Privacy policy

1. Who we are

GalleryCloud (“we”, “us”) is an online platform that lets photographers upload, deliver and showcase photo and video galleries for their clients. The data controller responsible for your personal data is:

LAZAR RAUL-ANDREI P.F.A.
Authorised natural person (Persoană Fizică Autorizată) registered in Romania
Tax identification number (CUI): 54741496
Contact for privacy matters: our contact page

This policy explains how we collect, use and protect personal data in compliance with the EU General Data Protection Regulation (GDPR) and applicable Romanian law.

2. Data we collect

• Account data: your name, email address and a hashed version of your password (we never store passwords in plain text). If you sign in with Google, we receive your name, email address and Google account identifier from Google instead of a password.
• Galleries & media: the photos and videos you upload, with basic technical metadata (file type, size, upload time), plus gallery titles, subtitles, welcome messages, themes, unique links, access passphrases, download keys and expiry dates you set.
• Public profile: if you publish a profile page, the display name, bio, tagline, location, links, profile photo and cover image you add. These are visible to anyone who has the link.
• Client activity: people viewing a gallery you share can mark favourites, leave comments and optionally enter their name. This is linked to a per-gallery browser session, not to a GalleryCloud account, and is shown only to the photographer who owns the gallery.
• Payment data: Pro subscriptions are processed by Stripe. We keep your Stripe customer and subscription identifiers, subscription status, renewal date and preferred language. Stripe collects your billing address and, optionally, a business tax ID. We never receive or store your full card number.
• Support & contact messages: if you use the contact form, we store the name, email address, subject and message you provide.
• Technical & log data: our infrastructure automatically records data such as your IP address, browser user-agent, request times and the pages or endpoints accessed. This is used for security, abuse prevention and debugging. We also record when you were last active, to apply the inactivity rules in section 9.

3. How we use your data

We use personal data to:

• Provide the service — store and deliver your galleries, authenticate your account, process subscriptions and send transactional emails (email verification, password resets, payment receipts and notices about your subscription or stored data).
• Keep the platform secure — bot protection, rate limiting, and fraud and abuse prevention.
• Communicate with you — respond to support requests and send occasional important announcements about the service.
• Comply with legal obligations, including tax and accounting rules for payments.

We do not sell your data and we do not use it for advertising or third-party marketing.

4. Legal basis for processing

We rely on the following GDPR legal bases:

• Performance of a contract (Art. 6(1)(b)) — providing the service you signed up for, including storage, gallery delivery and billing.
• Legitimate interests (Art. 6(1)(f)) — platform security, abuse prevention, basic operational logging and service announcements.
• Legal obligation (Art. 6(1)(c)) — retaining payment and invoicing records.

5. Cookies & local storage

We use only strictly necessary cookies — no analytics, advertising or cross-site tracking:

• Session cookie (__lumen_session) — keeps you signed in (expires after 30 days).
• Gallery access cookie (__lumen_g_…) — remembers that you entered the correct passphrase for a protected gallery.
• Download access cookie (__lumen_dl_…) — remembers that you entered the download key for a gallery.

We also use your browser’s local storage to remember minor preferences, such as your language, whether you have seen the cookie notice or the onboarding guide, and your dashboard colours. Cloudflare, our hosting provider, may set its own strictly necessary cookies for security and bot management. Cloudflare Turnstile and Google Sign-In may set cookies or storage on the pages where they are used.

6. Third-party service providers

We share personal data with the following processors and providers, only as needed to run the service:

• Cloudflare — hosting, application runtime, database (D1), file storage (R2), CDN, DNS and bot protection (Turnstile).
• Stripe — subscription billing, invoices and payment receipts.
• Resend — delivery of transactional emails.
• Google — “Sign in with Google” authentication (optional) and Google Fonts. When your browser loads a page, it requests font files from Google’s servers, which discloses your IP address to Google.

We do not use analytics, advertising or social-media tracking services.

7. International data transfers

Some of our providers (including Cloudflare, Stripe, Resend and Google) are based in or process data in the United States and other countries outside the European Economic Area. Where personal data is transferred outside the EEA, it is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

8. Data storage & security

Data is stored on Cloudflare’s infrastructure (Workers, D1 database, R2 object storage). Passwords are hashed with PBKDF2-HMAC-SHA-256, and session cookies are cryptographically signed. All connections use HTTPS. Access to production systems is restricted. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Data retention

• Account data — kept while your account is active; erased when you delete your account.
• Galleries, photos and videos — kept until you delete them, until a gallery’s expiry date passes, or until your account is deleted, whichever comes first. Client favourites and comments are deleted together with their gallery. Deletion from storage is permanent.
• After a Pro subscription ends — you keep full access for 15 days, then your galleries become read-only for 30 more days. If you have not resubscribed by then, your galleries and files are permanently deleted. We email you before each step.
• Inactive free accounts — if you have not signed in for 12 months, we email you a warning. If you still have not signed in 30 days later, your galleries and files are permanently deleted.
• Payment records — retained for 10 years to meet tax and accounting obligations.
• Contact messages — kept for as long as needed to handle your request.
• Server and security logs — retained for up to 30 days.

10. Your rights

Under the GDPR you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (“right to be forgotten”)
• Restrict or object to processing
• Data portability — receive your data in a structured, machine-readable format

You can delete your account and its data directly from your profile. For any other request, write to us through our contact page; we respond within one month. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro), or with the data protection authority in your EU country of residence.

11. Data breach notification

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it and, where the risk is high, inform affected users without undue delay.

12. Children’s privacy

The service is not directed to children. You must be at least 18 years old to create an account. We do not knowingly collect personal data from children. Photographers are responsible for obtaining any consent required before uploading photos of minors.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new “last updated” date and, for significant changes, notify registered users by email or an on-platform notice.

14. Contact

For questions about this policy or your personal data, write to us through our contact page. We have not appointed a Data Protection Officer, as we are not required to; privacy requests are handled through the same channel.