Privacy Policy

At JorgeX Technologies LLC (hereinafter "PhotoHeart", "we", "us" or "our"), we are committed to protecting our users' privacy. This Privacy Policy describes how we collect, use, store, and protect your personal information when you use our platform at photoheart.app.

1. Data Controller

2. Data We Collect

2.1. Account Data

When you register with PhotoHeart, we collect:

• Full name
• Email address
• Authentication information (encrypted password or OAuth tokens)
• Professional profile information (optional)

2.2. Service Usage Data

During use of the platform, we may collect:

• Your clients' data (name, email, phone) that you enter in the CRM
• Images and photographs you upload to the platform
• Photo session and gallery information
• Billing and transaction data
• Activity logs and platform usage records

We process your clients' data on your behalf, as a data processor: you are the controller of that data. That processing is governed by the Data Processing Agreement.

2.3. Payment Data

Payments are processed securely by Stripe (PCI DSS Level 1).

Data we send to Stripe:

• Your email address
• Billing information you provide

Data Stripe returns to us:

• Successful or failed payment confirmation
• Reference identifiers (customer and subscription IDs)
• Subscription status
• Last 4 digits of your card (to display in your dashboard)

2.4. Integration Data

If you connect external services, we store access tokens securely in Supabase Vault (AES-256 encryption):

Google Calendar (optional):

• Purpose: Sync your photo sessions with your calendar
• Data sent to Google: Event title, date, time, location, description
• Data received: List of calendars, existing events
• OAuth Scopes: calendar.events, calendar.readonly

Gmail (optional):

• Purpose: Send emails to your clients from your own email account
• Data sent to Google: Email content, recipients
• Data received: Send confirmation
• OAuth Scopes: gmail.send, gmail.readonly
• Important: Emails are sent from YOUR account. PhotoHeart does not access the contents of your inbox.

You can disconnect these integrations at any time from Settings → Integrations. When disconnected, the tokens are permanently deleted.

2.5. Marketing, Events, and Promotions Data

When you participate in giveaways, events, promotions, or subscribe to our commercial communications (without needing to be a registered user), we collect:

• Name
• Email address
• Explicit consent for commercial communications
• Acquisition source (event, landing page, form, etc.)
• Registration date

This data is used to:

• Manage your participation in giveaways and promotions
• Send you commercial communications about PhotoHeart (if you have given your consent)
• Inform you about partner offers related to the photography sector (if you have given your consent)
• Contact you if you are a giveaway winner

3. Processing Purposes

3.1. Service Provision

• Provide and maintain the PhotoHeart service
• Manage your account and subscription
• Process payments and billing
• Send you service-related notifications (transactional)
• Improve and personalize your experience

3.2. Commercial Communications (with your consent)

• Send you newsletters with news, tips, and content for photographers
• Inform you about new features, offers, and PhotoHeart promotions
• Share partner offers in the photography sector (editing tools, image banks, training, etc.)
• Invite you to events, webinars, and relevant activities

3.3. Giveaways and Promotions

• Manage your participation in giveaways and contests
• Contact you if you are a winner
• Send you the corresponding prizes or benefits

3.4. Other

• Comply with legal obligations
• Statistical analysis and service improvement (anonymized data)
• Fraud prevention and security

4. Legal Basis for Processing

• Contract performance: To provide the contracted service
• Consent: For marketing communications (if you have granted it)
• Legitimate interest: To improve our services and prevent fraud
• Legal obligation: To comply with tax and data protection regulations

5. Third Parties and Data Processors

We share your data with the following service providers acting as data processors:

Infrastructure and Storage

• Supabase: Database, authentication, file storage
• Vercel: Hosting and deployment

Payments

• Stripe: Payment and subscription processing (Privacy Policy)

Communications

• Resend: Transactional email sending
• Hostinger: Server for the WhatsApp notification service (only if you connect your number)

AI Assistant

• OpenRouter: Access to language models for the AI assistant (only if you use it)

Authentication

• Google OAuth: Google login (optional)

Optional Integrations

If you choose to connect them:

• Google Calendar: Photo session synchronization
• Gmail: Email sending from your account

These integrations require your explicit consent and can be disconnected at any time.

Analytics (with your consent)

• Google Analytics: Usage analysis
• Meta Pixel: Conversion analysis
• Vercel Analytics: Aggregated metrics (no cookies)

All our providers comply with GDPR and maintain adequate security measures.

6. International Transfers

Some providers are located outside the EEA. Transfers are carried out with appropriate safeguards:

• Standard contractual clauses approved by the European Commission
• Privacy certifications (EU-US Data Privacy Framework)

7. Data Retention

We retain your data while you maintain an active account. After an ordinary cancellation, access ends when the paid period ends; stored content is retained for 90 days and configuration data for 180 days, unless a longer legal retention period applies.

Galleries and photographs are stored privately. Authorised access uses temporary URLs; images are not published, and an already-issued URL cannot necessarily be revoked before it expires.

Manually archiving a session does not trigger automatic deletion. Sessions inactive for six months may enter a cleanup process, which runs seven days after the applicable cleanup mark.

A GDPR erasure request is scheduled for 30 days or, if later, for the end of the contracted period plus 30 days. Once deletion starts, it is irreversible. The structured data export and the separate original-media export are independent processes; the latter is resumable and produces temporary links.

Legal references

• Spanish Commercial Code, article 30 (BOE)
• Spanish General Tax Law, article 66 (BOE)

The ten-year retention period in article 25 of Law 10/2010 applies to entities subject to that anti-money-laundering legislation and is not the general default period for all accounts.

7.2. Marketing Data Retention

For data collected through events, giveaways, or commercial communication subscriptions:

• Giveaway participants: Up to 12 months after the giveaway ends, unless you have given consent for commercial communications
• Newsletter subscribers: Until you request to unsubscribe or withdraw your consent
• Consent history: We maintain a record of consent granted for legal compliance purposes

8. Commercial Communications

8.1. Types of Communications

If you have given your consent, you may receive:

• PhotoHeart Newsletter: News, tips for photographers, success stories (approx. 1-2 times per month)
• Offers and promotions: Special discounts, limited-time offers, promotional codes
• Partner offers: Promotions for complementary tools for photographers
• Events: Invitations to webinars, trade shows, and industry events

8.2. Partners and Collaborators

Occasionally, we may include in our communications offers from partner companies in the photography sector (editing tools, image banks, training, etc.). We never sell or transfer your email to third parties. Partner offers are always sent through our own channels.

8.3. How to Unsubscribe

You can stop receiving commercial communications at any time by sending an email to privacy@photoheart.app indicating that you wish to unsubscribe.

Unsubscribing from commercial communications does not affect transactional emails necessary for the service (payment confirmations, security notifications, etc.).

9. Giveaways and Promotions

9.1. Legal Terms

Each giveaway or promotion will have its own specific legal terms that will be published alongside the promotion, including:

• Participation period
• Entry requirements
• Prize description
• Giveaway mechanics
• Selection date and method
• Winner contact method

9.2. Data Processing in Giveaways

When participating in a giveaway:

• We collect the minimum necessary data (usually name and email)
• We request your explicit consent for processing
• Receiving future commercial communications is optional and not a requirement for participation
• Data is retained as indicated in section 7.2

9.3. Winner Communication

If you are selected as a winner, we will contact you via the email you provided. If you do not respond within the deadline specified in the terms, a new winner may be selected.

10. Your Rights (GDPR/LOPDGDD)

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a structured format
• Objection: Object to certain processing of your data
• Restriction: Request restriction of processing
• Withdraw consent: At any time, without retroactive effect

To exercise these rights, contact us at: privacy@photoheart.app

We will respond to your request within a maximum of 30 days.

11. Data Security

We implement technical and organizational measures to protect your data:

• Data encryption in transit (HTTPS/TLS)
• Data encryption at rest
• Two-factor authentication available
• Secure credential storage in Supabase Vault
• Role-based access control
• Regular backups
• Continuous security monitoring

12. Cookies and Similar Technologies

Essential Cookies (no consent required):

• Authentication cookies (Supabase) to maintain your session

Analytics Cookies (with consent):

• Google Analytics - to understand how you use the service
• Meta Pixel - to measure campaign effectiveness

We display a consent banner on your first visit. For more information, see our Cookie Policy.

13. Minors

PhotoHeart is not directed at individuals under 18 years of age. We do not knowingly collect data from minors as users of the service. If you are aware that a minor has provided us with data, please contact us immediately.

Data of minors that you include in your contracts is processed on your behalf, in accordance with the Data Processing Agreement.

14. Changes to This Policy

We may update this Privacy Policy occasionally. We will notify you of any significant changes by email or through a notice on the platform. The "last updated" date at the top indicates when the last revision was made.

15. Contact and Complaints

For any privacy-related queries:

If you believe we have not adequately addressed your rights, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es

---

Related documents:

• Terms and Conditions
• Cookie Policy
• Data Processing Agreement