Privacy Policy

1. Data Controller

Photo(n) ("we", "us", or "our") is the data controller responsible for your personal information under this Privacy Policy.

2. Information We Collect

2.1 Account Information

• Email address - For account creation and authentication
• Name - From OAuth providers or user input
• Profile picture - From OAuth providers (optional)
• OAuth tokens - From Google, Apple, or Microsoft sign-in

2.2 Photo Data

• Image files - Photos you upload to our service
• EXIF metadata - Camera settings, date taken, GPS location (if available)
• User-provided metadata - Titles, descriptions, tags you add
• AI-generated descriptions - Automatically created using Google Gemini AI
• AI-generated descriptions - Automatically created using Mistral AI (EU-based)

2.3 Location Data

• GPS coordinates - From photo EXIF data or browser geolocation (with consent)
• Geocoded addresses - City, country, and location names derived from coordinates

2.4 Usage Data

• Device information - Browser type, operating system
• IP address - For security and analytics
• Activity logs - Upload timestamps, interactions with photos

3. AI Processing (Google Gemini)

3.1 What Data is Sent to Google

• Your photo - A compressed thumbnail version (max 10MB) for analysis
• Your description - Any text description you provide (optional)
• AI tone preference - Your selected analysis tone (positive/neutral/critical)

3.2 Processing & Security

3.3 Google's Data Usage Policy

• Data submitted via the API is not used to train public AI models
• Your photos are processed temporarily and are not stored by the AI model after analysis
• Google's processing is governed by their Terms of Service and Privacy Policy

3.4 Your Consent

We require your explicit consent before sending any photos to Google for AI analysis. You must check the consent box during photo upload. Without consent, you cannot upload photos (AI analysis is currently required for all uploads).

3.5 Legal Basis

• GDPR Article 6(1)(a) - Your explicit consent
• GDPR Article 49(1)(a) - Explicit consent for international transfer

3. Mistral AI Processing

3.1 What Data is Sent to Mistral AI

• Your photo - A compressed thumbnail version (200x200px) for analysis
• Your description - Any text description you provide (optional)
• AI tone preference - Your selected analysis tone (positive/neutral/critical)

3.2 Processing Location (EU-Based)

This is a significant privacy improvement over US-based AI providers and ensures your photos remain under strong EU data protection laws at all times.

3.3 Mistral AI's Data Usage Policy

• Mistral AI does NOT use your photos to train their AI models
• Your photos are processed temporarily and are not stored by Mistral AI
• Mistral AI may log requests for abuse prevention and debugging
• Mistral AI's processing is governed by their Terms of Service and Privacy Policy

3.4 Your Consent

We require your explicit consent before sending any photos to Mistral AI for analysis. You must check the consent box during photo upload. Without consent, you cannot upload photos (AI analysis is currently required for all uploads).

3.5 Legal Basis

• GDPR Article 6(1)(a) - Your explicit consent
• GDPR Article 28 - Data Processing Agreement with Mistral AI
• No international transfers - All processing stays within the EU

4. How We Use Your Data

We process your personal data for the following purposes:

• Service provision - To provide photo storage and management features
• AI analysis - To generate automatic photo descriptions (with consent)
• Authentication - To verify your identity and secure your account
• Communication - To send service notifications and updates
• Security - To prevent fraud and protect our services
• Legal compliance - To comply with legal obligations

Legal Basis for Processing

• Contract performance (Art. 6(1)(b) GDPR) - Providing our services
• Consent (Art. 6(1)(a) GDPR) - AI processing, location data, marketing
• Legitimate interests (Art. 6(1)(f) GDPR) - Security, fraud prevention
• Legal obligation (Art. 6(1)(c) GDPR) - Compliance with laws

5. Third-Party Services

5.1 OAuth Providers

5.2 Google Gemini AI

See Section 3 above for detailed information about Google Gemini processing.

5.2 Mistral AI

See Section 3 above for detailed information about Mistral AI processing (EU-based).

5.3 Cloud Storage

We use S3-compatible cloud storage to securely store your photos. Your images are encrypted at rest and during transmission.

5.4 Firebase Cloud Messaging

We use Firebase Cloud Messaging (FCM) to send push notifications for comments, likes, and other interactions (with your consent).

5.5 Mapping and Location Services (OpenStreetMap)

6. Your Rights Under GDPR

As an EU resident, you have the following rights:

Response Time: We will respond to your request within 30 daysas required by GDPR.

7. Data Retention

We retain your data only as long as necessary for the purposes outlined in this policy or as required by law.

7.1 Active Account Data

• Account Data: Retained while your account is active
• Photos & Content: Retained while your account is active or until you delete them
• AI Analysis Data: Stored with your photos; deleted when photo is deleted
• Activity Logs: Retained for 90 days for security purposes

7.2 Account Deletion Process

When you request account deletion, we follow this GDPR-compliant process:

7.3 Data Retention Exceptions

We may retain certain data longer when:

• Legal Obligation: Required by law (tax, financial records)
• Legal Claims: Needed for establishment, exercise, or defense of legal claims
• Public Interest: Required for archiving purposes in the public interest

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption: All data encrypted in transit (TLS/HTTPS) and at rest
• Authentication: Secure JWT token-based authentication with HttpOnly cookies
• Access Control: Strict role-based access controls
• Image Compression: Automatic EXIF stripping for privacy
• Password Security: Bcrypt password hashing with salt
• Regular Audits: Security monitoring and vulnerability assessments

9. Cookies and Tracking

9.1 Essential Cookies

We use the following essential cookies (no consent required):

• accessToken: Authentication token (7 days, HttpOnly, Secure)
• refreshToken: Token refresh (30 days, HttpOnly, Secure)

9.2 Analytics Cookies

We currently do not use analytics cookies. If we implement analytics in the future, we will request your consent.

10. Children's Privacy

Our service is not intended for children under 18 years of age. We do not knowingly collect personal data from children under 18. If you believe we have collected data from a child under 16, please contact us immediately at info@photo-n.world, and we will delete it promptly.

11. International Data Transfers

Current Setup

We have implemented EU-only data processing for both Google Gemini AI and Mistral AI. Your photos are processed in European data centers (France, Belgium, or Germany) to eliminate international data transfers for AI processing, ensuring full GDPR compliance.

Future Implementation

Before public launch, we will implement EU-only data processing using Google Cloud Vertex AI (europe-west1 region) to eliminate international data transfers for AI processing.

Safeguards

• Standard Contractual Clauses (SCCs) with Google
• Google's EU Data Protection commitment
• Your explicit consent before each upload

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending an email notification (for significant changes)

Your continued use of our service after changes become effective constitutes acceptance of the revised Privacy Policy.

13. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your GDPR rights:

14. Supervisory Authority

If you are not satisfied with our response to your privacy concerns, you have the right to lodge a complaint with your national data protection authority:

• EU Residents: Find your authority at edpb.europa.eu