Privacy Policy

Last updated: 6 October 2026

1. Who's responsible for your data

photor, registered with the Dutch Chamber of Commerce (KVK) under number 42138416, VAT/BTW number NL005527372B78, Amstelveenseweg 233II, 1076CP Amsterdam, the Netherlands is the data controller for the personal data described in this policy. Contact us at hello@photor.cc for any privacy question or request, including access, correction, deletion and portability.

2. What we collect

• Account data: your email address, a hashed password, your license key, and your subscription status/plan.
• Billing data: we don't see or store your payment details. Paddle.com Market Ltd, our Merchant of Record, collects and processes your billing information directly — see Paddle's Privacy Notice. We receive only your subscription status and renewal date from Paddle.
• Project content: the photos, GPS/EXIF metadata, annotations, thermal data, PDFs and reports you create or upload while using photor.
• Trial requests and emails: when you request a trial we keep your name, company, work email and the details you give about your work, so we can set up the trial and follow up on it. During a trial we send a short series of onboarding emails; every one of them has an unsubscribe link, and they contain no tracking pixels or tracked links.
• Technical data: session cookies needed to keep you logged in, and basic server logs (IP address, timestamp, request path) kept briefly for security and debugging.

3. How your photos and annotations are used

Your project content is used first and foremost to run the Service for you — displaying your photos on the map, running on-device OCR on nameplates, and building your reports.

By default, we additionally use a narrow slice of that content — the cropped image region of an individual annotation, together with its text description — to train and improve photor's own recognition models. Before this happens:

• GPS and other location-identifying EXIF metadata is stripped from the crop;
• project names are hashed, so training data isn't traceable back to a specific site or customer by us or anyone reviewing the training set.

You can switch this off for any individual project at any time (Settings within that project) — once switched off, no further annotations from that project are used for training. This is on by default because it's how photor's recognition accuracy keeps improving for everyone, but it's your choice to make per project.

4. Our legal basis for processing

We process your account and project data to perform our contract with you (running the Service you've subscribed to). We process annotation data for model training under our legitimate interest in improving the Service, balanced against the safeguards in Section 3 (metadata stripping, hashing, and your per-project opt-out) — where the law requires your consent instead, we'll ask for it.

Businesses we approach. We occasionally email businesses that may benefit from photor, using business contact details they publish themselves — a company website or a public certification register such as SCIOS. We do so under our legitimate interest in offering the Service to professionals. Each message carries a one-click link that stops all further messages; we send at most three about the same subject. Ask us at hello@photor.cc and we delete your details.

What we see of those messages. The links in them carry a code for your company, so we can see whether a link was followed and how the example inspection it opens is used — which parts are opened, for how long, whether a finding is added or the report downloaded. We use this only to judge which of our messages are useful and to stop writing to businesses they are not useful to. We do not track whether a message is opened, we use no third-party tracking, and we delete these records after twelve months, or straight away when you ask.

5. Who we share data with

We don't sell your data. We share data only with the processors that help us run photor:

• Paddle.com Market Ltd — billing, subscription management, VAT/tax compliance, as Merchant of Record for your purchase.
• Mijndomein (Dutch hosting and email provider) — hosts this website, its database and the hello@photor.cc mailbox, and sends account, trial and onboarding emails from it.
• Our hosting providers — run the servers photor's application and your project data live on.

We only disclose personal data beyond this if required by law, or with your consent.

6. Where your data is processed

Our infrastructure and processors are based in the EU/EEA or the UK. Where a processor is located outside the EEA, we rely on appropriate safeguards (such as the EU Standard Contractual Clauses) as required by the GDPR.

7. How long we keep it

We keep your account and project data for as long as your account is active. If you close your account or your subscription lapses and isn't renewed, we keep your data for a reasonable grace period to allow you to export it or reactivate, and then delete it, except where we need to keep limited records for legal or accounting purposes (for example, invoice records).

8. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• request deletion of your data ("right to be forgotten");
• restrict or object to certain processing, including the training use described in Section 3 (you can also just switch this off per project yourself);
• receive your data in a portable format;
• lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your own country's supervisory authority.

To exercise any of these, email hello@photor.cc.

9. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS) between your browser and our servers, hashed passwords, and access controls on the systems that store your project data. No system is perfectly secure, but we take reasonable steps to protect what you share with us.

10. Cookies

We use only the cookies necessary to keep you signed in and to protect your account (session and CSRF-protection cookies). We don't use third-party advertising or tracking cookies on photor.cc or in the app.

11. Children's privacy

photor is a professional tool intended for business use and isn't directed at children. We don't knowingly collect personal data from anyone under 16.

12. Changes to this policy

We may update this policy from time to time, for example as the Service evolves. We'll post the updated version here with a new "Last updated" date, and for material changes we'll email account holders in advance.

13. Contact

Email hello@photor.cc, or write to photor, Amstelveenseweg 233II, 1076CP Amsterdam, the Netherlands. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).