Privacy Policy

The data controller is [Legal name of company or person], [Full postal address]. Contact us about privacy at privacy@givenchy.baby.

• Data protection officer: [Data protection officer, or state that none is required]
• EU representative: [EU representative (GDPR Art. 27 / DSA Art. 13) if based outside the EU, otherwise “not required”]
• UK representative: [UK representative (UK GDPR Art. 27) if based outside the UK, otherwise “not required”]

For images you upload and share for your own purposes, you decide what to publish and you may have your own legal duties to the people shown in them.

• Account details: username (shown publicly), encrypted email address, a salted hash of your password (never the password itself), account settings and API tokens.
• Uploads: your images, encrypted when stored, and their file name, size, format, upload time and any custom link or expiry you choose.
• Technical data: IP address, approximate location worked out from it (such as country or city, never GPS), browser and device type, requested address, time of the request and error data. This also applies to people who only view an image.
• Usage counts: how many times an image was viewed, stored as totals that aren’t linked to individual viewers.
• Messages and reports: whatever you send when you contact us, report content or appeal a decision.
• Payment details, if you buy a paid plan: billing name and address, plan, and transaction records. Card details go directly to our payment provider, and we don’t see or store them.

Image files can contain hidden metadata such as GPS location, camera serial number and capture time. We remove this from the public copy of the file. We can’t remove personal data that is visible in the image itself, such as faces, addresses or documents, so please check before you upload. Don’t upload special-category data (such as health details or sexual orientation) about yourself or others unless you are sure you may lawfully do so.

Under the GDPR and UK GDPR, we need a legal basis for each use of your data. Periods shown here are explained in how long we keep data.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object (see your rights). If we ever ask for consent, you can withdraw it at any time, without affecting what we did before. We won’t send marketing email without a valid legal basis and an easy way to opt out.

You need to provide an email address and password to create an account, and a file to upload an image. Without them, we can’t provide those features. Technical data is needed to deliver any page or image. You don’t have to give us anything else.

We may use automated tools, such as rate limits and matching against lists of known illegal material, to protect the Service. We don’t make decisions with legal or similarly significant effects about you based solely on automated processing without a legal basis and human review. You can ask for a person to review a decision and can contest it. We don’t use your images to train artificial intelligence models.

We don’t sell your personal data or share it for targeted advertising. Suppliers process it for us under data processing agreements (GDPR Art. 28) and only on our instructions:

We also disclose data where the law requires it, such as to courts and authorities with a valid order, or to report suspected child sexual abuse material or threats to life or safety. We check that requests are lawful and limited to what is necessary. Data can also pass to a buyer or successor if the business changes hands, and we’d tell you first.

If personal data leaves the EU, EEA or UK, we protect it with approved safeguards as required by GDPR Chapter V: [Safeguards used, e.g. EU adequacy decision or Standard Contractual Clauses]. You can ask for a copy of these safeguards at privacy@givenchy.baby.

• Images stay until you delete them, they expire, or we remove them. They then disappear from public access [within 24 hours] and from backups within [30 days].
• Accounts are deleted when you ask, with remaining data removed within [30 days].
• IP addresses and approximate location are erased as soon as you log out or your visit ends, meaning [30 minutes] without activity. If they are linked to an attack or abuse, we keep them for up to [30 days]. If they are linked to a report of illegal content or a legal order, we keep them for as long as the law requires. Our suppliers’ logs: [How long your host and CDN keep IP logs, or that they keep none].
• Moderation and legal records are kept for [3 years]. Material we must preserve for authorities is kept for as long as the law requires.
• Tax and accounting records are kept for [10 years, or your national period].

If the GDPR or UK GDPR applies to you, you have these rights, subject to legal conditions and exceptions:

• Access your data and get a copy (Art. 15).
• Correct inaccurate data (Art. 16).
• Delete your data (Art. 17).
• Restrict how we use it (Art. 18).
• Move data you gave us, in a common machine-readable format (Art. 20).
• Object to processing based on legitimate interests, and to direct marketing at any time (Art. 21).
• Ask for human review of solely automated decisions (Art. 22).
• Withdraw consent wherever we rely on it (Art. 7(3)).

Write to privacy@givenchy.baby. We’ll reply within one month, or tell you within that month if we need up to two more because the request is complex. It’s free unless a request is clearly unfounded or excessive. We may need to confirm your identity first.

You can also complain to a regulator (Art. 77), in the country where you live or work or where you think the problem happened. Ours is [Your lead data protection authority, with its website]. We’d welcome the chance to fix things first.

If an image shows you or contains your personal data and you want it removed, email privacy@givenchy.baby with the link and the reason. You don’t need an account. Intimate images shared without consent are treated urgently: see the Acceptable Use Policy.

We use only what is strictly necessary. Details are in the Cookie Policy.

The Service isn’t for anyone under 16. We don’t knowingly collect their data. If you believe a child has given us personal data, contact privacy@givenchy.baby and we will delete it.

Images, usernames and email addresses are encrypted when stored, connections are encrypted, and passwords are kept only as salted hashes that nobody can read, including our founder and developers. Our founder, developers and staff don’t browse your images or account details. Access happens only when needed to act on a report of illegal content, comply with a legal order or fix a security problem, and each access is logged. The Service has to decrypt images to show them to anyone with the link, and usernames are public. No system is perfectly secure. If a breach is likely to put your rights at risk, we’ll notify the regulator within 72 hours where required, and tell you without undue delay if the risk is high.

Depending on your state and whether these laws apply to us, you may have the right to know, access, correct and delete your personal information and to appeal our response. The categories we collect, the purposes and the recipients are listed above. We don’t sell personal information or share it for cross-context behavioural advertising, and we won’t discriminate against you for using your rights. Use the contact details above, or have an authorised agent do so.

We’ll update this policy when our practices or the law change, and show the new effective date above. For significant changes, we’ll notify account holders in advance by email or on the site.