The Japanese version is the governing text.
1. What we collect
- Photographers: email address; with Google sign-in, your Google name and email; display name; profile (if you fill it in: credit line in Japanese and English, Instagram account name and a web URL; for now shown only to you)
- How-to emails and update news (optional): the date and time you chose to receive them, the version of the text and the state of the checkbox shown then, the number and dates of emails sent, and the date you unsubscribed
- Payment: card details are collected and held by Stripe; we never store card numbers. We record your billing country and the country where your card was issued, to calculate consumption tax and to check where we can offer paid use
- Galleries: uploaded photos, gallery titles, capture times, the photographer’s star ratings, viewers’ picks, stars, tags and notes, and grouping numbers for photos that look alike
- Information inside photos: photos sent from the Lightroom plug-in carry the copyright notice, creator name and contact details the photographer has registered in Lightroom, so that it stays clear whose photos they are (this can be turned off in the plug-in settings). Location data, camera serial numbers and develop settings are not included. Viewers who open a gallery can save the photos
- Language and country (approximate): When you first log in, we record on your account the language setting of your browser (for example, ja-JP) and the two-letter country code that comes with the connection. We use them to choose the language of screens and emails and how prices are shown. The country is only a hint: we do not use it to decide billing or tax (your billing country is the one you enter when you register a card). We do not store your IP address for this. You can change your language at any time.
- Usage: access times, IP address, browser type
- Lightroom plug-in sending records (optional): only from photographers who allow it, a record of each send (your macOS, Lightroom and plug-in versions, how many photos were sent, how and how long, and the kind of error that occurred). It never includes the error’s text, photos, file names, gallery titles or passcodes, and we don’t store IP addresses or browser information with it. We also record which integration and version created a gallery (for example papat-lrc/1.2.1)
- Viewers: no account needed; we only keep what they enter in the gallery (picks, stars, tags, notes and a display name) and a passcode cookie. The display name does not have to be your real name, and we do not check it. Your display name and the photo you are currently viewing are shown to the other people who have the same gallery open at the same time, including the photographer. The photographer can also see the display names of the people who have the gallery open on their job page. When you finalize a selection or withdraw a finalization, your display name and the time are kept in the gallery’s finalization history and included in the notification email to the photographer. Otherwise, the display name is not included in records or notifications
- Visits to our introduction pages: web analytics results (counts). See “4. Usage counts and web analytics.”
2. Why
To run the Service (sign-in, storing and delivering galleries, sending selection emails), billing, understanding how much the Service is used (counts), preventing abuse, fixing problems, improving the Service (including finding why sending is slow or fails, from the sending records), choosing the language of screens and emails and the currency in which prices are shown for each user, sending the how-to emails and update news (only to people who chose to receive them: up to 7 how-to emails in the first 3 weeks, then news about new features and the like at most once a month; they include information about the papat service; you can stop them all at any time from the link in the emails or your settings; we do not track opens or clicks), and important notices (such as changes to the terms or prices), which we send even if you have stopped the how-to emails and update news. We never use your photos to train AI models.
3. How long
Photos and gallery data (including the finalization history) are deleted when the gallery expires. Account data is kept until you delete your account; billing records are kept as required by law. The IP address from which a gallery was created is kept for 90 days after the gallery is deleted, then erased. Records of the how-to emails and update news (when you chose to receive them, the number and dates of emails sent, when you unsubscribed) are kept for 3 years after the last email; a record that you unsubscribed is kept until you delete your account, so that we do not email you again. Plug-in sending records are erased 180 days after we receive them; the integration and version that created a gallery are kept as long as the gallery data.
4. Usage counts and web analytics
To learn how much papat is used and to improve it, we do three things.
Web analytics on our introduction pages
- On the introduction pages of papat.app (home, pricing, about, how-to, terms and so on) we use Cloudflare Web Analytics from Cloudflare, Inc.
- The demo gallery (papat.app/demo/) is part of our introduction pages and uses the same web analytics. It contains only our own photos, and nothing you do there is saved or sent.
- It uses no cookies. It tells us page views, referrers, country, browser and device type, and how fast pages load. It does not collect information that identifies you.
- We do not use web analytics after you log in, or on galleries (the screen your clients see). On galleries we count only what is described in “Gallery activity shown to the photographer” below.
- To turn it off, switch on “Do Not Track” or Global Privacy Control in your browser, or use the switch below. While it is off, the analytics script is not loaded.
Switching web analytics on or off needs JavaScript.
The setting is stored only inside your browser (localStorage). It is not sent anywhere.
Counting how the Service is used
- To improve and run the Service, we count things from our server records: the number of galleries, photos and finalized selections, and counts by country.
- The country comes from the country information attached to the connection. We do not store IP addresses for this count.
- We don’t look at the content of your photos (see the Terms, “Your photos”). Only the operator sees the counts.
Gallery activity shown to the photographer
- So that the photographer can see how a job is going, we record how many times the gallery was opened and how many downloads were made (including by type, such as all at once or one by one), as daily counts, and show them, together with when the gallery was last opened, to that gallery’s photographer.
- For the devices used, we count only whether each was a phone, a tablet or a computer.
- We do not record display names, IP addresses or detailed device information (such as the model or browser name).
- These counts are deleted together with the gallery at the end of its viewing period.
5. Information sent to other companies
Your browser may send information to the companies below.
- Cloudflare, Inc. (when you view our introduction pages)
- What is sent: the page address, referrer, browser and device type, and how long the page took to load. Cloudflare also determines the country from the connection.
- Why: to count page views and visits by country, and to check how fast pages load.
- How to stop it: see “4. Usage counts and web analytics.”
- Stripe, Inc. (when you go to the card registration screen)
- Your browser moves to a Stripe screen. The card details and billing address you enter go to Stripe, not through papat’s pages. Our server sends Stripe your email address, display name and an identifier.
- Why: to register your card and to bill you.
- Google LLC (when you choose “Log in with Google”)
- Your browser moves to a Google screen. As the result of signing in, we receive your name and email address.
- Why: to let you log in with your Google account.
Other than the above, we do not send information to advertising, analytics or social media services from the screens you see after logging in, or from galleries.
6. Service providers
Cloudflare (hosting, storage, delivery, and email sending through Cloudflare Email Sending), Stripe (payments), Google (sign-in). They may process data outside Japan.
7. Sharing with third parties
We do not provide personal information to third parties without your consent, except as required by law.
8. Cookies and stored data
We use cookies to keep you signed in and to remember gallery passcodes. We do not use advertising cookies or mechanisms that follow you around to record your behavior (tracking). Web analytics, which counts things such as page views, works as described in “4. Usage counts and web analytics”: without cookies and without identifying you.
Your web analytics on/off setting is stored only in your browser’s localStorage.
The display name you enter in a gallery is stored in your browser and is removed when you clear your browser data.
9. Your rights
Ask us to disclose, correct, delete or stop using your personal data and we will respond after verifying your identity.