What Phototory collects, why, who else handles it, and how long it lasts. The short version: we hold your photographs and your email address for as long as it takes to give you your report and let you download it again, and then we delete them.
1. Who this policy covers
This policy covers phototory.com and the Phototory service. It applies whether you buy a report or only try the free sample.
Phototory is operated by Deeko Global LLC, an Ohio limited liability company, of PO Box 37, Mason, OH 45040, United States.
Phototory is offered to people in the United States. We do not currently market or offer the service elsewhere, and it is not built to meet the requirements of privacy laws outside the United States.
2. What we collect
Photographs you upload, and the report generated from them.
Your email address, when you give one for report delivery, to sign in, or through the contact form.
Payment records. Stripe processes the payment itself; we keep the transaction identifiers and the amount, and never receive your card number.
Contact form submissions: your name, email address, the topic you chose, and your message.
Basic technical information needed to operate and protect the service, including a one-way hash of the IP address a contact form submission came from. We store the hash, not the address itself.
If you accept analytics and advertising cookies, information about how you move through the site. If you decline, they are never set and none of it is collected.
In the categories California law uses, that is: identifiers, commercial information, internet or network activity, and visual information. We do not collect Social Security or government identification numbers, precise geolocation, biometric identifiers, or health information.
We collect all of it from you directly. We do not buy personal information about you from data brokers or anyone else.
3. What we do with it
Produce your report, deliver it, and let you download it again while it is retained.
Take payment, and keep the records of it that financial and tax rules require.
Reply when you contact us, and recognize repeated automated submissions so the contact form stays usable.
Understand, with your consent, which parts of the site work and which do not.
We do not use your photographs or the contents of your reports for advertising, and we never disclose them to advertisers. Analytics events carry no photograph, no report line, and no email address.
4. Your photographs
Your photographs are sent to an automated image-analysis service operated by Anthropic, which identifies the items visible in them. No human at Phototory reviews your photographs as a matter of routine.
We do not use your photographs to train any model, and under the terms we use that analysis service on, material sent to it is not used to train its models either.
They are stored so your report can be regenerated and re-downloaded during the retention period, and are then deleted along with it.
A photograph of a room can contain more than furniture: documents, screens, pictures of people, personal effects. Everything visible in the frame is uploaded with it, so upload only what you are comfortable sending.
5. Who else handles your data
Anthropic, for automated analysis of uploaded photographs.
Stripe, for payment processing on one-time report purchases and extended-storage subscriptions.
Amazon Web Services, for storage of photographs and reports, delivery of email, and hosting.
Cookiebot, which presents the cookie banner, records your consent choice, and keeps a record of it so it can be honored on your next visit.
Google, for Tag Manager, which loads on every page and decides which measurement tags may run, and for Analytics, only if you accept analytics cookies.
Meta, only if you accept advertising cookies.
Neither Google Analytics nor Meta receives photographs, report contents, or your email address.
Each of these handles your information to provide the service described above, under contract with us, and none is permitted to use it for their own unrelated purposes.
6. How long we keep things
Photographs and reports: 30 days from upload. At that point the report can no longer be reached and the record of it is deleted. If an active extended-storage subscription is attached to the account that owns them, they are kept while it runs. If that subscription is canceled, a further 30 days runs from the cancellation date and the same thing happens then.
Erasure completes within 7 days after that. The stored files are held briefly after deletion so an accidental deletion can be undone, and are then erased. So everything is gone within 37 days of upload at the latest, and within 7 days of whichever later date applies to you.
Contact form messages: up to 12 months, so a conversation outlives the report it was about.
Sign-in links: minutes. They expire shortly after being sent, can be used only once, and are stored hashed, so the stored value cannot be used to sign in.
Account records: until you ask us to delete the account.
Payment records: seven years, which is how long we keep financial records for tax purposes.
Deletion is enforced by a scheduled job, not by a promise. When the window passes, the photographs, the generated PDF and the underlying record are removed, and once erasure has completed nothing can be restored.
7. Cookies, analytics and advertising
Cookies strictly necessary to operate the site, which keep you signed in and remember your cookie choice, are always set.
Analytics and advertising cookies are set only after you accept them.
Our cookie banner is provided by Cookiebot, which records your choice and enforces it. A tag manager, Google Tag Manager, loads on every page and sets no cookies of its own; it is told at the outset that analytics and advertising storage are denied, and holds those tags back until you accept. The advertising pixel is not loaded at all until then.
Declining is presented as plainly as accepting, and you can change your mind at any time by choosing Cookie settings at the bottom of any page.
Because these are off until you turn them on, you do not need to send us an opt-out signal to stay out of them. If you have a Global Privacy Control setting enabled in your browser, leaving analytics and advertising cookies declined achieves the same result.
8. Selling and sharing your information
We do not sell your personal information for money, and we never sell or disclose your photographs or report contents to anyone for advertising.
If you accept advertising cookies, information about your visit to this site is shared with Google and Meta so that we can measure advertising. Some state privacy laws, California's in particular, define selling and sharing broadly enough that this can count as sharing for cross-context behavioral advertising.
That is the only thing on this site that could fall under those definitions, it is off unless you switch it on, and switching it back off in the cookie notice stops it.
9. Your privacy rights
Depending on the state you live in, you may have the right to know what personal information we hold about you and to get a copy of it, to have it corrected, to have it deleted, and to opt out of its sale or sharing or of targeted advertising.
We will not deny you service, charge you a different price, or give you a worse experience for exercising any of these rights.
To make a request, use the contact form at /contact and choose Privacy or data request, or write to us at the postal address below. We will ask you to confirm control of the email address involved, so that nobody else can make a request about your information. An authorized agent may make a request for you, and we will ask for proof that you authorized them.
We respond within 45 days. If a request is complex we may take up to another 45 days, and we will tell you within the first 45 if that happens. If we refuse a request you can ask us to reconsider by replying to our response, and we will answer that appeal in writing.
Because reports are deleted automatically after 30 days and erased within 37, a deletion request about an old report may find nothing left to delete. We will tell you if that is the case.
10. Security
Photographs and reports are stored encrypted, and are not publicly listed or browsable.
A report link contains a long random identifier and is not guessable, but it is not password-protected either: anyone you forward it to can open the report while it exists. Treat it like a document, not a login.
Sign-in links and the stored fingerprints of IP addresses are hashed, so the stored values cannot be reversed into a usable credential or an address.
No service can promise perfect security. If a breach affects your personal information we will notify you, and the authorities we are required to notify, as promptly as the law requires.
11. Children
Phototory is not intended for children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has sent us information, contact us and we will delete it.
If you are between 13 and 18, use Phototory only with the involvement of a parent or guardian.
12. Changes to this policy
If this policy changes materially we will say so on the site, and by email where we hold your address and the change affects you. The effective date at the top of this page always reflects the current version.
13. Contacting us
Use the contact form at /contact and choose Privacy or data request. It reaches us directly and we reply to the address you give.
You can also write to us at: Deeko Global LLC, PO Box 37, Mason, OH 45040, United States.