Privacy Policy

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, update your profile, make a purchase, or communicate with us. This may include your name, email address, phone number, and business details.

1a. Technical & Log Data

When you use our Platform, we automatically collect certain technical information, including:

• Log Data: IP address, browser type and version, referring/exit pages, pages visited, date and time of your visit, and time spent on pages
• Device Data: Hardware model, operating system and version, unique device identifiers
• Usage Data: Feature interactions, upload activity, gallery access logs, and download events
• Location Data: Approximate geographic location derived from your IP address (country/region level only)

This data is collected via server logs, cookies, and analytics tools. It is used for security monitoring, fraud prevention, performance optimisation, and service improvement.

2. How We Use Information

We use the information we collect to operate, maintain, and improve our services, to process your transactions, to send you related information (including confirmations and invoices), and to communicate with you about promotions or news.

2a. Legal Basis for Processing (UK GDPR Article 6)

As a UK company, SeySpace is subject to the UK General Data Protection Regulation (UK GDPR) as retained in UK law by the Data Protection Act 2018. The legal bases on which we process your personal data are:

• Contractual Necessity (Art. 6(1)(b)): To provide, maintain, and manage your account; to process payments; to deliver galleries and downloads to your clients
• Legitimate Interests (Art. 6(1)(f)): For security monitoring, fraud prevention, product improvement, service analytics, and communicating platform updates — where these interests are not overridden by your rights
• Legal Obligation (Art. 6(1)(c)): To comply with tax laws, court orders, regulatory requirements, and requests from law enforcement
• Consent (Art. 6(1)(a)): For optional analytics cookies, marketing emails, and any processing not covered by the above bases — you may withdraw consent at any time

Where we process special category data (e.g., photographs that may reveal ethnicity or health), we rely on your explicit consent (Art. 9(2)(a)) or substantial public interest grounds, as applicable.

3. Payment Information

SeySpace does not store your credit card details. All payment processing is handled by our third-party provider, Stripe. When you provide payment information, it is transmitted directly to Stripe via an encrypted connection. We only store tokens or IDs required to manage your recurring subscriptions or transactions.

For bookings made through the Creative Network, SeySpace securely processes deposits and deducts a 15% commission before disbursing the remaining funds to the respective professional's connected Stripe, PayPal, or Paystack account.

4. Data Storage and Residency

Your data and your clients' photographs are stored on secure cloud servers. We utilize this infrastructure to ensure high availability, security, and compliance with data protection standards.

5. Storage Limits & Data Retention

SeySpace enforces storage limits and data retention policies based on your subscription tier. Understanding these policies is important for managing your content:

Storage Tracking

We track the following metrics for your account:

• Total Storage Used: The cumulative size of all files you have uploaded
• File Size: Individual file sizes are recorded for storage quota calculations
• Referral Bonus Storage: Users referred through the Growth Network receive an instant +10GB boost to their storage limit.

Retention Periods by Tier

Automatic Deletion Process

Content that exceeds its retention period is automatically deleted from our servers. Our automated cleanup process runs daily at 3:00 AM UTC and permanently removes:

• Gallery images past their expiration date
• Associated file variants (thumbnails, web-optimized versions, high-resolution copies)
• RAW files linked to expired images

Expiry Notifications

We send email notifications to help you manage your content before deletion:

• 5-Day Warning: Sent when your content is 5 days away from expiration
• 2-Day Warning: Final reminder sent 2 days before deletion

Note: These notifications are sent to Free tier users only. Paid tier users have extended retention and are not subject to the same notification schedule.

6. Data Controller vs. Data Processor (Photography Services)

For the purpose of GDPR and data protection laws when using our client gallery and delivery services:

• You (The Photographer) are the Data Controller for the personal information of your clients (e.g., photos, names, emails) that you upload to SeySpace. You are responsible for obtaining necessary consents.
• SeySpace is the Data Processor. We process this data only on your behalf to provide the Service (e.g., hosting galleries, delivering downloads).

6a. Data Controller vs. Data Processor (Marketplace)

When buyers purchase products from independent sellers on the SeySpace Marketplace, the data roles are as follows:

• SeySpace acts as a Data Processor to facilitate the transaction on the platform.
• The Seller acts as an independent Data Controller for the buyer data they receive to fulfill the order (such as the buyer's email address and billing details).
• Data Sharing: If you buy a product on the Marketplace, we will share your necessary contact and transaction information with the specific Seller you are purchasing from so they can provide support and deliver the product. We do not share your full payment card details with Sellers.
• Sellers are individually responsible for handling buyer data in compliance with data protection laws.

6b. Marketplace Affiliate Program

The SeySpace Marketplace allows Sellers (photographers) to partner with Affiliates to promote their products. If you click on an Affiliate's referral link or use their referral code at checkout:

• Tracking: We use cookies or similar tracking technologies to attribute your purchase to the referring Affiliate so they may receive a commission.
• Data Sharing: The Affiliate will receive aggregated analytics (e.g., number of clicks and sales). We do not share your name, email, or payment details with the Affiliate.
• Affiliate Independence: Affiliates operate independently. Sellers are responsible for setting their commission rates, processing payouts, and ensuring their Affiliates comply with data protection laws.

7. Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encrypted data transmission (SSL/TLS)
• Secure cloud storage
• Regular security audits and monitoring
• Access controls and authentication requirements

However, no internet transmission is completely secure, and we cannot guarantee absolute security.

8. No Scraping or Mirroring

To protect the intellectual property and privacy of our users, scraping, mirroring, or data mining of the SeySpace Discovery Network or any client galleries is strictly prohibited. Automated extraction of images or personal data from our platform is a violation of our policy and will result in immediate IP blocking and potential legal action.

9. Cookies and Tracking (PECR)

We use cookies and similar tracking technologies in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR). We categorise our cookies as follows:

• Strictly Necessary: Required for the Platform to function (authentication sessions, security tokens, CSRF protection). These cannot be disabled.
• Analytics / Performance: Used to understand how users interact with our Platform (e.g., page views, feature usage). We use these only with your consent.
• Marketing / Targeting: Used to deliver relevant communications. We only set these with your explicit consent.

You can manage your cookie preferences at any time via your browser settings or our in-platform cookie preferences centre. Withdrawing consent to non-essential cookies will not affect your ability to use the Platform.

9a. Do Not Track (DNT) Signals

Some browsers offer a "Do Not Track" (DNT) setting. SeySpace does not currently alter its data collection practices in response to DNT signals, as there is no industry-standard mechanism for honouring them. We encourage you to use our cookie preferences controls instead.

9b. Email Marketing & PECR Opt-Out

SeySpace may send you marketing emails about new features, offers, or updates. We will only do so where you have given consent or where we have a legitimate interest under PECR (e.g., you are an existing subscriber and the email relates to similar services).

You can opt out of marketing emails at any time by:

• Clicking the "Unsubscribe" link in any marketing email
• Updating your notification preferences in your account settings
• Contacting us at support@seyspace.com

Opting out of marketing emails will not affect transactional emails (e.g., invoices, password resets, gallery notifications) which are necessary for your use of the Service.

10. Third-Party Services

We may use third-party service providers to monitor and analyze the use of our Service, including:

• Cloud Storage: Secure storage for your images and files
• Stripe: Payment processing
• Google Analytics: Usage analytics (optional)
• Celery/Redis: Background task processing for storage management

10a. Inspiration Vault Data and Third-Party Links

When you use the Inspiration Vault feature to clip and save image URLs from third-party websites (such as Pinterest or other platforms):

• We store the URLs, metadata, and optional curation notes you provide. We do not download or host the original image files from third-party sites unless explicitly uploaded by you.
• We do not share your private Inspiration Vault data with third parties. However, if you choose to publish an item to the public Inspiration Network, the associated URL and metadata will be visible to other SeySpace users.
• SeySpace is not responsible for the privacy practices or content of the third-party websites from which you clip images. Your interaction with those external sites is governed by their respective privacy policies.

10b. Internal Administrative and Support Access

SeySpace utilizes a tiered internal access model to provide technical support and ensure platform security. Personnel with specialized roles (Sovereign, Bridge, and Concierge) may access system data as follows:

• Sovereign Admins: Full oversight for infrastructure maintenance and system-wide security.
• Operational Bridge: Management of technical configurations and complex enterprise setups.
• Success Concierges: High-touch support for Enterprise and Studio users, assisting with workflow and account management.

All such access is performed through secure, authenticated channels and is subject to rigorous audit logging. We do not use this access for any purpose other than providing and improving the Service.

10c. Children's Privacy — ICO Age Appropriate Design Code

The SeySpace platform is not directed at individuals under the age of 18. We do not knowingly collect personal data directly from children.

Under UK GDPR Article 8, processing of personal data of a child under 13 requires parental or guardian consent. If you are a photographer who uploads images or personal data relating to children as part of your professional work, you are the Data Controller for that data and are solely responsible for ensuring lawful processing, including obtaining the necessary parental consents.

If we become aware that personal data of a child under 13 has been directly submitted to us without parental consent, we will delete it promptly. Please contact legal@seyspace.com to report any such instances.

10d. International Data Transfers (UK GDPR Chapter V)

Your personal data may be transferred to and stored in countries outside the United Kingdom where our service providers operate (including cloud infrastructure and payment processors). Where such transfers occur, we ensure appropriate safeguards are in place in accordance with UK GDPR Chapter V, including:

• UK Adequacy Regulations: Transfers to countries granted adequacy status by the UK Secretary of State
• International Data Transfer Agreements (IDTAs): The UK's standard contractual mechanism for transfers to non-adequate countries
• Addendum to EU Standard Contractual Clauses: Where applicable for transfers involving EU/EEA entities

By using SeySpace, you consent to your personal data being transferred internationally subject to these safeguards.

10e. Data Breach Notification (UK GDPR Articles 33 & 34)

In the event of a personal data breach, SeySpace will:

• Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of individuals
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, providing details of the nature of the breach and the steps they can take to protect themselves
• Maintain an internal record of all data breaches, including those not required to be reported to the ICO

If you believe your SeySpace account has been compromised, please contact us immediately at legal@seyspace.com.

10f. Google API Services Usage

SeySpace's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Data Access: With your explicit consent, we access your Google Calendar data strictly to display your upcoming events and bookings within your secure SeySpace dashboard.
• Data Storage: We only store the temporary OAuth authentication tokens required to maintain the calendar sync connection. We do not permanently store your calendar event data on our servers.
• Data Sharing: We do not share, sell, or transfer your Google Calendar data to any third parties, advertisers, or data brokers under any circumstances.

11. AI Assistant & Chatbot

When you interact with our AI Assistant (SeyBot), we process the content of your messages to provide relevant answers from our Knowledge Base.

• Data Usage: Chat logs are stored to improve support quality and allowing human agents to follow up.
• No Model Training: Your private gallery data and client information are not used to train public AI models.
• Privacy: We recommend avoiding sharing sensitive personal information (like passwords or credit card numbers) in the chat.

12. Your Rights Under UK GDPR

As a UK resident (or where UK GDPR applies), you have the following rights regarding your personal data:

• Right to Access (Art. 15): Request a copy of the personal data we hold about you
• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal data
• Right to Erasure / "Right to Be Forgotten" (Art. 17): Request deletion of your personal data where it is no longer necessary for the purpose it was collected
• Right to Restrict Processing (Art. 18): Request that we limit how we use your data in certain circumstances
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing purposes
• Rights relating to Automated Decision-Making (Art. 22): Request human review of any automated decisions that significantly affect you

To exercise any of these rights, please contact us at legal@seyspace.com. We will respond within one month of receipt of your request (UK GDPR Article 12).

12a. Right to Lodge a Complaint with the ICO (UK GDPR Article 77)

If you believe we have not handled your personal data in accordance with UK GDPR, you have the right to lodge a complaint with the UK's supervisory authority:

We would appreciate the opportunity to address your concerns before you approach the ICO. Please contact us first at legal@seyspace.com.

13. Account Data Retention After Deletion

When you delete your SeySpace account, we retain your personal data (name, email, billing history) for the following periods before permanent deletion:

• Account data (name, email, preferences): Retained for 30 days to allow account recovery, then permanently deleted
• Financial records and transaction history: Retained for 7 years as required by UK tax law (HMRC requirements under the Taxes Management Act 1970)
• Security and audit logs: Retained for up to 12 months for fraud prevention and legal compliance
• Uploaded content (photos, galleries): Subject to your subscription tier's retention policy as described in Section 5

You may request early deletion of your personal data (subject to legal retention requirements) by contacting legal@seyspace.com.

14. Data Export

Before your content reaches its retention deadline, you have the right to download and export all your data. We provide download functionality within client galleries and recommend maintaining local backups of important files.

15. Governing Law

This Privacy Policy and any disputes related to it shall be governed by and construed in accordance with the laws of England and Wales. By using the Service, you consent to the exclusive jurisdiction of the courts of England and Wales. SeySpace is registered in the United Kingdom and is supervised by the Information Commissioner's Office (ICO) as its competent data protection authority.

If you have any questions about this Privacy Policy, please contact us at support@seyspace.com.