Privacy Policy

Last updated: [date]

This Privacy Policy explains how Lensqivo collects, uses, stores and deletes personal data when you use lensqivo.com, the photographer dashboard, and the photographers' websites we host. It is written to meet the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations. Please read it before you give us any personal data.

1. Who we are

Lensqivo is operated by [legal name as in the commercial registration], commercial registration no. [number], [address], Kingdom of Saudi Arabia ("we", "us").

Privacy contact: [lensqivo.support@gmail.com] · [phone] · lensqivo.com

2. Our role

• Photographers' accounts (photographers who sign up): we decide how this data is used, so we are its controller.
• Data photographers keep about their own clients (client list, bookings and payments, contracts, calendar appointments, messages from their website, private albums): the photographer is the controller, and we process it on the photographer's behalf, only to run the service. Clients of a photographer should contact that photographer first; we will help the photographer answer.
• Reviews on photographers' websites: we run the review system together with the photographer.

3. Data we collect, why, and on what basis

Photographers

• Account: name, email, mobile number, password (stored hashed), language, two-step verification settings. Why: to create and secure your account. Basis: our contract with you.
• Website: studio name, logo, cover image or video, about text, city, contact details, social links, licences you choose to show, packages. Why: to publish your website and, if you allow it, list you in the photographer directory. Basis: contract.
• Albums and photos you upload. Why: to store and show them. Display versions are re-saved without embedded data (such as location). If your plan keeps original photos, the original file is kept exactly as uploaded, including any embedded data, and clients you allow to download may receive it. Basis: contract.
• Subscription and payments: plan, dates, amounts, coupon, payment reference. Card details are entered on the payment provider's form; we never receive or store card numbers. Basis: contract and legal obligations (accounting and tax).
• Support tickets and attachments. Basis: contract.
• Google Drive (only if you connect it): an access key stored encrypted, limited to the files you pick. Basis: your consent, which you can withdraw by disconnecting.
• Your clients' data, described in section 2.

Visitors to photographers' websites

• Contact form: name, mobile number, email (optional), the package you ask about, your message, and your IP address. It is delivered to the photographer. Basis: your request to contact the photographer, and our legitimate interest in preventing spam.
• Reviews: your name, star rating and comment are published on the photographer's website; your IP address is stored to stop repeated reviews. Basis: your choice to publish a review, and our legitimate interest in preventing abuse.
• Private albums: we remember in your session that you entered the password.
• Visit statistics: counted without cookies, using a code that changes every day and cannot identify you; we do not store your IP address for statistics.

Everyone

• Technical data needed to run and protect the service: IP address, browser type, pages requested, error logs. Basis: our legitimate interest in security and keeping the service working.

We do not collect sensitive data on purpose. Do not upload photos or information revealing health, religion, criminal records or similar sensitive matters unless you have the person's explicit consent and it is necessary.

We do not sell personal data, show advertising, or send marketing messages. Service emails (verification, password reset, payments, subscription reminders, support) are part of the service.

4. Cookies

We only use cookies that the service needs: your sign-in session, your language choice, security tokens, and unlocked private albums. We do not use advertising or tracking cookies.

5. Who we share data with

We share personal data only with providers that help us run the service, under contracts that protect it, and only as much as they need:

• Hostinger — our server, located in Germany (all data).
• Cloudflare R2 — encrypted backups, stored in the European Union.
• Brevo — sending emails (email address, name, email content).
• MyFatoorah — online payments (name, email, mobile number, amount).
• Google — only if a photographer connects Google Drive (their Drive files), or if automatic translation is switched on (website and album texts).

We may also disclose data when required by law or by a competent authority. If the service is sold or merged, data moves to the new owner under this policy.

6. Storage outside Saudi Arabia

Our server and backups are outside the Kingdom (Germany and the European Union), and some providers above process data in other countries. We transfer data only as allowed by the PDPL and its regulation on transfers outside the Kingdom, using the safeguards it requires, such as SDAIA's standard contractual clauses, and only the data each provider needs.

7. How long we keep data

• Account and content: while your account is active. If you delete your account, it can be restored for 30 days, then it is permanently deleted with all your files.
• Accounts closed by us: [up to 90 days], then permanently deleted, unless the law requires keeping them longer.
• Your clients' data, messages and reviews: until you or the photographer delete them, or the photographer's account is deleted.
• IP addresses stored with messages and reviews: [30 days].
• Visit statistics: 90 days.
• Server logs: 14 days.
• Backups: up to 5 weeks, encrypted.
• Payment and invoice records: as long as Saudi law requires.

When the period ends, data is deleted so it cannot be recovered.

8. Your rights

Under the PDPL you have the right to:

• be told how your data is collected and used (this policy);
• access your data and get a copy in a readable format;
• ask us to correct, complete or update it;
• ask us to delete it when it is no longer needed;
• withdraw your consent where we rely on it (for example, disconnect Google Drive).

Photographers can edit or delete most of their data directly in the dashboard, and can delete their account from the profile page. For anything else, write to [lensqivo.support@gmail.com]. We may ask you to confirm your identity, and we reply within 30 days. If you are a client of a photographer, contact the photographer first.

If you are not satisfied with our answer, you can complain to the Saudi Data and AI Authority (SDAIA) through the National Data Governance Platform: dgp.sdaia.gov.sa.

9. People in photos

Photographers are responsible for having the consent of the people they photograph before publishing their photos. If you appear in a photo on a website we host and want it removed, contact the photographer, or write to us at [privacy email] and we will pass on and follow up your request.

10. Security

We protect data with encrypted connections (HTTPS), hashed passwords, optional two-step verification for photographers and required two-step sign-in for our team, private albums served only through expiring links, encrypted backups, and limited staff access. Our team can open a photographer's dashboard only to give support or keep the service safe, and every such access is logged.

If a personal data breach happens, we will notify SDAIA and affected people as the PDPL requires, and photographers whose clients' data is affected.

11. Children

The service is for adults (18 or over). Photographers who publish photos of children must have the consent of a parent or guardian.

12. Changes

We may update this policy. The date at the top shows the latest version. We will tell photographers about important changes by email or in the dashboard.