Privacy Policy

1. Introduction

This Privacy Policy explains how Fovea (“Fovea,” “we,” “us,” or “our”) collects, uses, shares, and protects information about you when you use our website, web application, and companion mobile apps (collectively, the “Service”).

Fovea is a photography marketplace and business-management platform. It serves two kinds of users: photographers and studios (“studios”), who run their photography business on the Service, and the customers who discover, book, message, and receive galleries from those studios. This policy applies to both. Where a studio uploads or manages information about its own clients, the studio acts as the controller of that information and Fovea processes it on the studio's behalf to provide the Service.

The Service is offered to users in the United States. This policy is effective as of June 12, 2026. By using the Service, you agree to the collection and use of information as described here.

2. Information we collect

We collect the following categories of information, depending on how you use the Service. We collect most of this information directly from you when you create an account, book or accept a session, exchange messages, upload or receive photos, or place an order.

Account and contact information

• Email, name, and phone number — used to create and secure your account, confirm bookings, and let studios and customers communicate.
• Studio profile details — business name, bio, and similar information a studio chooses to publish on its public marketplace profile.
• Mailing and shipping address — collected when you order prints or provide an address during a booking, and used only to fulfill that order or session.

Photos and other content you provide

• Photos and galleries uploaded by studios and delivered to their customers. This is the core of the Service. Photos may include images of people, including the customer and others present at a session.
• Messages exchanged between customers and studios through the Service.
• Reviews you write and proofing selections you make (for example, favorites or picks within a gallery).

Payment information (via Stripe)

• Payment and transaction history — amounts, status, receipts, invoices, and (for studios) payouts. We keep this so you and your studio or customer have an accurate record.
• Saved-card references only — such as card brand and the last four digits — which are held by our payment processor, Stripe. Full card numbers never touch Fovea's systems. Card data is collected and stored directly by Stripe; we store only Stripe identifiers (such as customer, account, and payment-intent IDs) that let us reconcile a payment.

Approximate location

When a studio sets up its profile, it enters a city and state. We use this approximate location so customers can discover studios near them in the marketplace. We do not collect precise device geolocation (GPS), and the apps do not request your device's location.

Device and notification identifiers

We assign each account a user ID. If you enable push notifications, we store a device push-notification token so we can deliver notifications to your device through Expo, Apple Push Notification service (APNs), and Google's Firebase Cloud Messaging (FCM).

Usage data

We record a limited set of pseudonymous analytics events related to booking links and galleries — for example, when a booking link or gallery is viewed — so that studios can see basic analytics about their work. We do not use third-party advertising or cross-site tracking technologies, and we do not build advertising profiles about you.

3. How we use your information

We use the information we collect to operate, provide, and improve the Service, specifically to:

• Create and manage your account and authenticate you.
• Provide the core service — marketplace discovery, booking, gallery delivery, proofing, messaging, and print orders.
• Process payments, deposits, payouts, invoices, and receipts through Stripe.
• Send transactional notifications and service communications (such as booking confirmations, message alerts, and gallery-ready notices).
• Power the studio-facing analytics about bookings and galleries.
• Support the marketplace, including helping customers discover studios by approximate location.
• Maintain the security and integrity of the Service, prevent fraud and abuse, enforce our Terms, and comply with our legal obligations.

4. How we share your information

Within the Service, information flows where it has to in order to work: a customer's booking details are shared with the studio they book, a studio's public profile is visible to customers in the marketplace, messages are shared with the other party to the conversation, and a delivered gallery is shared with its intended recipients. Beyond that, we share information only with the service providers (“ sub-processors”) that operate the Service on our behalf, and only as needed to provide it:

• Supabase — hosts our database, authentication, file storage (including your photos), real-time features, and backend functions.
• Stripe — processes payments and studio payouts through Stripe Connect and securely stores card details. We store only Stripe references, never raw card numbers.
• Expo, Apple Push Notification service (APNs), and Google Firebase Cloud Messaging (FCM) — deliver push notifications to your device using device tokens.
• Vercel — hosts and serves the Fovea web application.

We may also disclose information when required by law or valid legal process, to enforce our Terms, to detect or prevent fraud or security issues, to protect the rights, property, or safety of our users or the public, or in connection with a corporate transaction such as a merger, acquisition, financing, or sale of assets (in which case we will require the recipient to honor this policy).

We do NOT sell your personal information, and we do NOT share it for cross-context behavioral advertising. We use no advertising SDKs and run no ad networks. Your data is not used to track you across other companies' apps or websites, and we do not disclose it to data brokers.

5. Data retention & deletion

We retain your account data for as long as your account is active and as needed to provide the Service. You have control over your data in two ways:

• Export your data. A self-service “Download my data” option is available from your account, so you can obtain a copy of the personal information associated with your account.
• Request deletion. You may request deletion of your account and the personal data associated with it. During our current beta period, deletion requests are processed by our support team; contact us at privacy@fovea.pro to start the process.

Some information cannot be deleted immediately or in full. Certain financial and transaction records — such as invoices, payments, and payout history — are retained with personal identifiers anonymized or removed to the extent we need to meet our tax, accounting, audit, and other legal obligations, and to resolve disputes. We also retain limited information as needed to prevent fraud and enforce our agreements. When information is no longer required for these purposes, we delete or de-identify it.

Where a studio has uploaded content or information about its own clients, deleting your studio account does not necessarily remove copies a customer may have already received (for example, photos already downloaded), and a customer's deletion request may be coordinated with the relevant studio that controls that content.

6. Your US state privacy rights

Depending on where you live, U.S. state privacy laws may give you rights over the personal information we hold about you. Subject to those laws and their exceptions, you may have the right to:

• Access / know — request a copy of, or information about, the personal information we hold about you. Self-service export is available from your account.
• Delete — request deletion of your personal information, as described in the section above.
• Correct — request that we fix inaccurate personal information. You can update most account details directly in the app.
• Opt out of sale or sharing — confirm and rely on the fact that we do not sell your personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of.

To exercise any of these rights, email us at privacy@fovea.pro or use the in-app tools where available. We will take reasonable steps to verify your identity before acting on a request, which may mean asking you to confirm details associated with your account. We aim to respond within the timeframe required by applicable law — generally within 45 days, with the possibility of an extension where the law permits and we notify you. You may also use an authorized agent to submit a request on your behalf where state law allows; we may ask the agent for proof of authorization and may still verify your identity directly. We will not discriminate against you for exercising your privacy rights.

7. How we protect your information

We use a layered set of safeguards designed to protect your information, including:

• Encryption in transit. Connections to the Service are protected with industry-standard TLS encryption.
• Row-level security (RLS). Our database enforces row-level security policies so that each user — and each studio's tenant — can only access the records they are authorized to see.
• No card data on our systems. Card numbers are handled entirely by Stripe; we never store full payment-card numbers.
• Private photo storage with signed links. Photos and files are kept in private storage buckets and delivered through short-lived, signed URLs rather than public links, so galleries are not exposed to the open internet.

No method of transmission over the internet or method of electronic storage is completely secure, so while we work hard to protect your information, we cannot guarantee absolute security. Please help us by keeping your password confidential and notifying us promptly of any suspected unauthorized access.

8. Children's privacy

The Service is intended for adults and is not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 where a higher minimum age applies under state law). If you are a parent or guardian and believe a child has provided us personal information, contact us at privacy@fovea.pro and we will take steps to delete it. Note that studios may legitimately photograph children as part of a session booked by a parent or guardian; those photos are handled as user content under this policy and under the studio's own arrangements with the family.

9. Changes to this policy

We may update this Privacy Policy from time to time as the Service evolves or as legal requirements change. When we make material changes, we will update the effective date above and, where appropriate, provide additional notice (for example, within the app). Your continued use of the Service after an update takes effect means you accept the revised policy.

10. Contact us

If you have questions about this Privacy Policy or our data practices, or if you would like to exercise your privacy rights, contact us at privacy@fovea.pro.