Data privacy policy app

(1) Information on the collection of personal data

1.1 We provide SaaS software (software or app) that you can use via your browser. Optionally, the software can be installed on your device as a Progressive Web App (PWA) (hereinafter collectively referred to as the “Software”). This Privacy Policy describes how we process your personal data when you use the app.
1.2 Personal data means any data that relates to you personally, e.g. name, email address and user behaviour.
1.3 The controller within the meaning of Art. 4(7) GDPR is Evolo Software GmbH, Görrestraße 48, 80797 Munich (see our legal notice) (hereinafter also referred to as “we”, “us” or “our”).

1.4 If you have any questions regarding the processing of your personal data or the exercise of your rights, you can contact our Data Protection Officer at any time: Evolo Software GmbH, Data Protection Officer, Görrestraße 48. 80797 Munich, Germany, E-mail: info@pictomento.com

(2) Your rights

2.1 You have the following rights vis-à-vis us regarding your personal data:
2.2 Note on data portability: Upon request, we will provide you – where technically feasible and legally permissible – with the data you have provided and/or that is stored in your user account in a commonly used, machine-readable format (e.g. JSON).
2.2.1 Right of access (Art. 15 GDPR),
2.2.2 Right to rectification (Art. 16 GDPR),
2.2.3 Right to erasure (Art. 17 GDPR),
2.2.4 Right to restriction of processing (Art. 18 GDPR),
2.2.5 Right to data portability (Art. 20 GDPR),
2.2.6 Right to object to processing (Art. 21 GDPR),
2.2.7 Right to protection against automated decisions (Art. 22 GDPR),
2.2.8 Right to withdraw your data protection consent, and
2.2.9 Right to lodge a complaint with a supervisory authority regarding our processing of your data.

(3) Processing of personal data when using the app

3.1 When accessing and using the app, we process personal data depending on the type of use. Which data is processed depends in particular on whether you use the app merely for informational purposes (e.g. as a visitor of a shared gallery link) or whether you create a user account and create/manage galleries.
3.2 When using our app purely for informational purposes, i.e. when you use the app without registering or otherwise transmitting information to us, we automatically collect the following technical data (log data), which is required for the display, stability and security of the system:
3.2.1 IP address,
3.2.2 date and time of the request,
3.2.3 time zone difference to Greenwich Mean Time (GMT),
3.2.4 requested file (visited page),
3.2.5 page from which the file was requested (previously visited page),
3.2.6 access status/HTTP status code,
3.2.7 amount of data transferred,
3.2.8 information about browser type as well as language and version of the browser software, and
3.2.9 your operating system.

3.3 This data is technically necessary in order to display our app to you and to ensure the stability and security of the system.
3.4 The legal basis for processing the aforementioned data is Art. 6(1) sentence 1 lit. f GDPR. Our legitimate interest lies in providing a functional and secure app.
3.5 The aforementioned log data is deleted as soon as it is no longer required for the purpose for which it was collected, at the latest after seven (7) days, unless longer storage is required for the investigation of misuse or security incidents.

(4) Data security

4.1 We implement appropriate technical and organisational measures to protect your data against manipulation, loss, destruction or unauthorised access. These include in particular:
4.1.1 access and authorisation concepts (access to production systems exclusively for internal engineers; currently primarily via administrator roles),
4.1.2 access protection (e.g. access via password-protected SSH keys),
4.1.3 encryption during transmission (TLS/SSL) for publicly accessible endpoints; internal system communication takes place within a technically isolated network,
4.1.4 encryption of sensitive data fields (e.g. billing data) as well as password hashing in accordance with the state of the art (Argon2),
4.1.5 monitoring and alerting (e.g. via Grafana with email/push notifications),
4.1.6 keys and access credentials are managed separately (currently, among other things, via environment variables; migration to secret management is planned). The specific implementation is regularly reviewed and further developed.

(5) Objection to or withdrawal of data processing

5.1 If you have consented to the processing of your data, you may withdraw this consent at any time. The withdrawal applies from the time at which you notify us and affects the future processing of your data. The lawfulness of the processing of your data up to the time of your withdrawal remains unaffected.
5.2 If we process your personal data on the basis of a balancing of interests, you may object to this processing. In particular, we carry out a balancing of interests when we process your data in the public interest or on the basis of our legitimate interests. Please inform us in your objection of the reasons why you object to the processing of your data in its previous form. We will review your objection and will either stop or adjust the processing, or explain to you our compelling grounds which justify the continuation of the processing.
5.3 Of course, you may object at any time to the processing of your personal data for advertising and data analysis purposes.
5.4 To object or withdraw your consent, please contact us at info@pictomento.com.

(6) Retention period of your personal data

6.1 We store your personal data only for as long as necessary to fulfil the purposes for which it was collected. This includes compliance with legal, tax and accounting retention obligations. In detail, depending on the respective processing, the following applies in particular:
6.1.1 User account and profile data: generally for the duration of the existing user account; deletion after termination takes place upon request.
6.1.2 Gallery data and media (photos/videos): if deleted by the user, the content is generally deleted immediately (hard delete). One-time purchase galleries are no longer available after expiry of the respective term; the underlying data may then be removed in accordance with internal deletion periods. Galleries created during an Unlimited plan generally remain available until deleted by the user. If a gallery is not taken over/continued, we delete the associated data no later than after three (3) years.
6.1.3 Usage and interaction data (e.g. views, likes, downloads): storage where necessary for error analysis, security and product improvement. Fixed deletion routines are currently not fully automated, but are carried out as part of our operational processes.
6.1.4 Backups: To ensure operational and data security, we create backup copies of certain system data (in particular database and log data). These backups are kept in secured EU/EEA storage and are accessible only to a very limited group of persons. Deletion/overwriting is currently not fully automated, but takes place as part of our operational processes.
Note: There is currently no separate backup system for uploaded photo/video files; deleted media content is removed directly from the production storage. This may change in the future.
6.2 If you have any questions regarding the storage of your personal data, please contact us at [Data Protection/Contact Email Address].

(7) Processing of data by third parties

7.1 For the provision and operation of the app, we partly use external service providers who process personal data on our behalf (processors) or act as independent controllers. Where required, we conclude data processing agreements with processors. In particular, we use the following service providers:
7.1.1 Storj Labs (Storj) – Storj Labs Inc., 1870 The Exchange SE Ste 220 PMB 75268, Atlanta, GA 30339-2171, USA: used as private and secure object storage for photos, profile pictures, as well as database and log backups. Storage takes place via a node network exclusively within the EEA (EU). To the best of our knowledge, no storage takes place outside the EU.
7.1.2 Mollie – Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands: payment service provider for the processing of payments. Payment information (e.g. card or bank account data) is processed exclusively by Mollie; in particular, we receive transaction IDs and status information. Depending on the selected payment method, additional payment service providers (e.g. card networks) may be involved; processing outside the EEA cannot be excluded in such cases.
7.1.3 sevDesk – sevDesk GmbH, Im Unteren Angel 1, 77652 Offenburg, Germany: accounting and invoicing tool (creation of invoices, accounting processing). According to the provider, processing takes place within the EU.
7.1.4 Further recipients may be added in individual cases (e.g. IT service providers for operations/support) – in each case only to the extent necessary.
7.2 The legal basis for the transfer is then Art. 6(1) sentence 1 lit. b GDPR (performance of contract) or Art. 6(1) sentence 1 lit. f GDPR (legitimate interest, e.g. operational security), or – where consent has been obtained – Art. 6(1) sentence 1 lit. a GDPR.
7.3 The retention period is governed by the section “Retention period of your personal data” above.
7.4 If service providers process data outside the European Economic Area (EEA), this only takes place under the conditions of Art. 44 et seq. GDPR (e.g. EU Standard Contractual Clauses).

(8) Further functions and offers of our app

8.1 In addition to the informational use of our app, we offer further functions that you may use if interested and which we describe in more detail below. As a rule, you must provide additional personal data for this purpose, which we process in order to provide these functions. The above general principles (e.g. regarding retention period, your rights and the right to object/withdraw consent) apply to these data processing activities unless expressly stated otherwise below.

8.2 Login and user account

8.2.1 In order to use the app in full (e.g. to create and manage galleries), you need a user account. In this context, we process in particular the following data:
8.2.2 Authentication data: email address, password hash, where applicable one-time password/OTP data (hash, expiry time), status (active/inactive), and the time of the last login.
8.2.3 Profile data (optional/plan-dependent): name, profile picture/logo, language, as well as information about the photography business (e.g. company name, company size, website, event/project types, number of projects per year, previous delivery method, source of referral).
8.2.4 Billing data (for paid plans): name, address, postcode, city, country code and, if applicable, VAT ID (partially stored in encrypted form).
8.2.5 For pure visitor access (“Visitor”), we currently do not store any permanent profile data (e.g. name or email address). Technically, the time of the last access (e.g. use of the access link) may be recorded. In addition, technical information (e.g. IP address, device/browser information, timestamps) may be processed in log data for error analysis and IT security.
8.2.6 The legal basis for this data processing is Art. 6(1) sentence 1 lit. b GDPR (performance/initiation of a contract) and Art. 6(1) sentence 1 lit. f GDPR (security, prevention of misuse, error analysis).
8.2.7 We generally store this data for the duration of your user account. The deletion of user accounts is currently not fully automated in all cases. Upon request, we delete the user account and the data linked to it in accordance with statutory requirements, provided that no legal retention obligations (in particular under tax and commercial law) or overriding legitimate interests (e.g. for the establishment, exercise or defence of legal claims) prevent deletion. The retention period depends on the contractual purpose and statutory retention obligations.

8.3 Galleries, photo and video content

If you create galleries and upload content, we process the data necessary for this. This includes in particular:
8.3.1 Gallery metadata: name/title of the gallery, cover image (reference), date of creation, as well as optional details of the creator (e.g. logo, subtitle, website).
8.3.2 Media and content data: photo and video files uploaded by you (original files), file names, chapter/folder assignment, technical image/file information (e.g. aspect ratio, file size, timestamp/time zone offset, sequence), as well as visibility settings (e.g. “hidden”/private).
8.3.3 EXIF metadata: We store the original files. These may contain EXIF metadata (e.g. capture time, camera/lens data; possibly also location data if contained in the file). We do not currently extract EXIF data separately; EXIF data is currently not removed/filtered automatically.
8.3.4 The legal basis for this data processing is Art. 6(1) sentence 1 lit. b GDPR (performance/initiation of a contract) and Art. 6(1) sentence 1 lit. f GDPR (security, prevention of misuse, error analysis).

8.4 Face recognition

8.4.1 PictoMento provides a face recognition function with which faces can be recognised, grouped and assigned within a gallery. This allows invited persons to be shown, as a priority, content in which they appear and/or to filter content within the gallery by recognised persons. The use of this function requires that the customer (in particular the photographer as controller) actively enables face recognition for the respective gallery. For face recognition, we process face crops and encrypted technical recognition data in order to recognise and assign faces within the gallery and to improve the quality of recognition.
8.4.2 At present, the processing of face recognition data takes place exclusively within our systems (in-house). These face recognition data are not transferred to external AI service providers or other third parties. If galleries are deleted, the associated face recognition data are deleted as well. In the event that galleries are marked as “archived”, the automated deletion of cluster/embedding data is intended; however, this is currently not yet fully automated in all cases.
8.4.3 If face recognition is activated by the customer, processing takes place within the scope of providing the contractual functionality. For our processing operations related to the use of the software, Art. 6(1) sentence 1 lit. b GDPR (performance/initiation of a contract) and Art. 6(1) sentence 1 lit. f GDPR (security, prevention of misuse, error analysis) may in particular apply. Where special categories of personal data are affected in individual cases (e.g. biometric data), the customer as controller is obliged to have an appropriate legal basis before activating face recognition, in particular – where required – to obtain valid (explicit) consent from the persons depicted and to observe any withdrawals or objections. Face recognition can only be activated if the customer has first confirmed that the necessary data protection requirements have been met – in particular that valid consents of the affected persons have been obtained.

8.5 Sharing, access and usage/interaction data

8.5.1 When galleries are shared via links, we process technical access data as well as usage and interaction data. This may include in particular: views, viewing time, zoom interactions, chapter selection, likes and downloads (depending on quality level), anonymised by means of a random session ID.
8.5.2 Where used, reverse proxy/server logs may also contain IP addresses, user agent information and timestamps; strict retention is intended for this (status: currently not used in production or not yet finally configured).
8.5.3 The legal basis for this data processing is Art. 6(1) sentence 1 lit. b GDPR (performance/initiation of a contract) and Art. 6(1) sentence 1 lit. f GDPR (security, prevention of misuse, error analysis).

(9) Use of cookies

9.1 In addition to the data already mentioned, we use technically necessary cookies or comparable storage technologies (e.g. session cookies) in the app, which are required for authentication and the secure provision of the app.
9.2 Cookies are small text files or database entries stored on your device. They contain a string of characters that may enable unique identification of your browser/device.
9.3 Technically necessary cookies: We use only necessary cookies, in particular for login, maintaining your session and securing the application. Without these cookies, the app cannot be provided properly. The legal basis is Art. 6(1) lit. f GDPR (legitimate interest in secure operation) and Section 25(2) TDDDG (strictly necessary storage/access).
9.4 Technically optional cookies / third-party cookies: We currently do not use any technically optional cookies or third-party analytics or marketing cookies in the app.
9.5 Retention period: Necessary session cookies are generally deleted when the browser is closed or when logging out. Persistent authentication cookies (if used) are automatically deleted after a defined period.

(10) Conclusion of a contractual relationship (purchase/booking of plans)

10.1 If you book paid services within the app (e.g. one-time purchase “Pay per Gallery” or the Unlimited plan), we process the data required for this, in particular:
10.1.1 contact data (e.g. email address, name),
10.1.2 billing data (e.g. billing address, country code, if applicable VAT ID),
10.1.3 contract and transaction data (e.g. selected plan, term, status, transaction ID, payment status).
10.1.4 Processing is carried out for the performance and fulfilment of the contractual relationship (Art. 6(1) sentence 1 lit. b GDPR) and – where necessary – for compliance with legal obligations (Art. 6(1) sentence 1 lit. c GDPR, e.g. commercial and tax retention obligations).
10.1.5 For billing and invoicing, we may use an accounting/invoicing tool (e.g. sevDesk). The legal basis for this is Art. 6(1) sentence 1 lit. b and lit. c GDPR.
10.1.6 The retention period depends on the contractual purpose and statutory retention obligations.

(11) Use of payment service providers

11.1 To process payments, we work with the payment service provider Mollie (Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands). Payment information (e.g. card or bank account data) is processed exclusively by Mollie; as a rule, we do not receive complete payment data, but in particular transaction IDs, status information and, where applicable, billing references.
11.2 Depending on the selected payment method, additional payment service providers (e.g. card networks) may be involved. This may result in data transfers to third countries. Mollie processes data in accordance with its own Privacy Policy and – where required – using appropriate safeguards under Art. 44 et seq. GDPR (e.g. EU Standard Contractual Clauses).

(12) Contacting us

12.1 When you contact us (e.g. by email), the data you provide (e.g. email address, if applicable name and content of the message) will be processed by us in order to handle your request. The legal basis is Art. 6(1) sentence 1 lit. b GDPR (contract/initiation of a contract) or Art. 6(1) sentence 1 lit. f GDPR (general communication/support).

(13) Notice for business customers (data processing / DPA)

13.1 If you use PictoMento as part of your photography business and in doing so process personal data (e.g. customer data, guest email addresses, as well as photo and video content), you will regularly act as the controller. We then process this data on your behalf as a processor.
13.2 We process personal data which you, as a photographer, process when using PictoMento exclusively on the instructions of the respective photographer. In this respect, the photographer is the controller within the meaning of Art. 4 No. 7 GDPR. Insofar as we process these data for the photographer, we act as a processor. For this purpose, a data processing agreement (DPA) pursuant to Art. 28 GDPR is concluded with each registered photographer – where required – governing data protection compliant processing.
13.3 PictoMento provides the photographer with the technical platform for creating and providing online galleries. In this context, we process the data as a processor. Responsibility for ensuring that an appropriate legal basis for the processing exists (in particular required consent or other legal permissions) lies with the photographer as controller.

(14) Current version and changes to this Privacy Policy

Due to the further development of our app and the offers made through it, or due to changed legal or official requirements, it may become necessary to amend this Privacy Policy.

Version: 01.03.2026