Privacy Policy

1. Purpose of the document

This document sets out the principles of processing personal data of users of the PHOTTR mobile application (hereinafter referred to as the "Application"), operated by Phottr s.r.o. as the data controller, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 110/2019 Coll., on the processing of personal data.

2. Scope of the data processed

• Login credentials: email and name obtained through Firebase Auth when using Apple Sign-In or Google Sign-In.
• User content: photos uploaded to the app for editing and export purposes. We do not store metadata (EXIF, GPS).
• Technical data: anonymised telemetry data (device model, operating system version) via Sentry to ensure functionality and error reporting.
• Usage data: records of how the Application and the web application at cloud.phottr.com are used, for example which features are used. They are linked to the user's account ID and organisation ID, never to their name or email. See section 12.
• Operational logs: the IP address may be temporarily logged in the server logs, but is not processed in a targeted manner.

3. Method and place of processing

The photos are processed on the user's device, in the Google Cloud (EU) and partly via a technology partner based in the USA, with transfer in accordance with the requirements of the GDPR (standard contractual clauses).

Photos remain stored on cloud storage until the user deletes them.

When processing via the partner's API, the photos are not stored on the partner's servers.

When exporting data to third-party systems, we only transfer the product data created by the user in the application - i.e. the photo, name and product code.

4. Recipients of personal data

Personal data may be disclosed to the following categories of recipients:

• Apple and Google (login providers).
• Infrastructure providers (Google Cloud - EU, technology partner - USA).
• Telemetry provider (Sentry).
• Product analytics provider (PostHog, data stored in the EU), see section 12.
• Apple (for In-App Purchase payment processing).
• Shoptet (recipient of exported photos).
• Google (website traffic analytics) and OpenAI (measurement of ads in ChatGPT), only with the consent given in the cookie banner of the phottr.com website, see section 11.

Transfers outside the European Economic Area are carried out in accordance with Chapter V of the GDPR.

5. Legal basis for processing

• Fulfillment of the contract according to Article 6(1)(b) of the GDPR - provision of application functions, in particular photo editing and export.
• Legitimate interest under Article 6(1)(f) GDPR - ensuring the security and functionality of the application, including telemetry and troubleshooting.
• Compliance with the legal obligation under Article 6(1)(c) of the GDPR - storing accounting and tax documents in accordance with Act No. 563/1991 Coll., on Accounting, and Act No. 235/2004 Coll., on Value Added Tax, for the period specified in these regulations.
• Consent under Article 6(1)(a) GDPR - analytics and ad measurement cookies on the phottr.com website (section 11) and usage analytics in the Application and the web application (section 12). Consent can be withdrawn at any time.

6. Data retention period

• Photos: until deleted by the user.
• Technical and error logs: 30 days.
• Usage data: until the user account is cancelled, for at most 7 years.
• Accounting and tax documents: for up to 10 years, according to the relevant legislation.
• After cancellation of the user account, all related data is deleted within 7 days.

7. Rights of data subjects

Data subjects have the right to:

• access to personal data,
• correct inaccurate data,
• erasure ("right to be forgotten"),
• limit processing,
• data portability,
• object to processing,
• lodge a complaint with the Office for Personal Data Protection or another competent supervisory authority.

Requests to exercise rights can be made by email to legal@phottr.com.

8. Processing security

• All communication is via an encrypted connection (HTTPS/TLS).
• Data is stored in encrypted storage.
• Access to the infrastructure is protected by two-factor authentication.
• Only authorised persons have access to the data under an internal access policy.

9. Changes to the Policy

The Administrator reserves the right to modify this policy at any time. Users will be notified of material changes through an in-app notice and by posting an updated version on the website.

10. Dispute Resolution

Any disputes arising in connection with the use of the PHOTTR Application or this Policy shall be settled by arbitration in the Czech language under the laws of the Czech Republic. This provision is without prejudice to the consumer's right to apply to a competent court under generally binding legislation.

11. Cookies on the phottr.com website

The phottr.com website uses cookies only with the visitor's consent, given separately for each purpose in the cookie banner. The choice itself is stored in the browser's local storage.

Analytics (Google Analytics). If you consent, we measure site traffic with Google Analytics. It stores the cookies _ga and _ga_* (up to 2 years) and shares visit data with Google. You can withdraw consent at any time in Cookie settings.

Ad measurement (OpenAI). If you consent, we use the OpenAI Ads measurement code to find out whether a visit or enquiry came from our ad in ChatGPT. The code stores the cookies __oppref (30 days) and __obref (365 days) and shares conversion data with OpenAI. Form data is hashed before it is sent. We don't use this data for personalised ads. You can withdraw consent at any time in Cookie settings.

12. Usage analytics (PostHog)

To find out which features are useful and where users get stuck, we analyse how the Application (iOS and Android) and the web application at cloud.phottr.com are used. We use PostHog, operated by PostHog Inc., as our processor. The data is stored in the EU (Frankfurt, Germany).

In the apps, only with consent. Each user is asked whether Phottr may collect usage data. Only if they allow it do the Application and the web application send PostHog records of their actions, such as the screens viewed, a product created or a style selected. To do this, PostHog stores an identifier on the device (in the web browser, in local storage). Any user can turn this on or off at any time in Settings › Privacy in the Application, or under Privacy in the user menu of the web application. Turning it off stops collection on that device straight away, and on the user's other devices the next time they open the app. We keep a record of when consent was given and withdrawn.

What we don't send. Records are linked to the user's account ID and organisation ID. They never contain names, email addresses, photos, product names or text the user types. PostHog does not store IP addresses, but may use them briefly to estimate the country and city. We don't record the screen and we don't use the data for advertising.

Usage data is kept for at most 7 years and is deleted when the user account is cancelled (section 6). Requests to delete it earlier can be sent to legal@phottr.com.