Privacy Policy
Last updated: 23 April 2026 · Compliant with Regulation (EU) 2016/679 (GDPR) and with French Law No. 78-17 of 6 January 1978, known as the « Informatique et Libertés » Act, as amended.
1. Who are we?
The photag.fr website and the Photag platform are published by the company Yvardis, a SARL (French limited liability company) with a share capital of 1 000 €, registered with the Trade and Companies Register (RCS) of Laval under number 912 043 064, whose registered office is located at 4 la mitrie, 53700 Villaines-la-Juhel, France (hereinafter "Photag", "we").
For any question relating to your personal data or to the exercise of your rights, you may write to us at hello@photag.fr or by post to our registered office.
Photag is not subject to the obligation to appoint a Data Protection Officer (DPO) within the meaning of Article 37 of the GDPR. Your dedicated contact for any privacy question remains the address above.
2. Scope of this policy
Photag acts in two distinct roles within the meaning of the GDPR:
- Data controller for account data (photographers, organizers, participants, buyers), payment data, browsing data and optional facial recognition.
- Technical processor for the photographs uploaded by photographers to the platform: each photographer remains the controller of the processing of the images they publish and market, with Photag providing the hosting, gallery and sales infrastructure.
This distinction is important because it determines who your contact is: for a question about a specific photo, it is the photographer organizing the event who is responsible; for a question about your Photag account, it is us.
3. Data we collect
3.1 Photographers and organizers
- Identity: first name, last name, email address, telephone number (optional).
- Billing data: name/business name, address, country, VAT identifiers where applicable.
- Bank details for payouts: IBAN, BIC, account holder name.
- Usage data: uploaded photos, events created, gallery and commission settings.
- Financial data: pending balances, commissions, payout history.
3.2 Participants in an event
- If you create a participant account: first name, last name, email, events followed, "liked" photos.
- If you enable the facial recognition feature (optional): a reference selfie + a biometric vector computed from that selfie (see the dedicated section 5).
- Without an account (anonymous browsing): no personal data is collected beyond the technical browsing data (see section 10 Cookies).
3.3 Photo buyers
- Last name, first name, email address, billing address.
- Payment data processed directly by Stripe (our approved payment provider): we never store the full bank card number or the security code. Only the last 4 digits and the card type are retained as evidence.
- Purchase history and invoices.
3.4 Browsing data
- IP address, browser type, operating system, pages visited, referrer.
- Anonymized audience statistics (see section 10 Cookies).
4. Why we use this data — purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creation and management of your account, authentication | Performance of the contract (art. 6.1.b) |
| Hosting and distribution of your photos (photographers) | Performance of the contract |
| Processing of orders and payments | Performance of the contract |
| Issuance of invoices and accounting obligations | Legal obligation (art. 6.1.c) |
| Facial recognition / selfie search | Explicit consent (art. 9.2.a — biometric data) |
| Newsletter and commercial communications | Consent (art. 6.1.a) |
| Audience measurement and improvement of the service | Legitimate interest (art. 6.1.f) — consent for non-essential cookies |
| Fraud prevention and security | Legitimate interest |
| Management of disputes and unpaid amounts | Legitimate interest |
5. Facial recognition — specific processing
The selfie search feature processes biometric data, which constitute a special category of personal data within the meaning of Article 9 of the GDPR. We apply a reinforced level of protection to it.
Strictly optional activation. You can find your photos by bib number or by browsing the gallery without ever enabling facial recognition. It is never enabled by default.
Only upon creation of a participant account. No biometric data is recorded for visitors who are not logged in. If you browse anonymously, nothing is stored.
Explicit consent. At the moment when you take or upload a selfie, a clear message explains to you the nature of the processing and asks you for separate consent, which may be withdrawn at any time.
What is stored: the reference image (your selfie) and a mathematical vector (embedding) computed from it. This vector is used solely to compare your face with event photos and is not shared with any third party.
Retention period: for as long as your participant account exists. Deleting your account results in the immediate and permanent deletion of your reference selfie and of all associated vectors. You may also delete only the facial recognition without deleting your account, from your personal area.
6. Recipients and processors
To operate the platform, we rely on technical providers selected for their security and compliance guarantees. Each processor is bound by a contract compliant with Article 28 of the GDPR.
| Provider | Role | Location |
|---|---|---|
| Supabase | Authentication, database | European Union |
| Wasabi Technologies | Photo storage (S3) | Paris — France (EU) |
| Stripe Payments Europe Ltd. | Processing of payments and subscriptions | Ireland (EU) |
| Resend | Sending of transactional emails | United States * |
| Google Analytics | Audience measurement | United States * |
| MercuryCloud | Hosting of the application servers | France (EU) |
| n8n (self-hosted) | Internal automations | France (EU) |
* United States: transfers governed by the standard contractual clauses (SCC) adopted by the European Commission and, where applicable, the Data Privacy Framework (DPF).
Beyond these technical providers, your data may be disclosed to the tax authorities as part of our accounting obligations, or to the judicial authorities upon formal request. No data is sold or rented to third parties for commercial purposes.
7. Retention period
| Data | Duration |
|---|---|
| User account (photographer, participant, buyer) | For the entire lifetime of the account. Immediate deletion upon request. |
| Photos uploaded by photographers | For as long as the photographer keeps them on the platform. They may delete them at any time from their account area. No automatic purge. |
| Selfie and biometric vectors (participants) | For as long as the participant account exists. Immediate deletion upon deactivation of the feature, upon request, or upon deletion of the account. |
| Orders, invoices, accounting records | 10 years after the close of the financial year (art. L123-22 du Code de commerce — French Commercial Code). |
| Bank details (last 4 digits of the card) | 13 months from the debit (recommendation of the CNIL, the French data protection authority). |
| Newsletter consent | Until you unsubscribe. Proof of consent retained for 3 years after the last contact. |
| Technical and security logs | 12 months maximum (CNIL recommendation). |
| Audience statistics (analytics cookies) | 13 months maximum. |
8. Security of your data
We implement the following measures to protect your data:
- Encryption of communications via HTTPS / TLS 1.2+ across the entire site.
- Encryption at rest of database backups and of stored objects.
- Passwords never stored in plain text (irreversible cryptographic hashing on the Supabase side).
- Access to production data restricted to authorized persons only, with two-factor authentication.
- Regular and encrypted backups.
- Environment segregation policy (development / production).
- In the event of a data breach likely to give rise to a risk to your rights and freedoms, we will notify the CNIL within 72 hours and will inform you if the risk is high, in accordance with Articles 33 and 34 of the GDPR.
9. Your rights
In accordance with the GDPR, you have the following rights over your personal data:
- Right of access (art. 15): obtain a copy of the data we hold about you.
- Right of rectification (art. 16): correct inaccurate or incomplete information.
- Right to erasure (art. 17): request the deletion of your data; we undertake to delete any photo concerning you upon simple request.
- Right to restriction (art. 18): restrict the use of your data in certain cases.
- Right to portability (art. 20): retrieve your data in a structured and readable format.
- Right to object (art. 21): object to certain processing, in particular for direct marketing purposes.
- Right to withdraw your consent at any time for the processing that depends on it (facial recognition, newsletter, cookies).
- Right to give post-mortem directives (loi 78-17, art. 40-1) on the fate of your data after your death.
To exercise one of these rights, write to us at hello@photag.fr. We reply within a maximum period of one month. If we do not act upon your request, you have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés, 3 place de Fontenoy, 75007 Paris).
10. Cookies and trackers
The site uses two categories of cookies and trackers:
- Strictly necessary cookies (exempt from consent): they enable the basic functioning of the site, such as maintaining your authenticated session, your shopping cart or your language preference.
- Audience measurement cookies (Google Analytics): they help us understand how the site is used in order to improve it. These cookies are placed on the basis of your consent, which you may give or withdraw at any time from the cookie banner or from your browser settings.
On your first visit, a banner allows you to accept or refuse audience measurement cookies. Your choice is stored and you can change it at any time via the "Manage my cookies" link at the bottom of the page. You can also configure your browser to refuse all cookies or to be warned before they are placed.
Maximum lifetime of analytics cookies: 13 months, in accordance with the recommendation of the CNIL.
11. Changes to this policy
This policy may be updated to reflect changes in our services, in our processors or in the applicable legal framework. The date of the last update appears at the top of this page. In the event of a substantial change, we will inform you by email or via a notification in your personal area.
12. Contact us
For any question relating to this policy or to the exercise of your rights:
- By email: hello@photag.fr
- By post: Yvardis — 4 la mitrie, 53700 Villaines-la-Juhel, France
See also: Legal notice.