Effective date:
Last updated:
Portofolio is operated by Deminschii Arcadie, Republic of Moldova.
Contact: deminschiiarcadie@gmail.com
1. Who is responsible for your information
Portofolio is operated by Deminschii Arcadie, operating from the Republic of Moldova. In this policy, “Portofolio,” “we,” and “us” mean that operator. Contact deminschiiarcadie@gmail.com for privacy questions and requests.
This policy covers our public website, photographer accounts, photo storage, galleries, portfolio websites, delivery tools, and related support. We handle personal information under applicable Moldovan data protection law, including Law No. 195/2024, and the EU General Data Protection Regulation (“GDPR”) where it applies to the processing concerned.
For account administration, authentication, security, support, and our own business records, we determine why and how information is used and act as a data controller. For photographs, gallery contacts, selections, and website inquiries that photographers place in the service, we generally process information on the photographer’s instructions as a processor. The photographer determines the purpose of that processing and is responsible for the appropriate privacy notice and legal basis. A photographer may have a different legal role in their own client relationships.
2. Information about photographers and account holders
We collect the name, email address, and password you provide when registering. We store a password hash rather than your readable account password, along with email verification status, account identifiers, session records, activity timestamps, and account status.
Information you choose to add can include your business or display name, profile photograph, phone number, studio location, social links, website content, domain names and verification records, notification preferences, language, and other workspace settings. Information published on a portfolio website or contact card is visible according to that feature’s publication and access settings.
We also keep plan selections, trial dates, storage usage and limits, subscription status, support correspondence, and records needed to administer your account. If you contact us, we receive the information and attachments you send. Please provide only information needed to resolve your request.
3. Gallery visitors, clients, and people in photographs
Photographs and related information are usually supplied by the photographer, rather than collected directly from every person pictured. This may include recognizable faces, event details, filenames, dates, captions, and other information within an image or its metadata.
Depending on the photographer’s settings, gallery visitors may provide their name, email address, phone number, additional information, comments, photo selections, notes about individual photographs, or a review with a rating and optional social link. Portfolio inquiry forms can collect a name, email address, phone number, message, event date and location, and selected photography package. We store these submissions for the photographer and may send the photographer a notification containing submission details.
When you connect to the service, network requests necessarily expose connection information such as your IP address to the server. We use request information for delivery and abuse prevention; rate-limit counters use hashed identifiers. Application and server diagnostics may contain account identifiers, email addresses, error details, and connection information. Gallery activity and website analytics are described below.
4. How and why we use information
We use information to create and secure accounts, verify email addresses, provide storage and gallery tools, publish content you choose to publish, deliver photographs, administer plans and trials, answer support requests, prevent abuse, diagnose problems, and meet legal responsibilities.
Where a legal basis is required, our own processing relies on:
- Our contract with you: supplying requested account features, storage, delivery, account communications, and support.
- Legitimate interests: maintaining a reliable service, preventing fraud and misuse, investigating incidents, and protecting legal rights, after considering the impact on individuals.
- Legal obligations: responding to lawful requirements and retaining records that applicable law requires.
- Consent: optional processing for which the law requires consent. You can withdraw consent for future processing without affecting processing that was lawful before withdrawal.
When we process client photographs and submissions on a photographer’s behalf, the photographer must establish the relevant legal basis and any additional conditions for sensitive information. Accepting our Terms does not itself provide consent on behalf of people shown in photographs.
5. Photograph storage, previews, and downloads
Portofolio uses self-hosted server storage for uploaded original files and generated media, with PostgreSQL for account information, gallery records, metadata, and website settings. Some website content may contain images embedded in stored website settings. Self-hosting does not mean that storage or processing is guaranteed to take place exclusively in any particular country.
We process filenames, file types, sizes, dimensions, upload information, and associated metadata to organize and deliver media. Our preview worker reads selected EXIF and technical image information; it does not separately parse GPS or XMP fields in that extraction. Original files are preserved during preview generation and can still contain embedded GPS, camera, author, or other metadata. Remove information you do not want to disclose before uploading or enabling original downloads.
The service generates resized JPEG thumbnails and previews for display. Where downloads are enabled, it can stream originals or resized web versions, including ZIP archives of selected photographs. Original downloads can contain the metadata present in the original. A recipient can retain downloaded files independently of Portofolio.
We use customer content to operate and support the service and follow lawful instructions. We will not sell uploaded photographs or use them to train general-purpose AI models. This is a limitation on our use of your content, not a statement about the independent practices of external services you choose to use.
6. Who can access photographs and published content
Your authenticated workspace controls account management. An active gallery without password protection can be opened by anyone who obtains its link. A link is not an individual invitation or proof of a visitor’s identity. Where you enable gallery password protection, visitors must unlock the gallery before accessing its protected media. Hidden folders, gallery expiration, and download settings affect access through the service.
Portfolio websites can be published publicly and can use the website password option. Published mobile galleries are accessible by their links and do not have a separate password-protected mode. The service excludes password-protected source galleries from mobile-gallery linking. Media selected for a published website or contact card may be publicly available, even if the file was originally uploaded elsewhere in your workspace.
People with access may copy, capture, or redistribute what they see. Passwords can be shared, and disabling downloads does not prevent screenshots. Public content may also be indexed or cached by search engines and other parties. Choose publication settings carefully and share passwords separately from links.
Authorized Portofolio administration can access account information and media previews for support, security, moderation, troubleshooting, and legal responsibilities. Necessary server-side processing also accesses files. Service access is not limited solely to the photographer and gallery recipients.
8. Recipients and optional external services
We disclose information only for operating the service, following your instructions, meeting legal obligations, or protecting legitimate rights. The relevant recipients depend on the features used:
- Photographers and selected viewers: photographers receive their client submissions; visitors receive content made available through the selected sharing and publication settings.
- Email services: the configured SMTP provider handles verification codes, password resets, delivery messages, and notifications. Messages sent to our Gmail support address are processed by Google’s email service. Do not email original client photographs unless necessary for support.
- Telegram: if a photographer connects and enables Telegram notifications, Telegram receives the chat identifier and notification content, which may include client or inquiry details.
- Instagram/Meta: connecting Instagram processes the connected account identifier, username, access token, token expiry, and feed information such as media URLs and captions. Feed images may load from Meta’s media servers. Disconnecting removes the saved connection from Portofolio; you can also revoke access through Meta.
- Maps: displayed maps use Photon/Komoot address lookup and OpenStreetMap tiles. Loading a map sends browser requests to these providers, including the displayed address for lookup and normal connection information.
- Website tools: Google, Meta, or other providers receive information when a photographer enables their analytics, embeds, external media, or custom website code.
- Domain and certificate services: custom-domain operation involves DNS and certificate issuance, including Let’s Encrypt. Public domain and certificate information can be visible in DNS and certificate transparency records.
- Professional advisers and authorities: information may be disclosed where necessary for legal advice, a lawful request, or the establishment or protection of rights.
External services may act as independent controllers for their own purposes. Their notices apply to that processing. Contact us for the provider and processing information relevant to your account or a proposed integration before sending information subject to additional contractual or regulatory requirements.
9. Subscription and payment information
The application records plan preferences, eligibility and dates for trials, subscription status, and storage allowances. The current application does not collect payment-card details or provide an integrated paid checkout or automatic recurring charge. A plan selection or trial does not authorize a payment.
For separately arranged paid access and refunds, we handle relevant correspondence, plan and billing-period details, payment amounts and transaction references, and records needed to verify payment or a refund. Any agreed payment instructions and receipt identify the recipient and provider involved.
If paid checkout is introduced, the checkout must identify the payment provider or merchant of record, explain its handling of payment information, and show the charge and applicable terms before you pay. We will update this policy as needed before that processing begins. Please do not send card details or banking credentials to support.
10. International processing and transfers
Portofolio operates from Moldova and serves customers internationally. Self-hosting is not a commitment to a particular server country or to processing exclusively in Moldova or the European Economic Area. Email, integrations, and delivery to recipients in other countries may involve international processing.
Where applicable law restricts a transfer, an appropriate lawful transfer mechanism and any required supplementary measures must be in place before the restricted processing occurs. This policy does not claim that an adequacy decision, standard contractual clauses, or a particular transfer agreement already covers every service or customer arrangement. Contact us for relevant destination, recipient, and transfer information, or to arrange required processor terms, before uploading data that requires those arrangements. Your use of the service does not by itself waive transfer protections or provide consent on behalf of photographed people.
11. Security and its limits
We take reasonable technical and organizational measures proportionate to the service and information concerned. The application uses hashed account passwords, authenticated and revocable sessions, server-side access checks, signed access cookies, request rate limits, and controlled media delivery. Connected Instagram access tokens use application-level encryption.
HTTPS encrypts communications when you use the secure HTTPS service address. Uploaded files must be available to server-side storage, preview, and delivery processes; the service does not provide end-to-end encrypted photograph storage. We do not represent that all stored media or databases use encryption at rest or that the service holds an independent security certification.
No digital system can guarantee protection from unauthorized access, failures, corruption, accidental deletion, outages, or permanent loss. Maintain your own independent copies of important originals, protect your sign-in details, and report suspected unauthorized access promptly. Our Terms of Service and Refund Policy explain service failures and available remedies without limiting mandatory rights.
12. Retention, cancellation, and deletion
We retain account information and customer content for as long as needed to provide the service, carry out the photographer’s instructions, resolve support or security issues, and meet applicable legal obligations. Relevant criteria include whether the account is active, whether content remains published or referenced, the request concerned, and any legal requirement to preserve records or evidence. We do not promise permanent preservation.
Ending a trial or subscription changes plan entitlements and storage limits; it does not automatically delete uploaded photographs. The Free allowance continues, and new uploads or additional media can be blocked when the account exceeds its effective limit. Gallery expiration removes public gallery access and does not itself guarantee physical file deletion. Export important content before ending access or requesting account closure.
Deleted individual gallery photographs enter a trash state and can normally be restored through the interface for seven days. Cleanup later targets older trash; references in website content, drafts, or other media records can prevent file removal. Gallery deletion may first move a gallery to trash. Permanent gallery deletion removes its records and attempts to remove files that are no longer referenced. Remove photographs from websites, drafts, saved templates, linked uses, and other published locations when you intend to remove those copies as well. These operations are not a promise that every copy disappears at an exact deadline.
To close your account or request deletion beyond the available controls, email us. After verifying authority, we will arrange account closure and deletion or return of relevant information as required by law and any applicable processing agreement. We may retain information necessary for legal obligations, security, disputes, or legal claims, limiting its use accordingly. We will explain applicable exceptions when responding.
The service does not promise automatic or offsite backups, a fixed backup retention period, or guaranteed recovery. Supplementary backup and Telegram file-export features are currently disabled. If introduced, they require destination-specific information and applicable authorization before activation. Where recoverable administrative copies exist, deletion may involve a separate recovery-copy lifecycle; we will explain relevant handling in response to a request. Content already downloaded, copied into a recipient’s device, or held independently by an external service is outside our direct deletion controls.
13. Your rights and how to exercise them
Depending on the applicable law and circumstances, you may request access to personal information, a copy, correction, deletion, restriction, or portability. You may object to processing based on legitimate interests and withdraw consent for processing that relies on it. Mandatory exceptions can apply, including protection of other people’s rights and legally required retention. The application uses automated limits for storage, trials, and abuse prevention; you can contact us to challenge an error or request human review.
Send requests to deminschiiarcadie@gmail.com. Identify the account or gallery and the information or action concerned. We may request proportionate evidence of identity or authority, rather than disclosing another person’s information. Where GDPR applies, we respond without undue delay and normally within one month; a permitted extension for complexity or volume will be explained within that initial month. Other applicable statutory deadlines remain unaffected.
For information controlled by a photographer, contact that photographer first. If you contact us, we will assist and refer the request to the responsible photographer where appropriate, while meeting our own legal obligations. Account holders can use available profile controls and original-photo downloads; contact us for information or exports not available through those controls.
You can complain to Moldova’s National Center for Personal Data Protection. Where GDPR applies, you may also contact the competent supervisory authority, including in your EU country of residence or work. You do not need to contact us first to exercise a right to complain.
14. Photographer responsibilities
Photographers must have the necessary copyright permissions, image rights, and legal basis to upload, share, publish, and otherwise process their content. They must provide appropriate notices to clients and pictured people, obtain consent where required, respond to individual rights requests, and choose suitable access and download settings.
Photographs can reveal sensitive details about health, religion, family life, or other protected matters. Assess whether additional legal conditions, consent, safeguards, or a data processing agreement are needed before uploading that material. Contact us to arrange required processing terms and clarify suitability before beginning processing that requires them. Do not assume this public policy alone replaces a required controller–processor agreement.
15. Children’s information
Portofolio accounts are intended for adults who can enter the service agreement; the account service is not directed to children. Photographers may upload family, school, or other photographs of children only with the lawful authority and protections required for that use, including parent or guardian authorization where necessary.
If you believe a child has created an account or that a child’s photograph or information is being handled unlawfully, contact us and, where known, the responsible photographer. We will assess the report and take the action required by applicable law.
16. Personal data incidents
If we become aware of a personal data incident, we will take reasonable steps to investigate, contain its effects, preserve relevant evidence, and restore recoverable information where technically possible. We will notify affected photographer controllers without undue delay where we act as their processor, and notify authorities and affected individuals when and within the periods required by applicable law. Notice will explain the information available and practical protective steps where appropriate.
Report suspected account compromise, unauthorized publication, or a data incident to deminschiiarcadie@gmail.com. Include enough detail to identify the affected account or gallery without sending passwords or unnecessary sensitive material.
17. Changes to this policy
We may update this policy when the service or applicable requirements change. The dates at the top identify the current version. For material changes affecting existing processing, we will provide an appropriate notice through the service or account email before the change takes effect where required. If a new use requires consent, we will request it; publishing an updated policy does not replace that consent.