Privacy policy

1. Data controller

GLILAB, a French simplified joint-stock company (SAS) with a share capital of €1,000, registered under RCS Créteil 830 312 690, with its registered office at 4 rue d'Estienne d'Orves, 94300 Vincennes, France. For any question about your data: [email protected].

2. The data we collect

Without an account

• When you send a contact request: your name, your email, your phone number if you give it, your message, the type of shoot, the dates and the budget if you give them, and the app's language.
• When you report a profile: the reason, the details and the email address if you choose to give them.
• Your favorites and language stay on your phone or in your browser. They are not sent to our servers.

Client account (optional)

• Your email and password (stored encrypted: we never know it), or your Apple or Google ID.
• With Apple or Google, we receive your name and email address, or Apple's relay address if you choose to hide yours.
• Your favorites, so you find them on all your devices, and the requests you have sent.

Photographer account

• The same account data.
• Your profile: display name, description, specialties, spoken languages, shoot locations, prices, session length, year you started, links (Instagram, website, WhatsApp).
• Your profile photo and your portfolio photos.
• Verification data: SIRET number, name, activity and status of the business returned by INSEE, Instagram verification code and date.
• The contact requests you receive, and whether you also want them by email.
• If you allow notifications in the mobile app: your device's notification identifier, its system (iOS or Android) and its language.

Technical data

• Like any online service, our hosting providers process technical data (IP address, device or browser type, connection logs) to run and protect the service.

We do not collect your location, show ads, use any analytics or profiling tool, or sell any data.

3. Why, and on what legal basis

• Showing the directory, managing your account and passing your requests to photographers: performance of the service you use.
• Sending the emails your account needs (confirmation code, new password) and a copy of each request you send, alerting photographers to each new request and to the decision made on their profile, by email and notification: performance of the service.
• Checking photographers' professional activity, moderating profiles, preventing fraud and securing the service: our legitimate interest in offering a reliable directory.
• Answering requests from the authorities: legal obligation.

We do not send marketing emails.

4. Who receives your data

• The photographer you contact receives your request, your name, your email and your phone number if you give it, in their space, by email and by notification, to reply to you.
• Reports are read by our team only: the photographer concerned receives neither your identity nor your address.
• Approved profiles (name, description, photos, prices, links) are public: that is the purpose of a directory. The SIRET number and verification data are never shown.
• INSEE receives the SIRET number entered by the photographer, to check it in the public Sirene database.

Our service providers, acting only on our instructions

• Supabase (United States): database, accounts and server, on servers located in Oregon (United States).
• Cloudflare (United States): website hosting and photo storage.
• Resend (United States): emails (account, contact requests and their copies, profile review), sent from servers located in Ireland.
• Expo (United States): delivery of mobile app updates and notifications, then passed on by Apple or Google.

If you sign in with Apple or Google, or message us on Instagram to get your profile verified, those services process your data under their own policies. The map of locations in the mobile app is provided by Apple Maps (iPhone) or Google Maps (Android).

5. Transfers outside the European Union

Some providers are based in the United States. These transfers are covered by the European Commission's Standard Contractual Clauses and, where the provider has joined it, by the EU-US Data Privacy Framework.

6. How long we keep data

• Account, profile, photos and favorites: as long as the account exists. They are erased 30 days after you ask to delete your account; until then, you can cancel by signing in again.
• Contact requests: as long as the account of the photographer who received them exists. If you delete your client account, requests already sent stay with the photographer, no longer linked to your account.
• We may delete an account that has not been used for 3 years, after warning you by email.
• Notification identifiers: deleted when you sign out, when you delete your account or when the device no longer accepts them.
• Reports: 1 year at most after they are handled.
• Technical logs: 1 year at most.

7. Security

Connections are encrypted (HTTPS). Photos are stored in a private space and shown through temporary links. Access to data is restricted by security rules: a photographer only sees their own requests, and nobody can edit someone else's profile.

8. Cookies and storage on your device

The service uses no advertising or analytics cookies. The app and the website only store on your device what they need to work: your sign-in session, your favorites, your language and your preferences. As these are strictly necessary, they do not require your consent.

9. Your rights

• You can access your data, correct it, erase it, restrict its use, object to its processing, receive a copy in a common format (portability) and set instructions for what happens to it after your death.
• You can edit your profile, turn off alert emails and delete your account directly in the app; notifications can be turned off in your phone settings. For anything else, write to [email protected]: we reply within one month.
• If you believe your rights are not respected, you can complain to the CNIL, the French data protection authority (cnil.fr).

10. Minimum age

The service is intended for people aged 16 and over. Photographer accounts are reserved for adults.

11. Changes

We may update this policy. For any significant change, we will let you know in the app or by email. The date of the last update is shown at the top of the page.

This is a translation provided for convenience. In case of any difference, the French version prevails.