What we collect
We collect the photos you upload, the metadata extracted from them (labels, faces, dates, GPS), the names + relationships you provide for your face clusters, your answers to the bespoke questionnaire, and the standard account fields — email, billing info via Stripe.
What we don't collect
We do not train AI models on your photos. We do not sell them to advertisers. We do not share them with third parties beyond the named processors below.
Who processes your data
Under UK + EU GDPR we're required to be transparent about any third party that touches your data. The current list of sub-processors is:
- Google Cloud (Vision API) — image label and OCR analysis. Data region: EU. Contractually bound not to train on customer data.
- Megvii (Face++) — face detection and clustering. Data region: EU. Contractually bound not to train on customer data.
- Anthropic (Claude API) — bespoke questionnaire and folder naming. Data region: EU/US. Contractually bound not to train on customer data.
- Replicate (Real-ESRGAN) — Premium photo enhancement (optional, only invoked for Premium orders). Data region: US.
- Stripe — billing and Checkout. Data region: UK + EU.
- Resend — transactional email (sign-in links, order updates).
We're actively migrating to self-hosted equivalents of the machine-vision sub-processors to reduce the number of parties that touch your photos. When that lands we'll update this list and email affected customers.
How long we keep it
Originals: kept for the lifetime of your account. Metadata and audit logs: kept for 13 months after deletion for tax and regulatory record purposes, then purged. Off-site backups: rolling 30-day encrypted snapshots.
Your rights
UK + EU customers have the full GDPR rights: access, portability, rectification, erasure, restriction, and the right to lodge a complaint with the Information Commissioner's Office (ICO). For self-service, use the buttons on your account page — or email privacy@photonest.co.uk. We respond within 30 days, usually within a week.
Where we're based
PhotoNest is a UK sole-trader business operated by Phillip Dewey, based in Cardiff, Wales. Customer data is hosted in the UK and EU.