Privacy Policy

1. Introduction

PhotoFounder Inc. (“Company,” “we,” “us,” or “our”) operates the PhotoFounder platform. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our Service. By using the Service, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

• Account information — name, email address, password, phone number
• Business information — company name, business address, phone number, website, timezone
• Payment information — billing address and payment method details (processed and stored securely by Stripe; we do not store credit card numbers on our servers)
• User content — photographs, videos, galleries, floor plans, documents, and other files you upload
• Property and listing data — property addresses, descriptions, pricing, agent information, and other listing details entered through the Service
• Customer data — information about your customers (real estate agents) that you enter into the system, including names, email addresses, phone numbers, and booking history
• Communications — support requests, feedback, survey responses, and any other messages you send to us

2.2 Information Collected Automatically

When you access the Service, we automatically collect certain information, including:

• Usage data — pages visited, features used, actions taken, date and time of access, session duration
• Device information — device type, operating system, browser type and version, screen resolution
• Network information — IP address, internet service provider, referring/exit URLs
• Location data — approximate geographic location derived from your IP address

2.3 Information from Third Parties

We may receive information about you from third-party services you connect to the Service, including Google Calendar (calendar events for scheduling), Stripe (payment status and transaction data), and Matterport (virtual tour data). We only collect the information necessary to provide the integration features you have enabled.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service delivery — provide, operate, maintain, and improve the Service
• Transaction processing — process payments, send invoices, and manage billing
• Communications — send technical notices, security alerts, support messages, and service-related updates
• Customer support — respond to your comments, questions, and requests
• Analytics — monitor and analyze usage trends, performance, and activities to improve the Service
• Security — detect, investigate, and prevent fraudulent transactions, abuse, and unauthorized access
• AI processing — when you use AI-powered features (photo editing, virtual staging, business assistant), your content may be transmitted to third-party AI providers for processing; this data is used solely to generate the requested output and is not used to train AI models
• Legal compliance — comply with applicable legal obligations, regulations, and lawful requests

We do not use your uploaded photographs or media content for our own marketing, advertising, or promotional purposes without your explicit written consent.

4. Data Storage and Security

Your data is stored on secure servers with industry-standard encryption in transit (TLS/SSL) and at rest. Our multi-tenant architecture provides strong data isolation:

• Each tenant's data is stored in a separate, isolated database
• Media files are stored in dedicated Cloudflare R2 storage buckets per tenant
• Payment data is handled by Stripe and never stored on our servers
• Access controls ensure that one tenant's data is never accessible to another

While we implement commercially reasonable security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data. You are responsible for maintaining the security of your account credentials.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

• Service providers — we share data with third-party companies that perform services on our behalf, including payment processing (Stripe), email delivery (SendGrid), media storage (Cloudflare R2), analytics (Google Analytics), AI processing (Anthropic, Google), virtual tours (Matterport), floor plans (CubiCasa), and SMS delivery (Twilio). These providers are contractually obligated to protect your data and use it only for the purposes we specify.
• Your customers — when customers book services through your booking portal or view galleries and property websites, they can see your business name, branding, and the content you choose to make available.
• Legal requirements — we may disclose your information if required by law, subpoena, court order, or governmental regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.
• Business transfers — if PhotoFounder is involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our Service before your information is transferred and becomes subject to a different privacy policy.
• With your consent — we may share your information in other circumstances with your explicit consent.

6. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

• Essential cookies — required for the Service to function, including session management, authentication, and security. These cannot be disabled.
• Analytics cookies — we use Google Analytics to understand how the Service is used, including page views, feature usage, and user flows. Google Analytics collects anonymized usage data.

We do not use advertising cookies or third-party tracking for ad targeting purposes. You can control non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Service.

Do Not Track: Some browsers include a “Do Not Track” (DNT) signal. Because there is no industry-standard interpretation of DNT signals, the Service does not currently respond to DNT signals.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data — retained while your account is active and for 30 days after account deletion
• Media content — retained while your account is active and deleted within 30 days of account termination
• Payment records — retained for 7 years to comply with tax and financial reporting requirements
• Usage logs — retained for up to 12 months for analytics and security purposes
• Support communications — retained for up to 3 years for quality assurance and dispute resolution

When you request deletion of your account, we remove your personal data within 30 days, except where retention is required by applicable law or legitimate business purposes as described above.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your personal data, subject to legal retention requirements
• Portability — request your data in a structured, commonly used, machine-readable format
• Opt-out — opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email
• Restriction — request that we restrict processing of your data in certain circumstances
• Objection — object to our processing of your data in certain circumstances

To exercise any of these rights, contact us at privacy@photofounder.com. We will respond to your request within 30 days (or 45 days if we need additional time, with notice). We will not discriminate against you for exercising your privacy rights.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know — you may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it
• Right to Delete — you may request that we delete your personal information, subject to certain exceptions
• Right to Correct — you may request that we correct inaccurate personal information
• Right to Opt-Out of Sale or Sharing — we do not sell your personal information and do not share it for cross-context behavioral advertising
• Right to Non-Discrimination — we will not deny you services, charge different prices, or provide a different level of service because you exercised your CCPA rights

To submit a CCPA request, email privacy@photofounder.com or contact us through our contact page. We will verify your identity before processing your request.

10. International Data Transfers

PhotoFounder is based in the United States. If you access the Service from outside the United States, your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your country. By using the Service, you consent to the transfer of your information to the United States. Where required by applicable law, we implement appropriate safeguards for international data transfers, including Standard Contractual Clauses (SCCs) approved by the European Commission.

11. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Lawful basis — we process your personal data based on: (a) your consent, (b) the necessity to perform our contract with you, (c) our legitimate interests (such as fraud prevention and service improvement), or (d) compliance with legal obligations
• Data Controller — PhotoFounder Inc. is the data controller for personal data collected through the Service
• EU rights — in addition to the rights listed in Section 8, you have the right to lodge a complaint with your local data protection supervisory authority
• Consent withdrawal — where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal
• Automated decision-making — we do not make decisions based solely on automated processing that produce legal effects concerning you

12. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 13 years of age. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@photofounder.com and we will promptly delete such information from our systems.

13. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users via email and/or prominent notice on the Service within 72 hours of becoming aware of the breach, or as otherwise required by applicable law. The notification will include the nature of the breach, the types of data affected, the steps we are taking to address the breach, and recommended actions for affected users.

14. Third-Party Service Providers

We use the following categories of third-party service providers to operate the Service:

• Cloud infrastructure — Cloudflare (CDN, R2 storage), Hetzner (application hosting), Vercel (frontend hosting)
• Payment processing — Stripe
• Email delivery — SendGrid, entity-configured SMTP providers
• SMS delivery — Twilio
• Analytics — Google Analytics
• AI services — Anthropic (AI assistant), Google (photo editing, virtual staging, video animation)
• Integrations — Google Calendar, Matterport, CubiCasa, ElevenLabs

Each provider processes data only as necessary to perform their specific function and is bound by data processing agreements that require them to protect your information.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or prominent notice on the Service at least 30 days before taking effect. The updated policy will be posted on this page with a revised “Last updated” date. Your continued use of the Service after the effective date constitutes your acceptance of the updated policy.

16. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

• PhotoFounder Inc.
• Privacy inquiries: privacy@photofounder.com
• General inquiries: Contact page