Privacy Policy
Last updated: 8 November 2026
This policy explains what personal data Capturely handles, why, for how long, who helps us, and what rights you have. It is written for three groups of people, and each has its own part:
- Part A: photographers who have a Capturely account. For this data we are the controller.
- Part B: clients and visitors of a photographer's gallery, portfolio site or business card page. For this data the photographer is the controller and we are their processor.
- Part C: visitors to capturely.me, our own website. For this data we are the controller.
Parts D and E apply to everyone: who we share data with, transfers, security, your rights and how to contact us.
Who we are
Kamden MB, company code 307013462, Perkūnkiemio g. 19, LT-12120 Vilnius, Lithuania, trading as Capturely ("Capturely", "we", "us"). Email: hello@capturely.me. We have not appointed a data protection officer, because the law does not require one for our activities. Write to hello@capturely.me with any data protection question.
We do not sell personal data, we do not run face recognition or other biometric analysis on photos, we do not use photos to train AI models, and we make no decisions about anyone based solely on automated processing.
Part A. Photographers (we are the controller)
A1. What we collect
| Category | What it contains | Where it comes from |
|---|---|---|
| Account | Email address, name, password (stored only in hashed form), optional phone number, time zone (sent automatically by your browser), the languages you offer in galleries, your handle (the name in your site address), the date you joined | You, your browser |
| Sign-in with Google | If you choose it: the email address and name of your Google account. We ask only for basic profile information | |
| Sign-up and sign-in security | The IP address you signed up from (used to limit how many accounts one network can create per day); short-lived counters of failed sign-in attempts, keyed by email address and IP address | Your device |
| Sessions | For each signed-in device: the IP address, the browser, and when it was last active. You can see this list and sign devices out in your account settings | Your device |
| Settings | Notification preferences, gallery defaults, watermark and branding, business card details (name, email, phone, social links, portrait), the analytics or advertising IDs you add to your galleries, your webhook address and secret, your messaging app connection | You |
| Billing | Your plan, the dates of your free trial, subscription status, billing period, renewal or cancellation date, your customer and subscription references with our payment processor, extra storage, referral code, who referred you, when a referral credit was paid, and the promotional code you used, if any, with how far your trial got. Card details are collected and held by our payment processor, never by us | You, our payment processor |
| Notifications | The notifications shown in your dashboard and when your daily digest was last sent | Generated by the Service |
| Your content | Photos (including any metadata embedded in the files), gallery titles, folders, descriptions and site content. Where these contain other people's personal data, Part B applies | You |
| Correspondence | Emails you send us and our replies | You |
| Error logs | When something fails, our servers record the error, which can include the address requested, your IP address and your account ID | Your device |
| Sign-up measurement | Your choice in our cookie banner when you signed up (analytics, advertising, both or neither) and, only as far as that choice allowed: the identifier our analytics cookie gave your browser; the identifiers our advertising cookies gave your browser, the ad click identifier and campaign tags in the address you arrived at, the page you arrived on, and your browser type | Your device, our website (Part C) |
A2. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, store and deliver your galleries and sites, send you service emails (password reset, email verification, notifications, the daily digest you can switch off) | Contract, Art. 6(1)(b) |
| Take payments, manage subscriptions, trials and referral credits | Contract, Art. 6(1)(b) |
| Handle consumer withdrawals and refunds | Contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) |
| Keep invoices and accounting records | Legal obligation, Art. 6(1)(c) |
| Protect the Service: limit sign-ups and sign-in attempts, keep session records, investigate abuse, fix errors | Legitimate interests, Art. 6(1)(f): keeping the Service and its users safe |
| Handle notices about illegal content and comply with requests from authorities | Legal obligation, Art. 6(1)(c), and legitimate interests |
| Establish or defend legal claims | Legitimate interests, Art. 6(1)(f) |
| Tell you about important changes to the Service or these policies | Contract and legitimate interests |
| Send you emails about using Capturely: help getting started, asking for your feedback, telling you when a free gallery is about to close, and about our paid plans. You can switch them off at any time (see below) | Legitimate interests, Art. 6(1)(f): helping photographers get the most from the Service and telling our customers about our own plans |
| Measure our website and our advertising: report to our analytics and advertising providers, from our server, when you create your account, start a trial, make your first payment (with its amount and currency) and send your first gallery, as far as your cookie choice at sign-up allowed (see below) | Consent, Art. 6(1)(a) |
We do not send marketing newsletters.
Emails about using Capturely. To send these emails we use an email and lifecycle messaging tool. It receives your email address, first name, time zone, language, plan and subscription status, the date and source of your sign-up (for example a referral or an ad), and what you do in Capturely as events and counts: for example that you created or sent a gallery, how many photos you uploaded, or that a client opened your gallery or selected a number of photos. It receives no client details (no client names, client email addresses, comments or photos), only the titles you give your galleries. You can switch these emails off at any time with the link in each email or in your notification settings.
The dashboard uses a product analytics tool hosted in the EU to understand and improve how the dashboard is used, with everything you type and every photo hidden from it and no cookies.
What the sign-up measurement sends. Each report carries the event, its time, a random event identifier, for a payment its amount and currency, and for a trial or a first payment that came from a promotional code, that code (a campaign's code, the same for everyone who uses it). With analytics consent, our analytics provider also receives your browser's analytics identifier and a one-way code derived from your account number. With advertising consent, the advertising platforms (and our analytics provider, for advertising measurement) also receive your email address and account number in hashed form (a one-way code that cannot be turned back into the address), the ad click identifier and advertising identifiers above, and for an event that happens in your browser, your IP address and browser type, so the platform can match the event to the ad you clicked. Without consent for a category, nothing is reported to it. Each event is reported at most once. To withdraw your consent for these reports after sign-up, email hello@capturely.me and we stop them; this does not affect reports made before.
You need to give us your email address and a password (or use your Google account) to have an account. Everything else is optional or created by your use of the Service.
A3. How long we keep it
| Data | How long |
|---|---|
| Account, settings, billing fields | While your account exists. When you delete your account, they are deleted at once |
| Sign-up IP address | While your account exists |
| Failed sign-in counters | Less than an hour |
| Sessions | A session ends after a period without activity, and in every case 90 days after you signed in. Ended sessions are removed by routine clean-up |
| Notifications | Until you clear them, the gallery they mention is deleted, or you delete your account |
| Invoices and accounting records (held by our payment processor and by us) | As long as accounting and tax law requires us to keep them |
| Error logs | For a limited period, after which they are deleted automatically |
| Email and lifecycle messaging profile (the data above, held by our email and lifecycle messaging tool) | While your account exists. When you delete your account, we ask the tool to delete your profile and its history at once |
| Sign-up measurement | While your account exists. The record of which events were reported holds only the random event identifiers, not your account |
| Promotional code use (which code you used, and whether your trial started, was paid or was cancelled) | While your account exists. When you delete your account, the record loses your account and payment references and only counts per code remain |
| Card check for free trials (a one-way code of the card that started a free trial, which cannot be turned back into the card number) | Kept after you delete your account, so the same card cannot start a second free trial under another account |
| Backups held by our providers | Until they expire on the provider's schedule |
| Correspondence | As long as we need it to answer you and to deal with any follow-up |
Part B. Clients and visitors of a photographer (the photographer is the controller)
If you opened a gallery, a portfolio site or a business card page that a photographer made with Capturely, that photographer decides what is collected and why. We process the data on their behalf under our Data Processing Agreement. To exercise your rights, contact the photographer first. If you cannot reach them, write to us and we will pass your request on and help them answer it.
B1. In a client gallery
| Data | When |
|---|---|
| The photos and gallery details the photographer uploads (which may show you, and may contain embedded metadata such as date or location) | Always |
| Your name, email address and phone number | Only if the photographer asks you for them and you enter them, or the photographer enters your name or email |
| Favourites, selections, comments on photos, a comment with your selection, a review (rating, name and comment) | When you use these features |
| A random identifier stored in your browser, which keeps your favourites and selections together and links your visits | Always, when you open a gallery |
| Visit statistics: when you opened the gallery, how long it was open, how many photos you opened, and the identifier above | Always |
| View statistics: country (worked out from the IP address), browser, operating system, device type, referring website or campaign name, and a visitor code that changes daily (your IP address itself is not stored) | Each time the gallery is opened, and for each "download all" |
| Download counts per photo | When you download |
| A session cookie and its record (IP address, browser, last activity), and a cookie that remembers you unlocked a password-protected gallery or entered a client code | When needed, see our Cookie Policy |
Bots and automated tools are filtered out of the statistics. The photographer sees statistics per gallery. They are not shared with third parties and not used for advertising.
Emails we send for the photographer. If the photographer saves your email address on the gallery, Capturely can send you the "your gallery is ready" email when the photographer sends it, and a reminder when the gallery is within 3 days of expiring.
Notifications to the photographer. When you favourite, comment, download, submit a selection or leave a review, the photographer is notified in their dashboard and, depending on their settings, by email, by a messaging app and by webhook to a system of their choice. These notifications can include your name, the gallery title, the file name, your rating and the start of your comment.
Analytics and advertising tools the photographer adds. A photographer can add their own analytics or advertising tags to their galleries. Capturely loads these only after you accept them in the gallery's cookie banner. The providers of those tools then receive data about your visit under their own policies, and the photographer is responsible for that use. To change your choice later, delete the gallery's cookies in your browser settings; the gallery then asks you again.
B2. On a portfolio site or business card page
- Contact form. If you send a message through a photographer's site, we email your name, email address and message to the photographer (with your email address as the reply-to), and we save the start of your message as a notification in their dashboard. Your IP address is used for a short time to stop the form being abused.
- Fonts. Portfolio sites load their fonts from a web font service, which receives your IP address when the page loads.
- Embedded videos and images. A site can embed a video from a video platform, or show an image hosted elsewhere. Those services receive your IP address and may set cookies under their own policies when the content loads.
- Portfolio sites and business card pages set no cookies of their own and run no Capturely statistics.
B3. How long
Gallery data, including Client details, comments, selections, reviews and statistics, is deleted when the gallery is deleted: in our regular clean-up once 14 days have passed since its expiry date or 30 days since it was moved to the trash, at once if the photographer deletes it for good, and at once if the photographer closes their account. Stored photo files are deleted with it (on account closure, in the background shortly after). The identifier in your browser stays until you clear your browser storage.
Links to photos are private and stop working after a limited time.
B4. Our own limited role
We act as a controller ourselves only where we must: to keep the Service secure (for example blocking abuse), to handle notices about illegal content, and to meet legal obligations. The legal basis is our legitimate interest in a safe service and our legal obligations.
Part C. Visitors to capturely.me (we are the controller)
Our website here means the home page in every language, the blog, the help centre, these legal pages and the sign-in and sign-up pages. The dashboard, client galleries, portfolio sites and business card pages carry none of the measurement below.
- Analytics and advertising, only with your consent. Our cookie banner asks before any analytics or advertising cookie is set. You can allow analytics, advertising, both or neither, and change your choice at any time with Cookie settings at the foot of every page. Legal basis: consent, Art. 6(1)(a), and the rules on storing information on your device. Withdrawing consent does not affect what happened before.
- What the tools receive. With analytics consent, our analytics provider receives the pages you view, how you arrived (for example the website or campaign that sent you), your browser and device type, an approximate location worked out from your IP address, and a random identifier stored in a cookie. With advertising consent, advertising platforms receive the same kind of information together with the ad click identifier you arrived with, so they can tell us which ads lead to sign-ups and show our ads to people more likely to need Capturely.
- Before you choose. Our measurement tag for analytics and search advertising loads in a mode that sets no cookies and stores nothing on your device until you choose. It sends limited signals without identifiers (for example that a page was viewed, the time, the type of browser and whether you arrived from an ad), used only to estimate visits and conversions in total; your IP address reaches the provider as part of the request. Legal basis: our legitimate interest in measuring our website and advertising in total, Art. 6(1)(f). You can object at hello@capturely.me. The advertising platforms' tags are not loaded at all without your consent.
- Which ad brought you. With advertising consent, our server keeps the ad click identifier and campaign tags from the address you arrived at, and the page you arrived on, in a cookie for 90 days, and copies them to your account if you sign up (Part A). Until you choose, your browser holds them for the open tab only and discards them if you reject advertising.
- Counting visits without cookies. Our own server keeps a simple count of the pages of our website that are viewed, so we can see how many people visit, how they find us and how many reach the sign-up page, including the visitors who do not allow analytics cookies. For each page view it stores only: the time; the page address without its query, except the campaign tags
utm_source,utm_mediumandutm_campaignif the address carried them; whether the address carried an ad click identifier, as a yes or no (never the identifier itself); the domain of the website that linked to the page; your country, as our network provider works it out from your IP address; the type of device (mobile, tablet or desktop); the language of the page; whether the request looks automated; and a visitor code. The visitor code is a one-way code made from your IP address and browser details together with a random secret that is replaced every day and then deleted, so the same visitor has a different code every day and the code cannot be turned back into your IP address or linked to your visits on other days. Your IP address and browser details themselves are not stored. If you create an account, the page views with your visitor code from that day are marked as having led to a sign-up; your account is not linked to them. This count sets no cookies, stores nothing on your device and runs no script in your browser, so it does not depend on your cookie choice. The records are deleted after 90 days. Legal basis: our legitimate interest in knowing how our website is used and what brings visitors to it, Art. 6(1)(f); we keep the intrusion minimal, with nothing stored on your device and no code that lasts longer than a day. Because the records cannot be linked to you, we usually cannot find a particular person's page views among them; you can still object at hello@capturely.me. - Cookies. Besides the optional cookies above, our website sets two preference cookies (your language and the display currency you chose), a cookie that remembers your cookie choice and, when you follow a promotional code, a cookie that carries that code to checkout. The dashboard sets the cookies needed for signing in and for display preferences. See our Cookie Policy.
- Server logs. Our hosting provider processes your IP address and request details to deliver pages and protect the Service (legitimate interests). Error logs are kept as described in A3.
- Contacting us. If you email us, we use your message to reply (legitimate interests, or steps before a contract).
Part D. Who we share data with
Our service providers. We share personal data only with the service providers we need to run Capturely: application hosting, database hosting, file storage for photos, payment processing, email delivery, an email and lifecycle messaging tool for our emails to photographers (Part A), website analytics (only with consent, Part C), and web font delivery for portfolio sites. They act on our instructions. Our Subprocessors page describes each category, where the data is and how transfers are protected; the named list is available on request at hello@capturely.me. Data processing agreements with each of them are in place or being put in place.
Analytics and advertising providers for our own website, only as far as your cookie choice allows (Part C, and Part A for the sign-up measurement). Our analytics provider acts on our instructions. Advertising platforms also use the data for their own advertising purposes, as independent controllers under their own policies. Some of them are based outside the EEA (see E1).
Services a photographer chooses to connect. These receive data only when a photographer turns them on:
- a sign-in provider, if a photographer signs in with an external account. It is an independent controller for its own sign-in service;
- a messaging app for notifications, which receives the notification text (gallery title, client name, the start of a selection or review comment). It is a recipient the photographer chose;
- the photographer's own webhook or automation tools, which receive gallery events (gallery title and address, file name, photo ID, selection count, review rating and reviewer name). They are recipients the photographer chose;
- analytics and advertising tools a photographer adds to their galleries, which load only after the visitor consents. The photographer is responsible for them.
We also disclose data where the law requires it, for example to a court or a supervisory authority, or to protect our rights.
Part E. Transfers outside the EEA, security and your rights
E1. Where data is processed
Our application and its database are hosted in the European Economic Area and Switzerland. Switzerland has an EU adequacy decision. Photo files are held with a storage provider that may process data outside the EEA under the safeguards below. Some of our providers are companies based outside the EEA and may access data from there. Where this is a transfer outside the EEA, it is covered by an adequacy decision (including the EU-US Data Privacy Framework for certified companies) or the European Commission's Standard Contractual Clauses. The list of our subprocessors is available on request.
E2. Security
Passwords are stored only in hashed form. Data is encrypted in transit and at rest. Photos are kept in private storage, and the links to them are private and expire. Sign-ins end automatically, and photographers can sign out other devices. Access to production data is restricted to the people who need it. We will notify the supervisory authority and affected people of a personal data breach where the law requires.
E3. Your rights
Under the GDPR you can ask us for access to your personal data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on our legitimate interests. Where we rely on consent, you can withdraw it at any time.
- Photographers can change most data and delete their account in their settings.
- Clients and visitors of a photographer should contact the photographer first (Part B).
- To exercise any right with us, email hello@capturely.me. We answer within one month, which we can extend by two months for complex requests; we will tell you if we do. We may ask you to confirm your identity.
You can also complain to a data protection supervisory authority, in particular in the EU member state where you live, where you work or where you think the law was broken. Our lead supervisory authority is the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija), vdai.lrv.lt.
E4. Children
You must be at least 18 to open a Capturely account. Photographers are responsible for the consents needed to deliver photos of minors.
E5. Changes
We will post any change on this page with a new date, and tell photographers by email or in the dashboard before a material change takes effect.
E6. Contact
Kamden MB (Capturely), Perkūnkiemio g. 19, LT-12120 Vilnius, Lithuania. Email: hello@capturely.me.