Privacy policy

1. Who is responsible

Powroli is run by Polina Basova (Poland). For anything about personal data, write to hello@powroli.eu.

Powroli decides how the data of photographers (their accounts) and of powroli.eu visitors is processed and is the controller of that data.

The data of a photographer’s clients — photos in galleries, favourites, booking requests, orders — is processed on the photographer’s behalf. The photographer is the controller of that data and Powroli is the processor (art. 28 GDPR, see the Terms of use). Questions about it are best sent to the photographer first.

2. What data and why

Account: email, name, username, sign-in method (Google, Apple or an email link), language and notification settings. Needed to provide the account — contract (art. 6(1)(b) GDPR).

Photos and videos uploaded by photographers, with their technical data (EXIF: camera, time, sometimes place). Needed to store and show galleries and sites — contract.

Gallery and site visitors: no tracking cookies are set. To count visits, a one-way hash of the IP address, browser and gallery, with a salt that changes every day, is stored for one day; IP addresses themselves are not kept. A name or email is collected only when the visitor enters it (favourites, booking form). Legitimate interest (art. 6(1)(f)) — statistics for the photographer and protection against abuse.

Face recognition is off by default. A photographer turns it on for a gallery only when the people in the photos agree. Faces are turned into numeric vectors to group photos of the same person; these are biometric data (art. 9 GDPR), processed on the basis of explicit consent collected by the photographer. A selfie used for “Find me” is analysed in memory and never stored. Turning the feature off deletes all face data of the gallery.

Orders: name, email, phone, delivery address, what was bought and the amount. Card details are entered only on Stripe’s payment page and never reach Powroli. Needed to carry out the purchase — contract; records kept for tax law — legal obligation (art. 6(1)(c)).

Email letters (invitations, galleries sent to clients, order confirmations, notifications) are sent through Brevo — contract or the photographer’s notification settings.

Analytics on powroli.eu: Google Analytics runs only after the visitor accepts it in the cookie banner — consent (art. 6(1)(a)), which can be withdrawn at any time. It never runs on photographers’ galleries and sites.

3. Who receives the data

Google Cloud and Firebase — database, sign-in and servers in the EU (Belgium and the Netherlands).

Cloudflare — file storage in the EU (R2, EU jurisdiction) and content delivery.

Stripe — payments (Stripe Payments Europe, Ireland). Money goes to the photographer’s own Stripe account.

Prodigi — prints made by the lab: receives the photo file and the recipient’s name, address, phone and email to print and deliver the order.

Brevo (France) — sending email.

Telegram — only if a photographer connects notifications; then short notices about requests and orders go to their chat.

Google and Apple — sign-in with Google or Apple; Google Analytics after consent.

Data is never sold or used for advertising.

4. Transfers outside the EEA

Data is stored in the EU. Some providers (Google, Cloudflare, Stripe) may access it from the USA; such transfers rely on the EU–US Data Privacy Framework or standard contractual clauses. Prodigi is based in the United Kingdom, which has an EU adequacy decision.

5. How long data is kept

Account and content: until the photographer deletes them or the account. Deleting the account (Account → Delete account) removes the profile, galleries, files, sites, requests, statistics and the sign-in.

Visit hashes: one day. Gallery statistics: as long as the gallery exists.

Orders: as long as tax and accounting law requires (in Poland usually five years from the end of the tax year).

6. Rights

Everyone has the right to access their data, to have it corrected or deleted, to restrict or object to its processing, to take it to another service, and to withdraw consent at any time without affecting earlier processing. Photographers can download all their data in Account → Export.

To use these rights, write to hello@powroli.eu; a photographer’s clients can also write to the photographer. There is also the right to complain to a supervisory authority — in Poland the President of the Personal Data Protection Office (UODO, uodo.gov.pl) — or to the authority of one’s own country.

7. Cookies and browser storage

powroli.eu: the chosen language (cookie pw-lang), theme and the cookie-banner choice (stored in the browser); Google Analytics cookies only after consent.

Dashboard: Firebase sign-in data and the cookie pw-uid, which keeps a photographer’s own visits out of their gallery statistics.

Galleries: a cookie that remembers an entered gallery password, and the cart and favourites stored in the browser. No advertising or tracking cookies.

8. Security

Connections are encrypted (HTTPS). Galleries can be protected with a password; their photo links are signed and expire. Originals are stored privately and given out only through short-lived links.

9. Changes

This policy may change as Powroli grows; the date above shows the current version. Important changes are announced to photographers by email.