Privacy Notice

Information processed and shared

• Your account connection and permissions; account eligibility, credit balances and generation status; the product photos, generated images, product and brand information, selected image references, shoot directions and specialist briefs needed for the task you request.
• The assistant provider (for example OpenAI for ChatGPT) receives the requested tool results, image previews, saved draft information and review links. Optional identity permission shares an account identifier and, with email permission, your verified email address for workspace restrictions. Your PMP password is not sent in tool results.
• When you request Art Director ideas or refinements, we send the relevant original product photo, brief and selected shoot requirements to our configured AI analysis providers to suggest photographic directions. This analysis can happen before you approve image generation; it does not itself create the finished photographs or authorise use of your generation credits.
• When you approve image generation, the relevant product images, references and direction are processed by our configured AI generation providers. Image hosting and delivery use Cloudinary; database hosting uses Neon; application hosting and operational diagnostics use our hosting providers, including Vercel. The selected assistant also processes information under its own privacy terms.
• We record limited connection, security, usage and error information to operate and troubleshoot the integration, including connection identifiers, event times, request outcomes and file-handoff validation categories. These records are not permission to collect unrelated conversation content.

Your choices and retention

• Connecting, browsing and planning do not authorise generation or a purchase. Generating images requires approval of the current quote. Specialist finishing briefs prepared through the assistant remain drafts unless a separately supported action is explicitly confirmed.
• Disconnect an assistant from the PMP connection page to revoke its access. Access grants expire after 30 days and access tokens after one hour; expiry or disconnection does not automatically delete saved images, drafts or historical connection records.
• Saved product images, shoot drafts, briefs and account-associated connection records are retained with your account until you request deletion or the account is removed. Commissioned project and transaction records may be retained for up to six years afterwards as described below. Contact us to request deletion or a copy of your data, including connection diagnostics; we will explain any records that must be retained. Deleting PMP data does not delete copies already held in your assistant conversation; use that provider's controls separately.

Enquiry form

• Name, email address, phone number, and company name
• Product category and approximate product count
• Any notes or project details you provide
• Marketing consent preference

Project brief form

• Usage channels, image types, product list details
• Styling preferences, logistics, and timing requirements

Client portal account

• Email address, name, and a securely hashed password
• Organisation and role information

Automatically collected data

• Device type, browser, and operating system
• Referral source, landing page, and UTM campaign parameters
• Session identifiers for analytics (stored in your browser session storage)
• Page views and interaction events (e.g. enquiry funnel steps, file downloads)

• Responding to your enquiry and providing a tailored estimate
• Fulfilling photography services you commission from us
• Managing your client portal account and project workflow
• Sending transactional emails such as estimates, invoices, briefs, and delivery notifications
• Sending marketing communications where you have opted in
• Analysing website usage to improve our services and user experience
• Preventing fraud and ensuring the security of our systems

Contract

• Processing necessary to fulfil services you have commissioned or to take steps at your request before entering a contract (e.g. providing an estimate).

Legitimate interest

• Analysing website usage to improve our services, provided this does not override your rights. We maintain records of our legitimate interest assessments.

Consent

• Marketing emails are only sent where you have given explicit opt-in consent. You can withdraw consent at any time by clicking the unsubscribe link in any email or contacting us directly.

Legal obligation

• Where we are required to retain data for tax, accounting, or regulatory purposes.

• Email delivery: Resend (transactional emails such as estimates and briefs)
• Image hosting: Cloudinary (storing and delivering project imagery)
• Database hosting: Neon (PostgreSQL cloud database)
• Analytics: Google Analytics (website usage data) and Microsoft Clarity (session recordings and heatmaps on our public photography website, when you accept analytics cookies).
• Payment processing: Stripe (when payment features are active)
• Shipping: DPD and other carriers (return of merchandise)

Essential cookies

• Authentication session cookies that keep you signed in to the client portal.
• These are strictly necessary for the website to function and cannot be switched off.

Analytics cookies

• Google Analytics cookies that help us understand how visitors use our website, including pages visited and time spent.
• Microsoft Clarity helps us understand clicks, scrolling and form interaction. Enquiry forms and confirmations are masked; private customer and admin areas are excluded. Clarity advertising storage remains disabled. You can withdraw analytics consent using Cookie preferences in the footer; changing this choice may reload the page.
• Internal analytics session identifiers stored in your browser's session storage (cleared when you close your browser).

Third-party cookies

• Some embedded content (e.g. YouTube videos) may set their own cookies. We do not control these third-party cookies. Refer to the relevant provider's cookie policy for details.

• Enquiry data: retained for up to 24 months after your last interaction, or longer if you become a client.
• Client project data: retained for the duration of our business relationship and for up to 6 years afterwards to meet legal and accounting obligations.
• Account data: retained until you request deletion or your account is inactive for an extended period.
• Analytics data: aggregated and anonymised data may be retained indefinitely; identifiable analytics data is retained for up to 26 months.
• Marketing consent records: retained for as long as the consent is active and for a reasonable period afterwards for compliance purposes.

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure: request deletion of your data where there is no compelling reason for its continued processing.
• Right to restrict processing: ask us to temporarily stop processing your data in certain circumstances.
• Right to data portability: receive your data in a structured, commonly used, machine-readable format.
• Right to object: object to processing based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

• Encrypted connections (HTTPS) across the entire website.
• Passwords stored using secure one-way hashing. We never store plaintext passwords.
• Access to personal data restricted to authorised personnel who need it for their role.
• Regular review of our data processing activities and security practices.

• Photograph My Product Ltd, Unit E1, Northminster Business Park, Upper Poppleton, York, YO26 6QU
• Phone: 0330 043 0113
• Email: info@photographmyproduct.co.uk

• Website: ico.org.uk
• Helpline: 0303 123 1113