Privacy Policy

This policy explains how Polas processes personal data of people who use the polas.app website, the admin panel, the desktop app and the galleries published with Polas. The data controller is Victor Alberto Luna Just, tax ID (CUIT) 20-27181321-0, located in Oldman 704, Loma Verde, Escobar (CP 1625), provincia de Buenos Aires, Argentina.

Who decides about each piece of data

• Our customers' data (photographers, studios and schools that subscribe to Polas): we are the controller.
• Our customers' clients' data (for example, the families of a school and their children's photos): the controller is the photographer or school that uploads it or publishes the gallery. Polas processes it on their behalf and only to provide the service.

What data we process

• Account: name, email, phone, studio or school name and billing details.
• Plan payments: processed by Paddle. We do not receive or store your full card details; Paddle tells us the status of each payment.
• Content: the photographs and files uploaded to the service.
• Family data: name, email and orders of whoever buys in a gallery and, for school accounts, the roster of classes, students and guardians the school uploads.
• Face search: if the photographer enables it, a family can upload a selfie to find their photos. The selfie is processed in memory to compare it against the faces in that gallery and is discarded when the search ends: it is not stored. To make search possible, we generate a numerical representation of the faces in the gallery's photos, which is deleted together with the photos.
• Usage and browsing: pages visited, device, browser and IP address, through cookies and analytics tools.

What we use it for

• Providing the service: hosting photos, showing galleries, processing orders and delivering purchases.
• Billing plans and issuing receipts, through Paddle.
• Sending service emails: access codes, order notices, renewals and payments.
• Support, fraud prevention and account security.
• Improving the product with usage statistics. If you subscribe to updates, sending you news about Polas; you can unsubscribe at any time.

We do not sell personal data or use it for third-party advertising.

Who we share it with

Only with the providers we need to run the service, who process it on our behalf under confidentiality obligations:

• Paddle, to bill plans.
• Mercado Pago, when a family pays a photographer through that photographer's account.
• Render, Backblaze, Cloudflare and Hostinger, for hosting the application, the photos and the face recognition engine.
• Resend and Google, for sending emails.
• Google and PostHog, for Google sign-in and website analytics.

We may also disclose data when required by a competent judicial or administrative authority.

Some of these providers are located outside Argentina. In those cases we require them to provide an adequate level of data protection.

How long we keep it

• Account data, for as long as the account exists.
• Photos, depending on the plan: 150 days on the free Inicio plan and while the plan is active on paid plans. The photographer can delete them earlier.
• Receipts and payment records, for the period required by tax law.

Security

Communications are encrypted (HTTPS), passwords are stored hashed and each account's photos and data are isolated from other accounts. No system is infallible, but if we detect an incident affecting your data, we will notify you.

Cookies

We use our own cookies to keep you signed in to the panel and the galleries, and analytics cookies to learn which pages are visited. You can delete or block them in your browser; without session cookies you will not be able to sign in.

Google services integration (OAuth and API)

Our platform offers optional integrations with Google services to help you manage your schedule. If you authorize the connection with your Google account, Polas will access and use the following data:

• Email address: we access your primary email address to identify you on the platform, validate your identity and send you service notifications.
• Google Calendar (Events): we request read and write access to your calendar events (through the https://www.googleapis.com/auth/calendar.events scope) for the sole purpose of letting you automatically sync and schedule your school photo sessions and coverage events directly in your Google Calendar, avoiding overlapping commitments and making it easier to manage your business.

Compliance with Google's Limited Use policy: Polas' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Polas does not use or share this information with advertising networks, data brokers or for any purpose not directly related to providing and improving the event sync feature described above.

Minors

The Polas panel is not intended for minors. Galleries may contain photos of minors: they are published by the photographer or school, who is responsible for having the authorization of the families or the institution, and access is restricted to the people they authorize.

Your rights

You can request access to, correction, update or deletion of your data, and opt out of communications from Polas, by emailing support@polas.app. We respond within the time limits of Argentine Law 25,326. If your data was uploaded by a photographer or school, you can also ask them; we help them comply.

The Argentine Agency for Access to Public Information (Agencia de Acceso a la Información Pública), as the supervisory authority of Law 25,326, is empowered to handle complaints from anyone whose data protection rights have been affected.

Changes

We may update this policy. We change the date at the top and, for significant changes, notify account holders by email.

This English version is provided for convenience. If it differs from the Spanish version, the Spanish version prevails.

Contact

Victor Alberto Luna Just · Oldman 704, Loma Verde, Escobar (CP 1625), provincia de Buenos Aires, Argentina · support@polas.app