Privacy Policy

Introduction

At Creative Photography Group, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and protect your information when you use our service.

Information we collect

Account information

When you create an account, we collect:

• Email address (for account verification and communication)
• Profile information (nickname, screen name, bio, avatar)
• Authentication information (managed securely by Supabase)

Photos and content

When you upload photos, we store:

• Your photos (stored securely in Supabase storage)
• Metadata associated with photos (titles, descriptions, tags, album associations). We also extract and store EXIF data embedded in your photos, such as camera make and model, lens, exposure settings, focal length, date taken, and GPS coordinates. This data is displayed alongside your photos on the site.
• Thumbnails and optimized versions for faster loading

Usage data

We may collect information about how you use the service, such as:

• Pages visited and features used
• Interaction data (likes, comments, views)
• Device and browser information for technical support

How we use your information and legal basis

Under the GDPR (AVG), we need a legal basis for processing your data. Here is what we do and why:

• Contract performance: Storing and displaying your photos in galleries, albums, and your profile. Managing your account and profile. Handling event RSVPs and sending confirmations. Sending service-related emails such as event reminders, comment notifications, and challenge updates.
• Legitimate interest: Analyzing anonymous usage data (via Vercel Analytics) to improve the website. Detecting and preventing spam or abuse. Maintaining the security of the platform.
• Consent: Sending newsletters and promotional announcements. Signing in with a third-party provider like Google or Discord.

We do not sell, rent, or share your personal information or photos with third parties for their commercial purposes.

Your rights

You have the right to:

• Access your data: Request a copy of the personal data we hold about you
• Update your data: Edit your profile, name, bio, and avatar through your account settings
• Delete your data: Delete your photos yourself, or schedule full account deletion from your account settings. Account deletion takes effect after a 30-day retention period, during which you can contact us to cancel.
• Data portability: Request a copy of your data in a portable format
• Manage email preferences: Unsubscribe from specific email categories (newsletters, event updates, challenge announcements, notifications) using the unsubscribe link in any email, or through your account settings
• Object to processing: Ask us to stop processing your data for purposes based on legitimate interest. If you object, we will stop unless we have compelling grounds to continue.
• Lodge a complaint: File a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) at autoriteitpersoonsgegevens.nl

To exercise these rights, contact us through our website.

Data storage, retention, and third parties

Your account information, photos, and related data are stored using Supabase (authentication, database, and cloud storage). Anonymous web analytics are collected via Vercel Analytics, which does not use cookies or collect personal data (see the Cookies and tracking section below).

These services may process data outside the EU/EEA (e.g. in the United States) under appropriate safeguards for international data transfers, including Standard Contractual Clauses (SCCs) approved by the European Commission. We do not share your data with other third parties except as necessary to provide the service.

We retain your data for as long as your account is active. When you delete content, it is immediately hidden from all users and marked for permanent deletion. Deleted content, including all associated files, is permanently purged from our servers within 30 days. When your account is deleted, the same process applies to all remaining content. Some data may also remain in backups for a limited period for disaster recovery purposes, but it will not be accessible through the service.

Cookies and tracking

We use cookies and similar technologies only where necessary. We do not use tracking cookies or share data with third parties for advertising purposes.

Functional cookies (authentication)

When you log in, we use cookies to maintain your session. These are essential for the website to function and do not require your consent under Dutch law (Telecommunicatiewet).

• Cookie names: sb-*-auth-token (set by Supabase)
• Purpose: Authentication and session management
• Type: Functional / essential
• Retention: Duration of your session (until you log out or the session expires)

Web analytics (no cookies)

We use Vercel Analytics to understand how visitors use our website. This service does not use cookies. It collects anonymous, aggregated data only (e.g. page views) and cannot identify individual visitors or track you across other websites. No personal data is collected.

You can control or delete cookies through your browser settings. Note that disabling functional cookies may prevent you from logging in or using certain features.

Children's privacy

Our service is not intended for users under the age of 16. In the Netherlands and the EU, we do not knowingly collect personal information from children under 16 without parental consent.

Data controller and contact

The data controller responsible for your personal data is Creative Photography Group. If you have questions about this Privacy Policy or your data, please contact us through our website or community channels.

Changes to this policy

We may update this Privacy Policy from time to time. We will notify users of significant changes through our website or email. We encourage you to review this page periodically.