Privacy Policy

This Privacy Policy explains how Fotovault collects, uses, shares, and protects personal information, in line with South Africa's Protection of Personal Information Act, 2013 (POPIA). It applies to the Fotovault website and service. Please read it together with our Terms & Conditions.

1. Our two roles

Fotovault handles personal information in two different capacities, and it matters which one applies:

• As responsible party — for the information of our own account holders (photographers): the details you give us to open and run your account, and to bill you.
• As operator — for the personal information contained in the content you upload (for example, your clients' contact details and the people depicted in your photographs). Here you (the photographer) are the responsible party, and we process that information on your behalf and on your instructions. See clause 10.

2. Information we collect

Category	Examples
Account	Your name, email address, studio / business name, phone number, and a securely hashed password.
Billing	Your chosen plan, billing records, and payment references. We do not receive or store your full card details — card payments are processed by PayFast.
Your content	The photographs and files you upload, and any personal information they contain (e.g. people depicted). We strip location (GPS/EXIF) data from photos before they are displayed to clients.
Gallery & sharing	Gallery titles, the client name/email you share a gallery with, gallery passwords (stored hashed), and which photos a client marks as favourites.
Technical & usage	IP address, browser/device information, log data, sign-in codes (stored hashed), and engagement events such as gallery views and downloads (recorded against a pseudonymous identifier).
Communications	Emails and messages you send us for support.

3. How we collect it

• Directly from you — when you sign up, complete your profile, upload content, or contact us.
• Automatically — through your use of the Service (technical and usage information above), using cookies and similar technologies.
• From third parties — for example our payment processor (PayFast) confirms a payment, or, if you choose to connect it, Google confirms your Google account email when you link Google Drive.

4. Why we use it & our lawful basis

We process personal information only where POPIA allows — principally to perform our contract with you, to pursue our legitimate interests in running and securing the Service, to comply with the law, and with your consent where required. Specifically, to:

• create and administer your account, and provide the Service;
• host, store, back up, resize and display your galleries;
• process payments and keep billing and tax records;
• send you service, security, and account emails (including one-time sign-in codes);
• keep the Service secure — detect, prevent and investigate abuse, fraud, and unauthorised access (this includes rate-limiting and, where necessary, temporarily blocking IP addresses);
• provide support and respond to your requests;
• understand engagement (e.g. whether a gallery was viewed) to improve the Service;
• comply with our legal obligations and enforce our Terms.

We do not sell your personal information, and we do not use your photographs for advertising or to train anything.

5. Cookies

We use a small number of first-party, functional cookies and similar browser storage — to keep you signed in, remember linked accounts, hold a gallery-access session, and remember your light/dark theme preference. These are necessary for the Service to work. We do not use third-party advertising or cross-site tracking cookies. You can clear cookies in your browser, but the Service may not function correctly without the essential ones.

6. Who we share it with

We share personal information only as needed to run the Service, with operators (processors) who act on our instructions, and where required by law. We do not sell it. Our key service providers are:

Provider	Purpose
PayFast (South Africa)	Processing card and other payments. They handle your payment details under their own privacy policy.
Google	Only if you choose to connect Google Drive — to store your galleries in your own Google account. Governed additionally by Google's terms and privacy policy.
Email delivery	To send account, security, and gallery emails on our behalf.
Hosting	South African infrastructure that we host and manage.

We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a sale or transfer of the business (subject to this Policy).

7. Cross-border transfers

Your account data and galleries are hosted on South African infrastructure. Some service providers we use may process limited information outside South Africa (for example, if you connect Google Drive, or where a provider operates internationally). Where that happens, we take reasonable steps to ensure the recipient is subject to laws, binding rules, or contractual terms that provide an adequate level of protection comparable to POPIA, as required by section 72 of POPIA.

8. How we protect it

We take reasonable, appropriate technical and organisational measures to safeguard personal information, as required by POPIA. These include encryption of data in transit (HTTPS), passwords stored only as salted hashes (never in the clear), one-time codes on sign-in, gallery links that can be password-protected and set to expire, stripping of location metadata from displayed photos, access controls, and abuse protection.

9. How long we keep it

We keep personal information only for as long as necessary for the purposes above — while your account is active, and afterwards as needed to meet legal, tax, and accounting obligations or to resolve disputes. Galleries and files are also subject to the storage limits, retention periods, and expiry windows described in your plan. When you close your account, your content is made inaccessible and subsequently deleted after any applicable grace period, save for records we must retain by law and copies that persist transiently in backups.

10. Photographers & their clients

If you are a photographer using Fotovault, you are the responsible party for the personal information in the content you upload — including your clients' details and the individuals depicted in your photographs — and we act as your operator. You are responsible for having a lawful basis and any necessary consents to upload and share that information, and for informing the individuals concerned as the law requires. If you are a client who received a gallery link, the photographer who took your photos is the responsible party for that gallery; please direct requests about those photos to them, and we will assist the photographer as their operator.

11. Your POPIA rights

Subject to POPIA, you have the right to:

• be told what personal information we hold about you and to access it;
• request that we correct or delete information that is inaccurate, irrelevant, excessive, out of date, or unlawfully held;
• object, on reasonable grounds, to the processing of your information;
• withdraw consent where we relied on it (this will not affect processing done before withdrawal);
• lodge a complaint with the Information Regulator (see clause 14).

To exercise any of these, email support@fotovault.co.za. We may need to verify your identity before acting. If your request concerns photographs a photographer uploaded, we will refer you to, or act on the instructions of, that photographer as the responsible party.

12. Children

Fotovault accounts are for adults (18+) and are not directed at children. Photographers may deliver photographs of children they have taken with the necessary consent of a parent or guardian; the photographer is responsible for obtaining that consent. If you believe we hold a child's personal information without proper consent, contact us and we will address it.

13. Changes to this Policy

We may update this Policy from time to time. We will revise the "Last updated" date above and, where changes are material, take reasonable steps to notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

14. Complaints & the Information Regulator

Please contact us first — we would like the chance to resolve any concern. You also have the right to complain to the regulator:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Enquiries: enquiries@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
inforegulator.org.za

15. Contact

Questions or privacy requests? Contact Craig Foster (Information Officer) at support@fotovault.co.za.