Privacy Notice

1. Who we are

Controller (Art. 4(7) GDPR):

Legal name

GS Software BV

Trade name

Fotofee

Registered office

Da Vincilaan 1, 1930 Zaventem, Belgium

Enterprise number (KBO/BCE)

0801.407.862

VAT number

BE 0801.407.862

Register

RPR Brussel

Email

hello@fotofee.be

Data-protection contact

dpo@fotofee.be

Supervisory authority: Belgian Data Protection Authority (APD; Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels — dataprotectionauthority.be.

You have the right to lodge a complaint with the APD, with the supervisory authority of your habitual residence, or with a court (Arts. 77–79 GDPR).

2. What we process and why

Photo metadata. From each photo we keep the capture time, the GPS location and camera details when they are in the original file, and the original filename. We use them only to order and group your photos by date and place when we build your book. Your photos stay private to you, except that people you invite to edit the book can open the original photo files, including this metadata, and anyone with a share link can see the cover and read the book’s pages, made from smaller copies of your photos, never your original photo files (see “Sharing your book” below). The metadata is removed together with the photo, book or account: when a photo is deleted we clear it straight away, and the database rows and files are permanently deleted within 7 days, on the dates in the row above.

Data we receive from others: reports about your share link. Anyone who opens a book through a share link can report it to us as illegal content or as a breach of our terms (Digital Services Act Art. 16). Such a report is a source of personal data about you as the book’s owner (GDPR Art. 14(2)(f)): the link, the reason, the spreads concerned and, later, our decision. We email you when a report hides your link and when we decide, with our reasons (DSA Art. 17). The reports on your links are in your data export at fotofee.be/account, without the reporter’s name, email address, language and own words: we do not tell you who reported your book unless the law requires it (GDPR Art. 15(4), DSA Art. 17(3)(b)). You can ask for the reporter’s words at dpo@fotofee.be; we send them with anything that identifies the reporter removed. Where the law or the protection of others requires us to hold a report back, it is not in the export. If you report a book yourself, we use your name, email address, language and explanation only to handle the report and answer you, and we do not give your name or email address to the book’s owner.

Sharing your book. When you share a book, anyone with the share link can see its cover and read the book online, with your first name; the link stops working when you revoke it or after one year. Apps and sites where you paste the link (such as WhatsApp, Facebook or iMessage) fetch the title, subtitle and cover from us to show a preview, and keep their own copy under their own privacy terms; revoking the link does not remove it there. The story image (for Instagram, Facebook or another app you choose) is made on our server from your cover, shows your share link and is handed to your device; what you post is your choice, and the platform you post on processes it as its own controller. Anyone who sees your post can open the link until you revoke it or it expires. We do this at your request (GDPR Art. 6(1)(b) for your data; Art. 6(1)(f) for the people in the book, see §3).

We never use your photos to train any AI model. We never use your photos for marketing, testimonials, or sample books.

3. Special-category data — biometric face clustering

If you turn on face clustering, our pipeline extracts face embeddings (numerical vectors representing facial features) from photos in the album you are working on, clusters them in memory, and writes only an opaque integer “cluster id” to each photo. The embeddings themselves are not stored. No cross-user or cross-album face database is built.

Lawful basis: Art. 9(2)(a) GDPR — explicit consent (APD Recommendation 01/2021 §§3–5). Consent is asked at the moment you first generate a book with photos in hand, not buried at signup.

You can withdraw consent at any time from your account settings. On withdrawal we: (1) immediately stop running face clustering on new pipeline rounds; (2) within 72 hours clear the cluster ids written to your existing photos and your list of people who must be in the book.

Children’s images may appear in family albums. We do not differentiate adult vs child faces; the cluster ids are opaque and no demographic, age, gender or emotion inference is performed.

For your own children, you act as the holder of parental authority and can give consent on their behalf. For children depicted who are not your own (a niece, a friend’s child, classmates), you confirm that you have a reasonable basis to believe the parental-authority holder would not object to their inclusion in your personal photobook, and you commit to removing any photo at that holder’s request.

4. AI in the pipeline

We use AI for selection, ranking, cropping and layout of your own photos. AI also suggests the short texts in your book, such as chapter titles, introductions and captions, from what your photos show, from their dates and places, and from the title and description you type in book setup. We do not use AI to make new images or to change what your photos show. You see every text in your book before you order, and you can change titles in the editor.

This AI runs in the EU: Google Gemini on Vertex AI in an EU region and, as a backup, Mistral AI on its EU servers. These providers process your photos only to answer our request and may not use them to train their models; we never use your photos to train a model either. Content moderation uses the same tools: a safety check that runs on our own servers and the EU AI service above. The full list of sub-processors is in §5.

Mood and expressions. Our tools give each photo a mood label (for example “joyful” or “serene”) from the whole image, to pace the book; the EU AI service above may set that label from what it sees in the photo. Our tools also notice closed eyes or an open mouth, so that a blinking face is not chosen for the cover. None of this names or labels a person’s emotions, age, gender or origin, and nothing is kept per person. It is not an “emotion recognition system” within Art. 3(39) of the AI Act (see its Recital 18 on readily apparent expressions).

Under the EU AI Act (Regulation (EU) 2024/1689), our photo tools are not a high-risk AI system: they choose, crop and arrange your own photos and have no legal effects on you.

Year book. A year book is made from up to 2,000 photos. In the Fotofee app you choose one calendar year and the app offers that year’s photos; it leaves screenshots out on your phone before anything is uploaded, so they never reach our storage or the AI service. On the website you choose the photos yourself. The photos are checked as for any other book: our own tools on our servers first set aside weaker photos and duplicates, and the photos that remain are rated by the EU AI service above (Gemini on Vertex AI in the EU, or Mistral AI in the EU as a backup).

5. Sub-processors

We share your data with the service providers below. Each one that processes your data for us does so only on our instructions and under a processing agreement (Art. 28 GDPR); we put that agreement in place before any of your data goes to it. Mollie is not one of them: for your payment data, Mollie is a separate controller, with its own privacy statement. Transfers outside the EEA are covered in §6.

Other recipients (not our processors).

• Apps and sites where you share your link (link previews): title, subtitle and cover; independent controllers, not our processors.

We re-verify Data Privacy Framework certifications quarterly. The detailed sub-processor list and Transfer Impact Assessments (TIAs) are available to the APD on request.

6. International transfers

The EEA is our default. When we transfer data outside the EEA we rely on an adequacy decision, the EU-US Data Privacy Framework (DPF), or Standard Contractual Clauses (SCCs) with the supplementary measures identified in the relevant Transfer Impact Assessment. Address text for the address check at checkout goes to Google Maps Platform (US / global), and our service e-mails are sent by Resend (US), both under the DPF with SCCs as fallback. Notifications in the app go through Expo (650 Industries, United States) under the Standard Contractual Clauses in its terms, and from Expo to Apple or Google (United States) to reach your phone.

7. Your rights

You have the right to:

• Access the data we hold about you (Art. 15).
• Rectify inaccurate data (Art. 16).
• Erase your data (Art. 17), subject to retention obligations under Belgian law.
• Restrict processing (Art. 18).
• Portability in a machine-readable format (Art. 20).
• Object to processing based on legitimate interest (Art. 21), including if a photo of you appears in another customer’s upload.
• Withdraw consent at any time, with effect for the future (Art. 7(3)).
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (Art. 22). Our automated layout choices (which photo goes on the cover, what is cropped) have no such effects: they are proposals you review and approve.

Exercise your rights via the in-app tools in your account settings (data export, account deletion, consent toggles) or by emailing dpo@fotofee.be. We respond within one month. If a request is complex or there are many, we may take two more months, and we tell you so within the first month (Art. 12(3)).

8. Retention summary

• Account data: until you delete the account.
• Photos: kept until you delete them, the book or your account. An unordered book is deleted, with its photos, 30 days after its creation (we e-mail you 14 and 3 days before). Once an order is at the printer, photos that were not printed are deleted; the printed photos, the print file and the book’s layout are kept until 2 years after delivery (shipped + 7 days). Then only a 512 px cover image and the title remain. Backups and version history: purged within 30 days after each deletion.
• Uploaded photos on no book: soft-deleted 30 days after upload, purged 7 days later.
• Face embeddings: in memory only; never persisted.
• Face cluster ids: within 72 hours of consent withdrawal; on account deletion.
• The generated book: kept until you delete it or it expires; removed within 30 days of deletion.
• Orders / invoices: 7 years from end of accounting year (VAT Code Art. 60 §4).
• Order evidence (approved PDF hash, Terms version, the notice version shown): 5 years from delivery.
• Technical logs: 7 days. Auth and legal audit events: 7 days in full (Fly.io), a shortened copy 24 months in a write-protected archive (Cloudflare R2, EU), then deleted. Book-generation logs: 30 days, deleted at once when you delete your account. Error reports, application logs and traces: 30 days. Site statistics (with consent): individual measurements 7 days at Cloudflare, 30 days at Sentry.
• App notifications: the push token while you are signed in to the app on that device; after you sign out it is no longer used and is deleted 30 days later. The record of each notification sent: 30 days. Everything is deleted at once with your account.
• Cookie-consent records: 24 months.
• Marketing-consent records: until withdrawn, + 24 months thereafter for Art. 7(1) demonstrability.

When an account is deleted, the account record is anonymised — email address replaced by a neutral placeholder, name cleared, OAuth identity cleared — so accounting records remain intact without continuing to identify you.

A shortened security and legal record of your account’s events (no name, no email address) stays in a write-protected archive for up to 24 months, to protect the service and to defend legal claims; it is then deleted.

9. Children

Account holders are 18 or older. You must be 18 or older to create an account and to order (Terms §3); if we learn that an account belongs to someone under 18, we close it. Children may of course appear in the photos you upload; §3 explains how we treat the faces in them.

We do not identify, classify, or infer attributes of minors depicted in photographs — no age inference, no gender inference, no emotion inference. The pipeline treats all detected faces uniformly.

10. Cookies

We use a small number of cookies. See our Cookie Policy for the full list. Strictly-necessary cookies (session id, CSRF token, language preference, consent record) are exempt from consent under Art. 10/2 §2 of the Belgian Act of 30 July 2018. Everything else waits for your choice in the cookie banner; you can change it at any time under Cookie settings at the bottom of every page.

11. Security

• Photos stored in EU regions with AES-256 at rest + TLS 1.2+ in transit.
• Authentication uses opaque session cookies (HttpOnly + Secure + SameSite=Lax) — your browser never holds an access token.
• Auth events logged to a tamper-evident store (HMAC-pseudonymised) with anomaly alerting.
• Internal access to biometric cluster data is restricted and logged per the Belgian Act of 30 July 2018.

We notify you and the APD of any personal data breach as required by Arts. 33–34 GDPR (APD within 72 hours; you without undue delay where the breach poses a high risk to your rights).

12. Changes

We update this notice when our processing changes. Material changes are notified by email at least 30 days before they take effect. The version date above is the current version.

13. Complaints

You have the right to lodge a complaint with:

• The Belgian Data Protection Authority — dataprotectionauthority.be — under Art. 77 GDPR.
• The supervisory authority of your habitual residence (e.g. the Dutch Autoriteit Persoonsgegevens for Dutch residents) under Art. 77 GDPR.
• The Belgian courts under Arts. 78–79 GDPR.

You may also exercise your Art. 21 right to object by emailing dpo@fotofee.be.