This Privacy Policy explains how PhotoSEO Vision (“the Service”, “we”, “us”, “our”), operated by Franklyn K Photography, collects, uses, stores, and protects your personal data.
We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR), the French Data Protection Act (Loi Informatique et Libertés), and other applicable data protection laws.
When you create an account, we collect:
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Authentication, communications | Contract performance |
| Name (optional) | Personalization, certificates | Legitimate interest |
| Password (hashed) | Authentication | Contract performance |
We use Supabase Magic Link authentication — we may not store a password at all if you authenticate via email link.
When you subscribe to a paid plan:
| Data | Purpose | Legal basis |
|---|---|---|
| Payment method (via Stripe) | Process payments | Contract performance |
| Billing address | Tax compliance, invoicing | Legal obligation |
| Transaction history | Accounting, dispute resolution | Legal obligation |
When you use the Service:
| Data | Purpose | Legal basis |
|---|---|---|
| Rename history (filenames, alt text, keywords) | Service delivery, article generation | Contract performance |
| Event metadata (venue, couple name, date) | Service delivery, copyright registration | Contract performance |
| Credit consumption logs | Billing, plan enforcement | Contract performance |
| IP address | Security, fraud prevention | Legitimate interest |
| Browser/device type | Service optimization | Legitimate interest |
| Feature usage analytics | Service improvement | Legitimate interest |
When you use the rename feature:
When you use the blockchain copyright feature:
We use your personal data for the following purposes:
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide the Service (renaming, copyright, blog generation) | Account data, event metadata, photo hashes | Contract performance |
| Process payments | Billing data | Contract performance |
| Generate copyright certificates | Name, event metadata, blockchain records | Contract performance |
| Send service notifications | Email address | Contract performance |
| Send marketing communications | Email address | Consent (opt-in) |
| Prevent fraud and abuse | IP address, usage patterns | Legitimate interest |
| Improve the Service | Anonymized usage analytics | Legitimate interest |
| Comply with legal obligations | Billing data, transaction records | Legal obligation |
We share your data only with the following categories of recipients, and only to the extent necessary:
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase | Database, authentication | Account data, usage data | EU (Frankfurt) |
| Stripe | Payment processing | Billing data | USA |
| Anthropic | AI photo analysis, content generation | Photo thumbnails (transient), event metadata | USA |
| Pinata | IPFS metadata storage | Event metadata, photographer name, hashes | USA |
| Vercel | Application hosting | IP address, request logs | EU / USA |
When you use the copyright feature, the following data is written to public blockchains:
Metadata pinned to IPFS includes: photographer name (as provided by you), venue name, event name, photo filenames, alt text, and keywords. This data is content-addressed and may be publicly accessible. It does not include photo files.
If you use the blog publishing feature, article content is sent to your connected CMS (WordPress, Webflow) via their APIs, using your own authentication credentials. We act as a conduit — the data is published to your CMS account, not ours.
Data recorded on the Polygon and Bitcoin blockchains is permanent and cannot be deleted. This includes cryptographic hashes and IPFS CIDs. This immutability is the core feature that provides copyright proof.
Under GDPR Article 17, you have the right to request deletion of your personal data. We will delete all data stored in our database (Supabase) and request unpinning of IPFS data from Pinata. However, we cannot delete data already written to public blockchains, as we do not have technical control over these decentralized networks.
By activating the copyright protection feature, you explicitly consent to the permanent recording of hash data on public blockchains and the publication of event metadata on IPFS. You can choose not to use these features — they are opt-in on the Pro and Studio plans.
| Data type | Retention period | Reason |
|---|---|---|
| Account data | Duration of account + 30 days | Service delivery |
| Billing records | 10 years after transaction | French tax law (Code général des impôts) |
| Rename history | Duration of account | Service delivery |
| Event metadata | Duration of account | Service delivery |
| Usage analytics | 26 months (anonymized) | Service improvement |
| Blockchain records | Permanent (immutable) | Copyright protection |
| IPFS metadata | Duration of Pinata pinning | Copyright protection |
| Server logs (IP, requests) | 12 months | Security |
Upon account deletion, we delete all deletable data within 30 days. See Section 5 for blockchain and IPFS data.
Some of our service providers are located outside the European Economic Area (EEA). We ensure appropriate safeguards for international transfers:
| Provider | Country | Transfer mechanism |
|---|---|---|
| Stripe | USA | EU-US Data Privacy Framework (DPF) |
| Anthropic | USA | EU-US DPF + Standard Contractual Clauses |
| Pinata | USA | Standard Contractual Clauses |
| Vercel | USA / EU | GDPR DPA, EU hosting option |
The EU-US Data Privacy Framework was upheld by the EU General Court in September 2025 (Latombe case), providing a stable legal basis for transfers to certified US companies.
As a data subject, you have the following rights:
| Right | Description | How to exercise |
|---|---|---|
| Access | Obtain a copy of your personal data | Email privacy@franklyn-k.com |
| Rectification | Correct inaccurate data | Account settings or email us |
| Erasure | Request deletion of your data | Account settings or email us (see Section 5) |
| Restriction | Limit how we process your data | Email us |
| Portability | Receive your data in a structured format (JSON/CSV) | Email us |
| Objection | Object to processing based on legitimate interest | Email us |
| Withdraw consent | Withdraw consent for marketing | Unsubscribe link or account settings |
| Lodge a complaint | File a complaint with a supervisory authority | CNIL (cnil.fr) for France |
We will respond to your request within 30 days. If your request is complex, we may extend this to 60 days with notice.
We implement appropriate technical and organizational measures to protect your data:
We use strictly necessary cookies for:
These cookies do not require consent as they are essential for the Service to function.
We use anonymized, privacy-friendly analytics (no third-party tracking pixels, no Google Analytics). If we implement analytics that process personal data, we will update this policy and request your consent.
We do not use advertising cookies, retargeting pixels, or any form of ad-based tracking.
When you use the AI features, compressed photo thumbnails and event metadata are sent to Anthropic's API for analysis. Anthropic processes this data to generate filenames, alt text, keywords, and article content.
Anthropic's data handling:
For details, see Anthropic's Privacy Policy.
The Service does not make automated decisions that produce legal effects on you (per GDPR Article 22). AI-generated content is always presented as a suggestion for your review and approval.
The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided personal data to us, contact us at privacy@franklyn-k.com and we will delete it promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service at least 14 days before they take effect. The “Last updated” date at the top reflects the most recent revision.
For questions about this Privacy Policy, to exercise your rights, or to raise a concern:
Supervisory authority:
Commission Nationale de l'Informatique et des Libertés (CNIL)
3 Place de Fontenoy, TSA 80715
75334 Paris Cedex 07
cnil.fr
This Privacy Policy is effective as of March 21, 2026.