Privacy Policy

1. Who we are

This Privacy Policy explains how Phototoria OÜ ("Phototoria", "we", "us", "our"), a private limited company registered in Estonia, collects, uses, discloses and protects personal data when you visit phototoria.eu, create an account, or use the Phototoria AI photo and video editing platform (together, the "Service").

Phototoria OÜ acts as the data controller for personal data collected through the Service, within the meaning of the EU General Data Protection Regulation (GDPR) 2016/679.

Controller	Phototoria OÜ
Registered address	Harju maakond, Tallinn, Kesklinna linnaosa, Estonia, 10111
Registry code	16XXXXXXX (Estonian Commercial Register)
Contact email	privacy@phototoria.eu

2. Data we collect

We collect the following categories of personal data:

• Account data: name, email address, password (hashed), billing address and company name where applicable.
• Payment data: processed by our third-party payment provider; Phototoria does not store full card numbers.
• Content you upload: photos, video files and associated metadata (e.g. EXIF data) submitted for editing.
• Usage data: pages visited, features used, device and browser type, IP address, and approximate location derived from IP.
• Communications: messages you send us via the contact form, email, or support channels.
• Cookies and similar technologies: as described in our Cookie Policy.

3. How we use your data

• To provide, operate and maintain the Service, including running AI editing operations on uploaded content.
• To create and manage your account and process subscription payments.
• To respond to support requests and other communications.
• To send service-related notices and, where you have opted in, marketing communications.
• To monitor, secure and improve the Service, including fraud and abuse prevention.
• To comply with legal obligations, including tax and accounting requirements under Estonian and EU law.

Uploaded photos and videos are used solely to deliver the editing results you request. We do not use your private content to train shared AI models unless you explicitly opt in to such a program.

4. Legal basis for processing

We process personal data under the following legal bases set out in Article 6 GDPR:

• Contract: processing necessary to provide the Service you signed up for.
• Legitimate interest: for security, fraud prevention, and service improvement, balanced against your rights.
• Consent: for optional marketing communications and non-essential cookies.
• Legal obligation: for accounting, tax and regulatory compliance.

5. Sharing & third parties

We do not sell personal data. We may share data with:

• Cloud hosting and storage providers that run our infrastructure within the EU.
• Payment processors to handle subscription billing securely.
• Analytics and email-delivery providers, under data processing agreements.
• Public authorities, where required to comply with a legal obligation.

All third-party processors are bound by data processing agreements consistent with Article 28 GDPR.

6. International transfers

Phototoria primarily stores and processes data within the European Economic Area (EEA). Where a service provider is located outside the EEA, we rely on adequacy decisions, Standard Contractual Clauses, or other safeguards recognised under the GDPR.

7. Data retention

We retain account data for as long as your account is active, and uploaded content for as long as needed to deliver the Service or as you choose to keep it stored in your workspace. You may delete content or your account at any time; residual copies may persist briefly in backups before scheduled deletion.

8. Your rights under the GDPR

If you are located in the EEA, UK, or otherwise protected by the GDPR, you have the right to:

• Access the personal data we hold about you.
• Request rectification of inaccurate data.
• Request erasure ("right to be forgotten"), subject to legal retention requirements.
• Request restriction of processing, or object to processing based on legitimate interest.
• Receive your data in a portable format ("data portability").
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.

To exercise any of these rights, contact us at privacy@phototoria.eu. We will respond within one month as required by the GDPR.

9. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls, and regular security reviews. No system is completely secure, and we encourage you to use a strong, unique password for your account.

10. Cookies

The Service uses cookies and similar technologies for essential functionality and, with your consent, for analytics. Full details are provided in our Cookie Policy.

11. Children's privacy

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Service or by email. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact us

For any questions about this Privacy Policy or our data practices, contact:

Phototoria OÜ
Harju maakond, Tallinn, Kesklinna linnaosa, Estonia, 10111
Email: privacy@phototoria.eu