We collect account details, business contact details, portfolio content, uploaded media metadata, support messages, and basic technical data needed to run the service.

If payments are enabled, billing details are handled by the selected payment provider. Photaaz stores subscription status and plan records, not full payment card data.

We use data to provide portfolio websites, manage subscriptions, process support requests, protect the platform, improve performance, and send important account or service notices.

Contact form submissions are shared with the relevant portfolio owner and may also be reviewed by platform administrators for support and abuse prevention.

Portfolio owners can update or remove their visible profile, gallery, category, and contact information from their dashboard where available.

Requests about access, correction, or deletion can be sent through the published support contact.

Depending on location and context, processing may be necessary to perform a contract, comply with law, protect legitimate interests such as security and fraud prevention, or rely on consent for optional marketing and non-essential cookies.

Data may be shared with the relevant portfolio owner, authorized staff, and listed hosting, database, media, payment, email, analytics, and monitoring providers. We do not sell personal information.

Providers may process data outside the user's country. Where required, contractual safeguards or other recognized transfer mechanisms should be used and documented.

Account and active portfolio data is kept while the account is active. Following a verified deletion request, public access is disabled promptly and primary account and media deletion is targeted within 30 days. Encrypted backups may retain residual copies for up to a further 30 days, and CDN caches expire under provider cache schedules.

Visitor inquiries and support tickets are normally retained for 24 months, security and access logs for up to 12 months, and payment, tax, refund, and fraud records for up to seven years or the longer period required by applicable law. Open disputes, legal holds, abuse cases, and unresolved requests may be retained until resolution.

We use tenant authorization, access controls, encryption in transit, restricted secrets, validated uploads, rate limits, backups, and monitoring. No online service can guarantee absolute security.

Subject to applicable law, individuals may request access, export, correction, deletion, restriction, objection, or withdrawal of consent, and may complain to a relevant regulator. Identity verification may be required before disclosure or deletion.

Photaaz is intended for business users and is not directed to children. Users must not knowingly submit a child's personal data without appropriate authority and lawful consent.

Privacy requests can be submitted through the verified workflow below. Material changes will be dated and notified where required.

Account deletion is irreversible after processing. It does not itself cancel or refund an active Paddle purchase: the subscription should be canceled first through the buyer route. Deletion removes dashboard access and schedules portfolio records and Cloudinary media for deletion, while legally required billing records and temporary backups remain under the retention schedule above.