Privacy Policy

This Privacy Policy explains how Photouria ("we", "us", "our") collects, uses, stores and protects information when you use our website, mobile experience and luxury photo-book service. Questions? Email support@photouria.com.

01 · Who we areWho we are

Photouria is a private photo curation and printing service that turns your personal photo library into custom, physically manufactured photo books. We are the data controller for the information described in this policy.

02 · What we collectWhat we collect

• Account information: your email address, display name and authentication identifiers.
• Photos you upload or import: the image files themselves and technical metadata they contain (EXIF, capture date, GPS where present).
• Location data: where your photos contain EXIF GPS coordinates, we extract and store this metadata to enable location-based organisation of your library (e.g. grouping photos by place). Location data is processed only within your private account and is never shared with third parties beyond the secure infrastructure described in §07. If you prefer not to share location data, you can disable GPS tagging in your device's camera settings, or strip EXIF data from photos before uploading.
• Derived organisational data: face and animal detection vectors, image quality scores, and album/profile assignments used to organise your library.
• Note on detection vectors: face and animal detection vectors are abstract mathematical representations generated by AWS Rekognition; they are not biometric images or stored photographs. These vectors exist only within your private account to power the People and Animals features. They are deleted automatically when you delete the associated photo or your account.
• Order and shipping details: billing name, shipping address, the contents and configuration of any book you purchase.
• Guest order information: if you place an order without creating an account, we collect only the name, shipping address, email address and phone number needed to fulfil and communicate about that specific order. Guest data is retained for the period required to complete the order and resolve any fulfilment issues, then deleted.
• Support messages: when you write to us from the Help page, we keep your message, the email address you give us and our replies, so that you can see the conversation on the Help page and we can answer it. Only you (signed in, or in the guest session you wrote from) and the Photouria staff who answer support can read it. Support messages are deleted after two years, or sooner if you delete your account.
• Advertising measurement: what we send to Meta, the company behind Facebook and Instagram, is set out in §05.

03 · How photos enter PhotouriaHow photos enter Photouria

Photos only enter Photouria when you upload them yourself. There are two ways to do that: direct upload from your device (drag-and-drop or file picker), and phone upload, where you scan a QR code shown on your computer and send photos from your phone straight into the same library. Photouria does not connect to, or import from, any cloud photo service; we have no access to any photo you have not explicitly uploaded.

• Phone-upload QR codes are short-lived (20 minutes), single-session tokens; they identify your session, never your account details.
• To keep you signed in, your browser keeps your sign-in in its local storage. This is needed for the service to work and is removed when you sign out.

To provide automated photo book layout creation, photos you upload are analyzed using AWS Rekognition (for facial and animal detection, profile grouping, and image-quality scoring) and Google Gemini (for object and scene classification). This analysis is strictly used to organize and generate private people and animal profiles within your personal account. No data processed through these services is ever used to train third-party machine learning models, nor is it stored permanently outside of your secure account session.

04 · How we use your dataHow we use your data

• To render your library, previews and book layouts.
• To automatically organise the people and animals in your photos into private profiles you can browse, rename, merge or delete.
• To apply AI generative fill and outpainting where a chosen layout would otherwise require cropping a photo aggressively: AI-generated pixels are blended into the background of your layout to preserve your original image. This processing occurs solely to produce your book and is not used for any other purpose.
• To manufacture, ship and support any physical books you order.
• To send transactional emails (order confirmations, shipping updates, account notices).
• To detect abuse and keep the service secure.
• To measure which of our ads bring people to Photouria, and to show our ads to people more likely to want a book (see §05).

05 · Advertising and measurementAdvertising and measurement (Meta)

We advertise on Facebook and Instagram. We use Meta's tools, the Meta Pixel and the Conversions API, to measure which ads lead people to use Photouria and buy a book, and so Meta can show our ads to people more likely to find them useful.

What Meta receives. When you use photouria.com, your browser and our servers tell Meta when you view a page or choose a type of book, create an account, add your first photos, finish building a book, open checkout, go to payment and pay. With each of these, Meta receives:

• a random ID our site creates for your browser, and Meta's own cookies (_fbp, and _fbc if you arrived from a Meta ad);
• technical details sent automatically by your browser, like your browser and device type and connection information;
• the address of the page you are on, and of the page that sent you there;
• for a finished book, checkout, payment and a completed payment: the price and currency;
• if you are signed in: your email address and our ID for your account, both hashed;
• when you pay: the email address you gave at checkout and your delivery country, and from your delivery address your phone number, name, city, postcode and region, all hashed.

Hashed means the information is turned into a fixed code (using SHA-256) before it leaves us. Meta uses the code to match the event to an account it already knows. The information itself is not sent as readable text.

What Meta never receives: your photos, anything we work out from them (people, faces, places or dates), what is in your books, or your card details.

Meta's use. Meta uses this information under its own terms and privacy policy (facebook.com/privacy/policy).

Turning it off. Turn off ad measurement in this browser (photouria.com/?ads=off). That browser then stops loading Meta's pixel, our servers stop telling Meta about anything you do in it (including a payment you start there), and the Meta cookies and browser ID we stored in it are deleted. It works per browser, so do it on each device you use. To turn it back on, open photouria.com/?ads=on. You can also block cookies or tracking in your browser's settings, and choose how Meta uses activity from other websites in your Facebook or Instagram settings, under "Your activity off Meta technologies".

What we keep. Our servers keep a record of which of these events were sent for your account, so the same one is not sent twice. It is deleted with your account, except for a one-way code per finished book that stops a second copy being sent; once your account is gone, nothing links that code to you. We also keep daily totals of how many events were sent, which contain nothing about you.

Cookies and browser storage for measurement:

• Meta: cookies _fbp and _fbc.
• Photouria: the random browser ID above (photouria.xid) and, if you arrived from a Meta ad, that ad's click ID for up to 90 days (photouria.fbc), both in local storage.

Questions, or want to use your rights over this information? Email support@photouria.com.

06 · What we never doWhat we never do

• We never sell your personal information or your photos.
• We never use any photos you upload, or data derived from them, to train generalised or third-party AI models.
• We never share your media outside the secure backend infrastructure (Supabase and AWS) required to process previews and produce your prints, plus the specific print-fulfilment partner needed to manufacture and ship an order you have placed.

07 · Sub-processorsSub-processors

• Supabase: application database, authentication and encrypted file storage.
• Amazon Web Services (AWS): image storage and on-request face/animal detection via AWS Rekognition.
• Stripe: payment processing. Photouria never sees or stores your full card number.
• Resend: transactional email delivery (order confirmations, shipping updates, account notices).
• Google: AI-assisted image analysis (object recognition, scene classification) via Google Gemini.
• Meta Platforms: advertising measurement through the Meta Pixel and the Conversions API, as set out in §05. Meta never receives your photos.
• Our book printer: a specialist print-fulfilment partner; receives only the assets and shipping address required to produce and dispatch your specific order.

08 · International data transfersInternational data transfers

Several of Photouria's sub-processors are based in the United States: Amazon Web Services (AWS), Google (Gemini), Stripe and Meta. Our book printer operates an international print network with production partners across multiple countries, including Australia and the United States. When you use Photouria, your data (including photos, order details, and account information) may be transferred to and processed in countries outside New Zealand.

Under Information Privacy Principle 12 of the New Zealand Privacy Act 2020, we disclose that such transfers occur and confirm that we only engage sub-processors who maintain security standards and contractual protections comparable to those required under New Zealand law. A full list of sub-processors and their locations is in §07 above.

If you have questions about international transfers of your data, contact support@photouria.com.

09 · SecuritySecurity

Data is encrypted in transit (TLS) and at rest. Database access is designed with row-level security policies to prevent one account from reading another account's data. Service credentials follow a least-privilege model and are rotated periodically.

10 · Data retention & deletionData retention & deletion

You can export your data, or permanently delete your account and everything in it, at any time from the in-app Privacy settings, or by emailing support@photouria.com. Deletion is irreversible and removes your photos, derived detection data, profiles, books and order history from our systems, save for the minimum records we are legally required to retain (e.g. tax records for completed purchases).

Inactive accounts: if your account has had no sign-in activity for 24 consecutive months, we will send a notice to your registered email address. If no action is taken within 30 days of that notice, your account and all associated data (photos, profiles, drafts, and order history) will be permanently deleted. You can prevent this by signing in at any time.

11 · Your rightsYour rights

Depending on where you live, you may have the right to access, correct, port, restrict, object to, or erase your personal data (GDPR / UK GDPR / NZ Privacy Act 2020 / CCPA and similar). Contact support@photouria.com and we will respond within the time periods required by applicable law.

If you are located in New Zealand and are unsatisfied with our response to a privacy concern, you have the right to make a complaint to the Office of the Privacy Commissioner (privacy.org.nz).

12 · ChildrenChildren

Photouria is not directed at, and not intended to be used by, anyone under the age of 18. We do not knowingly collect personal information from children.

13 · Changes to this policyChanges to this policy

We may update this policy from time to time. Material changes will be announced on this page and, where appropriate, by email to your account address.

14 · ContactContact

For privacy questions or data requests, write to support@photouria.com.