Privacy Policy

1. Who we are

PracticePhoto is operated by Julio Cesar Fausto, who acts as the data controller for personal data processed through this service.

For full operator details, see our Impressum. For privacy-related questions, contact us at privacy@practicephoto.com.

2. What we collect

Depending on how you use PracticePhoto, we may process the following data:

• Account registration: email address, password (stored in hashed form), and optional display name.
• Purchases: purchaser email, order metadata (practice project purchased, price, purchase date), entitlement status, buyer code, and personal access tokens used to reach your project and PDF. These tokens are unique to your purchase and must not be shared.
• Waitlist sign-ups: email address, which practice project you expressed interest in, optional session reference, and whether you consented to marketing emails.
• Training tool usage: project content you create or personalize, practice journal images you upload, gear selections, location data you enter, Image Review notes and reflection answers, crop versions you save, stored AI feedback (Experimental) responses, and related metadata.
• Image Review: when you request AI feedback (Experimental) on an image, a resized encoded copy of that image plus relevant project context (such as your brief, practice rules, techniques, EXIF metadata, and reflection notes) is sent to OpenAI for processing; the generated feedback is stored with your image.
• Light Study: location search terms, coordinates you enter or select, and IP-address-based usage counters when you use Light Study as a guest.
• Community features: published projects, uploaded images, comments, and display name shown on published work.
• Technical data: essential session cookies, server logs (IP address, browser type, timestamps, pages accessed), and anti-abuse signals where applicable.

3. Why we process your data and legal bases

We process personal data under the following legal bases (Art. 6 GDPR):

• Contract performance: to create and manage your account, fulfill practice project purchases, provide tool access (including Image Review and optional AI feedback (Experimental) you request), generate and deliver PDFs, and send transactional emails related to your order.
• Consent: to send waitlist and launch marketing emails when you have explicitly opted in. You may withdraw consent at any time by contacting us.
• Legitimate interests: to maintain security, prevent abuse and fraud (including bot verification and Light Study guest rate limits), moderate community content, respond to rights claims, and improve the service — balanced against your rights and freedoms.
• Legal obligation: where we must retain records for tax, accounting, or regulatory purposes.

4. Processors and third parties

We use trusted service providers to operate PracticePhoto. They process data only on our instructions:

• Hosting and infrastructure — to run the application and databases (preferably within the EU or under adequate safeguards).
• Object storage (S3-compatible) — to store practice journal images, Image Review crop versions, and generated practice project PDFs.
• OpenAI — to power AI-assisted project suggestions, personalization, and optional Image Review AI feedback (Experimental). Relevant project context and, when you request feedback, a resized encoded copy of the selected image may be sent to OpenAI’s servers in the United States under applicable transfer safeguards (e.g. Standard Contractual Clauses).
• Cloudflare Turnstile — for bot verification on waitlist sign-ups and guest comments where enabled.
• OpenStreetMap and related providers — for Light Study location search, building footprints, and geocoding based on queries and coordinates you submit; we do not send your account identity with these requests.
• Map and imagery providers — for Light Study map tiles and reference photos (including OpenStreetMap, Esri, and Wikimedia Commons); your browser loads these resources directly or through our Service without attaching your account identity.
• Email delivery (SMTP provider) — to send purchase confirmations, account messages, and other service emails.
• Stripe (future) — when live checkout is enabled, payment processing will be handled by Stripe; their privacy policy will apply to payment data they collect directly.

We do not sell your personal data.

5. Retention

• Account data is kept until you delete your account, subject to legal retention requirements.
• Practice journal images, Image Review data, and stored AI feedback (Experimental) are kept until you delete the image or account, subject to backups and legal retention requirements.
• Light Study guest usage counters tied to your IP address are kept for up to 24 hours in cache storage for rate-limiting purposes.
• Purchase and entitlement records are retained for the period required for accounting, tax, and consumer law purposes (typically up to ten years where applicable).
• Waitlist entries are kept until the relevant practice project launches and reasonable follow-up is complete, or until you withdraw consent or request deletion.
• On account deletion, practice-project-sourced projects and uploads may be reassigned so your personal purchase link remains usable in read-only mode, consistent with our account settings description. Community-published content may be removed or anonymized as part of moderation or deletion processes.

6. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Request erasure (“right to be forgotten”) where applicable
• Restrict or object to certain processing
• Data portability, where technically feasible
• Withdraw consent at any time (for consent-based processing such as waitlist marketing)

To exercise these rights, email privacy@practicephoto.com. You also have the right to lodge a complaint with a supervisory authority. In Germany, you may contact the BfDI or your local data protection authority (Landesdatenschutzbehörde).

7. Cookies

We use essential session cookies required for authentication and basic site functionality. We do not currently use analytics or advertising cookies.

8. Children

PracticePhoto is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us so we can delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will reflect the latest version. Material changes may also be communicated where appropriate.