Privacy Policy

This Privacy Policy explains how Photouria ("we", "us", "our") collects, uses, stores and protects information when you use our website, mobile experience and luxury photo-book service. Questions? Email support@photouria.com.

01 — Who we areWho we are

Photouria is a private photo curation and printing service that turns your personal photo library into custom, physically manufactured photo books. We are the data controller for the information described in this policy.

02 — What we collectWhat we collect

• Account information — your email address, display name and authentication identifiers.
• Photos you upload or import — the image files themselves and technical metadata they contain (EXIF, capture date, GPS where present).
• Location data — where your photos contain EXIF GPS coordinates, we extract and store this metadata to enable location-based organisation of your library (e.g. grouping photos by place). Location data is processed only within your private account and is never shared with third parties beyond the secure infrastructure described in §06. If you prefer not to share location data, you can disable GPS tagging in your device's camera settings, or strip EXIF data from photos before uploading.
• Derived organisational data — face and pet detection vectors, image quality scores, and album/profile assignments used to organise your library.
• Note on detection vectors: face and pet detection vectors are abstract mathematical representations generated by AWS Rekognition — they are not biometric images or stored photographs. These vectors exist only within your private account to power the People and Pets features. They are deleted automatically when you delete the associated photo or your account.
• Order and shipping details — billing name, shipping address, the contents and configuration of any book you purchase.
• Guest order information — if you place an order without creating an account, we collect only the name, shipping address, and email address needed to fulfil and communicate about that specific order. Guest data is retained for the period required to complete the order and resolve any fulfilment issues, then deleted.
• Basic product analytics — anonymised usage events to keep the service stable and improve it.

03 — How photos enter PhotouriaHow photos enter Photouria

Photos only enter Photouria when you upload them yourself. There are two ways to do that: direct upload from your device (drag-and-drop or file picker), and phone upload, where you scan a QR code shown on your computer and send photos from your phone straight into the same library. Photouria does not connect to, or import from, any cloud photo service — we have no access to any photo you have not explicitly uploaded.

• Phone-upload QR codes are short-lived (20 minutes), single-session tokens; they identify your session, never your account details.
• Photouria also uses authentication session cookies set by Supabase to keep you logged in across page loads. These are essential for the service to function and are cleared when you sign out.

To provide automated photo book layout creation, photos you upload are analyzed using AWS Rekognition (for facial and pet detection, profile grouping, and image-quality scoring) and Google Gemini (for object and scene classification). This analysis is strictly used to organize and generate private people and pet profiles within your personal account. No data processed through these services is ever used to train third-party machine learning models, nor is it stored permanently outside of your secure account session.

04 — How we use your dataHow we use your data

• To render your library, previews and book layouts.
• To automatically organise the people and pets in your photos into private profiles you can browse, rename, merge or delete.
• To apply AI generative fill and outpainting where a chosen layout would otherwise require cropping a photo aggressively — AI-generated pixels are blended into the background of your layout to preserve your original image. This processing occurs solely to produce your book and is not used for any other purpose.
• To manufacture, ship and support any physical books you order.
• To send transactional emails (order confirmations, shipping updates, account notices).
• To detect abuse and keep the service secure.

05 — What we never doWhat we never do

• We never sell your personal information or your photos.
• We never use any photos you upload, or data derived from them, to train generalised or third-party AI models.
• We never share your media outside the secure backend infrastructure (Supabase and AWS) required to process previews and produce your prints, plus the specific print-fulfilment partner needed to manufacture and ship an order you have placed.

06 — Sub-processorsSub-processors

• Supabase — application database, authentication and encrypted file storage.
• Amazon Web Services (AWS) — image storage and on-request face/pet detection via AWS Rekognition.
• Stripe — payment processing. Photouria never sees or stores your full card number.
• Resend — transactional email delivery (order confirmations, shipping updates, account notices).
• Google — AI-assisted image analysis (object recognition, scene classification) via Google Gemini.
• Lulu — print-fulfilment partner; receives only the assets and shipping address required to produce and dispatch your specific order. (Gelato was used for order fulfilment prior to July 2026.)

07 — International data transfersInternational data transfers

Several of Photouria's sub-processors are based in the United States: Amazon Web Services (AWS), Google (Gemini), and Stripe. Lulu operates an international print network with production partners across multiple countries, including Australia and the United States. When you use Photouria, your data — including photos, order details, and account information — may be transferred to and processed in countries outside New Zealand.

Under Information Privacy Principle 12 of the New Zealand Privacy Act 2020, we disclose that such transfers occur and confirm that we only engage sub-processors who maintain security standards and contractual protections comparable to those required under New Zealand law. A full list of sub-processors and their locations is in §06 above.

If you have questions about international transfers of your data, contact support@photouria.com.

08 — SecuritySecurity

Data is encrypted in transit (TLS) and at rest. Database access is designed with row-level security policies to prevent one account from reading another account's data. Service credentials follow a least-privilege model and are rotated periodically.

09 — Data retention & deletionData retention & deletion

You can export your data, or permanently delete your account and everything in it, at any time from the in-app Privacy settings, or by emailing support@photouria.com. Deletion is irreversible and removes your photos, derived detection data, profiles, books and order history from our systems, save for the minimum records we are legally required to retain (e.g. tax records for completed purchases).

Inactive accounts: if your account has had no sign-in activity for 24 consecutive months, we will send a notice to your registered email address. If no action is taken within 30 days of that notice, your account and all associated data — photos, profiles, drafts, and order history — will be permanently deleted. You can prevent this by signing in at any time.

10 — Your rightsYour rights

Depending on where you live, you may have the right to access, correct, port, restrict, object to, or erase your personal data (GDPR / UK GDPR / NZ Privacy Act 2020 / CCPA and similar). Contact support@photouria.com and we will respond within the time periods required by applicable law.

If you are located in New Zealand and are unsatisfied with our response to a privacy concern, you have the right to make a complaint to the Office of the Privacy Commissioner (privacy.org.nz).

11 — ChildrenChildren

Photouria is not directed at, and not intended to be used by, anyone under the age of 18. We do not knowingly collect personal information from children.

12 — Changes to this policyChanges to this policy

We may update this policy from time to time. Material changes will be announced on this page and, where appropriate, by email to your account address.

13 — ContactContact

For privacy questions or data requests, write to support@photouria.com.