list or your insights.
• Publishing. When you choose to publish a photo, we send Meta an image that is already stored in your ProFotograaf library together with the caption you wrote. Publishing is always an action you take deliberately; nothing is posted automatically, and we do not read the media already on your account.
• Messages. If you turn on the Instagram inbox, we receive the messages sent to your business account and the handle of the sender, and store them alongside that person's record in your CRM so a conversation that started on Instagram does not get lost. We do not request access to comments.

Why. Photographers get found on Instagram and then have to run their business somewhere else. The connection exists so that publishing your work and answering the people who reply to it happen in the same place as your galleries and invoices. We do not use Instagram data to build advertising profiles, and we never sell it.

How long we keep it. Instagram data lives for as long as the connection does. Disconnect the account and we delete the connection record, the stored access token and the Instagram messages we hold for you. Delete your ProFotograaf account and the same happens as part of that erasure. See our data deletion instructions.

Your use of the connection is also subject to Meta's own terms and privacy policy. Data we have already received is governed by this policy; data that stays on Instagram is governed by theirs.

5. Suppliers a photographer credits

A photographer can credit the other suppliers who worked on a job: the florist, the venue, the band, the second shooter. To do that they enter that supplier's name, website, Instagram handle and sometimes an email address. The name, website and handle are published: they appear on the photographer's public pages, on the gallery a couple receives and on the wedding page the couple shares with their guests. The email address is never published. It exists so that the person named can be told they have been credited and be given a link to remove the listing.

The legal basis is the photographer's assertion. A credit is the photographer's own statement about who worked on their job. We do not ask the supplier first, and being listed is not consent to anything. We rely on the legitimate interest a professional has in saying publicly who did the work. That is exactly why removal is unconditional, immediate, and requires no account.

Removing yourself. Anyone who has been credited can remove their own listing from the link carried by any message we send about it: the address has the form /credits/remove/ followed by a one-time token. There is no login, no account, and no reason to give. Pressing the button deletes that listing and every other listing carrying the same website, Instagram handle or email address, and takes them off every public page on the next request.

Why we keep something afterwards. After a removal we keep the normalised website, handle and email address on a suppression list. It stops any photographer from listing you again and stops us emailing you. It holds those identifiers and nothing else, and we would have to erase it to undo your removal.

Have no link? Write to [email protected] and we will remove the listing and add you to the suppression list ourselves.

6. Why we are allowed to use it

• To perform our contract with you: running your account, hosting your site, storing and delivering your galleries, taking payment.
• Because we have a legitimate interest: keeping the service secure and available, preventing abuse, understanding which features are used, and diagnosing errors. We weigh this against your privacy and use pseudonymous data where it does the job.
• Because you consented: connecting an Instagram account, and any optional integration you switch on. You can withdraw consent by disconnecting.

7. Who else processes it

We do not sell personal data and we do not share it for advertising. We do rely on the following providers to run the service. Several are self-hosted by us in the Netherlands; those are listed too, because being our own supplier is not a reason to leave them out.

8. Where it is stored

The application, its database and our own mail and monitoring run on servers in Germany (Layer7). Your photos are stored at Cloudflare R2, where Cloudflare chooses the location and no EU jurisdiction is set. Stripe, Prodigi, OpenRouter, Honeycomb and Meta may process data outside the EEA; where they do, transfers rest on the European Commission's standard contractual clauses or an adequacy decision.

9. How long we keep it

We will be plain about this, because vague retention language is how data quietly accumulates forever.

• Your content and your account data are kept until you delete them. We do not run a background job that erases old galleries, old photos or old client records. If you want something gone, delete it. If you delete your account, it goes offline at once and everything in it is erased after 14 days. Until then you can restore it, and we e-mail you at the start, after 7 days and 1 day before the erasure. See our data deletion instructions.
• Visitor identifiers are removed after twelve months. This covers the viewer key stored with gallery views, portfolio views and downloads, and the address and user agent stored with contact form messages. A daily job clears them; the counts you see in your dashboard stay. The hash of a commenter's address, which only limits how often one visitor can comment, is cleared after 24 hours.
• Galleries on the free plan stop being reachable 14 days after they are created. That is an access limit. The photos stay yours and stay stored, and they become reachable again if you upgrade.
• Invoices are not kept once your account is erased. Before deleting, download all of them from your account settings as an archive with a PDF per invoice and a CSV summary. Keeping them for the retention period that applies to you is your responsibility.
• Instagram data is kept for as long as the connection exists and is deleted when you disconnect.
• Backups roll over on their own schedule, so deleted data can persist in a backup for a short period after it disappears from the live service.

10. Security

Traffic is encrypted in transit. Passwords never reach us. Client portal links and gallery links are unguessable tokens, and portal tokens are stored only as a hash, so a copy of our database does not hand over access to your galleries. Access to production systems is limited to the operator. No system is perfect; if we discover a breach that puts you at risk, we will tell you and the Dutch Data Protection Authority within the time the law allows.

11. Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, hand it over in a portable form, restrict what we do with it, or object to processing we base on legitimate interest. Where processing rests on consent you can withdraw it at any time, which does not affect what happened before.

You can delete your account yourself, without asking us. It goes offline at once and is erased after 14 days, and you can restore it until then. See our data deletion instructions. For anything else, write to [email protected] and we will answer within one month.

If you think we have got it wrong, you are entitled to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or to the supervisory authority where you live. We would rather you told us first.

12. If a photographer sent you here

If you received a gallery, an invoice or a portal login from a photographer, they decide what happens to your data and we act on their instructions. Ask them first. If you cannot reach them, or they do not act, write to [email protected] and we will help: we can always tell you what we hold, and we will step in where the law puts the obligation on us.

13. Cookies

We set a cookie to keep you signed in, and a cookie to remember that you unlocked a password-protected gallery. Your language choice is kept in your browser's local storage and in a cookie called pf_lang, so the server can answer in your language when you open a page without a language in its address. There are no advertising cookies and no third-party tracking scripts on our pages. That is why you are not being asked to accept anything.

14. If we wrote to you and you are not a customer

We sometimes write to photography businesses that are publicly listed, to introduce the service. If that is how you came to hear from us: we hold your business name, business email address, town and website, taken from public listings, and a record of which messages we sent you and when.

Those messages measure whether they were opened and whether a link in them was followed. We use that only to decide whether to write again and whether the message was worth sending. It is not combined with anything else, not sold, and not shared.

Every message carries an unsubscribe link, and your mail program may also offer a one-click unsubscribe of its own. Using either stops all further mail from us permanently (including any other kind of message we send), and we keep only your email address, for the sole purpose of not writing to you again. You can also write to us at the address in section 1 and ask us to erase what we hold.

15. Children

The service is a business tool and is not directed at children. We do not knowingly create accounts for anyone under 16. Photographs of children uploaded by a photographer are that photographer's responsibility, and they must have the consent the law requires.

16. Comments on a photographer's site

A visitor can comment on a photographer's blog post or photo. The photographer decides what is published and is the controller of those comments. We store them on the photographer's behalf.

• What we store: the name you type, your email address, an optional website, the text of the comment, and a salted hash of your IP address. The hash is used only to limit how often one visitor can comment. It cannot be turned back into your address and it is never shown. We clear the hash after 24 hours.
• Who sees it: the name, website and text are shown on the page once the photographer approves the comment. Your email address is never shown to anyone except the photographer.
• How long: a comment stays until the photographer deletes it or the photographer's account is deleted. Comments marked as spam are deleted after 30 days.

Removing your comments. Open /comments/remove on the photographer's site, enter the email address you commented with and we send a link to it. The link works once and for 24 hours. Pressing the button on the page it opens deletes every comment with that address on that one site, together with any replies the photographer wrote to them. Comments on other sites are not touched. The page gives the same answer for an address we do not know, so it reveals nothing about who commented. Without access to the mailbox, write to [email protected].

17. Changes

When we change this policy we update the date at the top. If a change materially affects what we do with your data, we will tell you by email before it takes effect.