Privacy policy
This policy explains what personal information Fotessa ("we") collects through Fotessa, why, and what you can do about it. We are the controller for information about photographers who use Fotessa. For information about a photographer's clients (gallery visitors and people who use a photographer's contact page), the photographer is the controller and we process it for them; see "If you're a photographer's client" below.
What we collect, and why
| Information | Why | Legal basis |
|---|---|---|
| Your name, email address and password (stored only as a secure hash) | To run your account and sign you in, and to email you about it | Contract |
| The photographs, text and settings you upload | To show your site and galleries | Contract |
| Your plan and billing status, and Stripe's customer and subscription ids | To provide the plan you pay for. Stripe holds your card details; we never see them | Contract |
| Signed-in sessions: when they started and your browser's user-agent | To keep you signed in, and so you can recognise your devices | Contract |
| IP addresses, briefly | To limit repeated attempts at signing in, signing up, passwords and forms. Deleted within 24 hours | Legitimate interests (security) |
Our server logs record each request's time, site, page type, result and size, but not IP addresses or full page addresses. We don't use analytics, advertising or tracking of any kind, and we don't sell or share information for marketing.
If you're a photographer's client
When you open a gallery and choose to pick favourites or comment, you give your name and email address. We record them, with your favourites, comments, and when you viewed, submitted or downloaded, for the photographer who sent you the gallery. When you use a photographer's contact page, your name, email and message go to that photographer. The photographer decides how this is used; please contact them first with any questions. We use it only to provide their galleries and site, and we'll help them with any request you make.
Original files offered for download are exactly as the photographer uploaded them, which can include camera details and, if the camera recorded it, location. The smaller versions we make for viewing have this information removed.
Cookies
We only use cookies that are needed for the service to work, so we don't ask for consent and there's no cookie banner.
| Cookie | What it does | Lasts |
|---|---|---|
sid | Keeps a photographer signed in to their site's admin | 30 days from last use |
g_… | Remembers that you've entered a gallery's password | 30 days |
gv_… | Remembers who you are in a gallery, so your favourites are kept | 180 days |
Who else handles information
- Hetzner Online (Germany): hosting and backups, on servers in the EU.
- Resend (USA): sends email, such as sign-in links and gallery notifications.
- Stripe (Ireland and USA): sells paid plans as merchant of record, takes payment and handles tax. For your payment details, Stripe is a controller in its own right under its own privacy policy.
Transfers to the USA are protected by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, or by the provider's certification under the UK–US data bridge and EU–US Data Privacy Framework.
How long we keep it
- Your account and site: until you delete your site. It's then permanently deleted after 14 days.
- Backups: kept for up to 8 weeks, so deleted information disappears from them within that time.
- Sign-in sessions end after 30 days without use. Email links expire within 7 days.
- Billing records: Stripe keeps them as long as the law requires for tax and accounting.
- Gallery visitors' details and contact messages: until the photographer deletes them, or their site.
Keeping it safe
Everything is sent over HTTPS. Passwords are stored as salted hashes, and session cookies are stored only as hashes. Galleries can have passwords and expiry dates and are never shown to search engines. Backups are copied each night to separate storage.
Your rights
You can ask to see, correct, delete or receive a copy of your information, and object to or restrict how it's used. Photographers can download everything from Settings and delete their site there at any time. For anything else, email hello@fotessa.com and we'll reply within a month. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office (ico.org.uk).
Changes
If we change this policy in a way that matters, we'll email photographers before it takes effect.
Contact
Fotessa. Email hello@fotessa.com.
Last updated 3 October 2026. See also our terms.