We are committed to protecting your personal data and respecting your privacy. This privacy policy explains how we collect, use, retain and protect your data, as well as your rights under UK GDPR.

We collect the following types of information:

• Personal identification: name, email address, phone number and addresses
• Photographs: including associated metadata
• Questionnaire responses: information about photo themes and preferences
• Usage data: IP address, browser type and interaction patterns

Data is gathered through:

• Order placement
• Questionnaire completion
• Photo uploads
• Cookies and analytics technologies

We use your data to:

• Process your orders
• Create curated photo stories
• Analyse trends to improve our service
• Communicate with you, with your consent
• Meet legal obligations

We may share your data with the following third parties:

• AWS in London: cloud storage
• Dropbox: cloud storage
• Pic-Time: client galleries
• PostHog: product analytics and service improvement
• Klaviyo: email marketing and personalisation when you consent

All third-party partners are bound by data protection agreements.

We protect your data through:

• Encryption in transit using SSL/TLS and at rest
• Encrypted drive storage
• Restricted access controls
• Regular security audits

In the event of a data breach, we will notify affected users and relevant authorities in accordance with legal requirements.

• Personal data is retained while you are an active customer
• Data is deleted after six years of inactivity
• Photos are retained for 24 months after your last interaction
• After this period, photos are automatically deleted from originals, shortlists and galleries

We use essential cookies for authentication, security and payment processing. With your permission, we use PostHog analytics to understand page views, selected actions, service journeys and technical errors. If you separately enable public-page replay, PostHog may record a sample of visits to public marketing and product pages. Form inputs are masked, URL query strings are removed, and customer account, upload, gallery and payment areas are excluded from replay.

With your permission, we may also use optional Klaviyo email-personalisation technologies for our own communications. We do not use this information to track you across apps or websites owned by other companies, for third-party advertising or advertising measurement, and we do not share it with data brokers. You can accept or reject analytics, public-page replay and marketing separately, and change your choices through Cookie Settings.

You have the right to:

• Access: request a copy of your personal data
• Rectification: request correction of inaccurate data
• Erasure: request deletion of your data
• Restriction: request restriction of processing
• Objection: object to certain types of processing
• Portability: request transfer of your data

We will respond to all valid requests within one month.

We only send marketing communications with your consent. You can unsubscribe at any time using the link in our emails or by contacting us directly.

We regularly review and update this privacy policy. Updates will be posted on this page, and significant changes will be communicated separately.

We are registered with the Information Commissioner's Office as Life Curated Ltd, reference number ZB645625.

If you have questions about this privacy policy or wish to exercise your rights, email hello@20.photos or write to:

Life Curated Ltd
7a Brunstane Road North
Edinburgh, EH15 2DL
Scotland

Registered in Scotland No. SC756550