Privacy Policy

1. Who we are

Osvio («Osvio», «we», «us», «our»; formerly operating under the name Lumi) — a digital platform for photographers and their clients, providing tools for creating, uploading, storing, organizing, presenting, and sharing photo galleries, automating workflows, interacting with clients, analytics, and other features available through the website, web application, plugins, integrations, and related services (collectively, the "Service").

The data controller, unless otherwise explicitly stated for a specific processing, is: IE "Yakimchuk Denys Oleksandrovich", privacy email: [email protected].

For personal data that a photographer or other professional user uploads or collects through the Service about their own clients and other individuals (such as photos, client records and gallery-visitor data), that user is the data controller and Osvio acts only as a processor on their documented instructions, as set out in the Data Processing Agreement. Osvio is a controller only for the data it processes for its own purposes, described in Section 6.

2. Who this Privacy Policy applies to

This policy applies to:

• registered photographers and other professional users of Osvio;
• clients, gallery visitors, and other individuals accessing content through Osvio;
• website visitors and users of marketing pages;
• individuals contacting support or interacting with us in other ways;
• other individuals whose personal data is lawfully transferred to Osvio in connection with the use of the Service.

3. What data we may process

3.1. Account data

• first and last name or professional name;
• email address, phone number, and other contact details, if provided;
• username, profile data, profile photo, and other voluntarily provided information;
• authentication and account security data.

3.2. Data related to the use of the Service

• created galleries, albums, projects, settings, access rights, and other work data;
• information about uploads, views, file downloads, and other interactions with features;
• technical logs, IP address, device type, browser, operating system, session identifiers, and approximate technical information;
• diagnostic information necessary for the security, support, and improvement of the Service.

3.3. Photos and other content

We may store and technically process photos, images, metadata, titles, descriptions, gallery structure, and other content uploaded or created in the Service.

Photos may contain personal data, including images of individuals, EXIF information, geolocation, creation date and time, and other data that may be associated with a natural person.

3.4. Client and gallery visitor data

Depending on the settings of a particular gallery, we may process data necessary for access and interaction: name, email, password or other access mechanism, information about selected photos, actions in the gallery, and other data related to the use of a specific feature.

If a gallery visitor voluntarily gives their name or email — for example when sending a photo selection, leaving a comment or before a download — that data, together with their activity in that gallery (views, likes, downloads, orders), may be linked to a client record the photographer keeps in Osvio. The photographer can turn these prompts off for their gallery. Retention periods are in Section 11.

3.5. Biometric and AI-related data

Osvio offers face detection, grouping and search functionality within a photographer's gallery. Where this functionality is active for a gallery, we technically process the photographs in that gallery to detect faces and generate feature vectors ("embeddings") used to group and search faces within the gallery. This processing runs on Osvio's own infrastructure; photographs and embeddings are not sent to a third-party AI provider for this purpose.

The functionality is controlled per gallery by the photographer. It defaults to off for gallery categories Osvio treats as sensitive (such as intimate or boudoir photography), and to on for certain other categories, but in every case a face embedding is created for a gallery only once the photographer has completed the applicable consent or configuration step for that specific gallery.

Such data may constitute the processing of special categories of personal data or biometric data within the meaning of applicable law. The photographer decides whether, and for which galleries, this functionality is used, and is solely responsible for having an appropriate legal basis — such as the consent of the individuals depicted — for that processing. Osvio performs it only as a processor on the photographer's instructions and does not use face embeddings for its own purposes; see Section 12 of the Terms of Use.

Face embeddings associated with a photograph or gallery are deleted when the photograph or gallery is deleted.

3.6. Payment and commercial data

We may process information about the tariff plan, subscription status, payments, invoices, refunds, fees, and other data necessary for managing commercial relationships. Full payment card data, if processed by a specialized payment provider, should not be stored by Osvio, except as explicitly provided by the integration architecture and applicable security requirements.

3.7. Marketing and communication data

We may process email, name, subscription history, marketing preferences, campaign responses, and other data necessary for sending messages, if permitted by law or based on proper consent.

3.8. Funnel and analytics event data

We may record events describing how you interact with the Service before and after registration (such as viewing a pricing page, starting a trial, or a gallery being opened by a client), together with a user or visitor identifier, an associated gallery where relevant, and a timestamp. This data is used for product analytics and is retained for 14 months (see Section 11).

3.9. Feedback you submit

If you submit feedback, a bug report, or a feature request through the Service, we process the content of your message, the page it relates to, your account identifier, and related technical context. This data is retained for 24 months (see Section 11).

3.10. Bring Your Own Storage (external cloud connections)

A photographer may connect a third-party cloud storage account they control — currently Google Drive, with other providers planned — as the storage location for the original photo and video files they upload, a feature called Bring Your Own Storage ("BYOS"). This is optional and available only on certain plans.

Where BYOS is enabled for a gallery, Osvio is granted access limited to a single, app-specific folder it creates in the connected account, sufficient only to upload, read, and manage the files Osvio itself places there. Osvio does not access, list, or request access to any other file, folder, or data already in the connected account. Previews, thumbnails, watermarked versions, and everything a client gallery and its downloads actually serve continue to be stored and processed on Osvio's own infrastructure regardless of this setting — only the original file is redirected.

The connected account belongs to and remains under the control of the photographer, who may disconnect it at any time from Storage settings. Disconnecting revokes Osvio's access going forward and does not delete anything already stored in that account; conversely, content the photographer removes directly in their own connected account, outside Osvio, may become unavailable to Osvio (see Section 15 of the Terms of Use).

Deleting a photo or an entire gallery in Osvio — including the automatic removal of a gallery whose expiry has passed — moves the original file(s) Osvio placed in the connected account to that account's own trash, where the provider's usual retention applies; Osvio does not permanently delete them itself. An original still needed to complete a purchased Memory Vault preservation is kept until that copy finishes.

The Google-specific disclosures for this feature, and for "Sign in with Google", are in Section 3.11.

3.11. Google user data

This section explains how Osvio accesses, uses, stores and shares data it receives from Google — through "Sign in with Google" and through the optional Google Drive connection described in Section 3.10 ("Google user data"). It applies to everyone who signs in with Google (photographers, clients and Memory Vault users) and to photographers who connect Google Drive.

What Google user data we access

• Sign in with Google: using the basic openid, email and profile scopes, your name, email address, Google account identifier and profile picture URL. This sign-in does not give Osvio access to your Gmail, Contacts, Calendar, Google Drive or any other Google service.
• Google Drive (optional, photographers only): the single scope https://www.googleapis.com/auth/drive.file, which lets Osvio see only the folder and files that Osvio itself creates in your Drive. We also read the connected account's email address and identifier, and its storage quota and usage, and we store the OAuth tokens that keep the connection working.

How we use Google user data

Only to provide and improve the user-facing features you requested: to sign you in and create or recognize your Osvio account; to upload, read and manage the original files you choose to store in your own Drive; to show which Google account is connected and how much space is free, so that uploads do not fail; and to keep the connection active. We do not use Google user data for any other purpose.

Who we share Google user data with

We do not sell Google user data, and we do not transfer or disclose it to third parties except (a) to infrastructure providers acting on our behalf solely to operate these features (see Section 9); (b) where needed to comply with applicable law or a binding legal request; (c) to protect the security of the Service and prevent fraud or abuse; or (d) in a merger, acquisition or sale of assets, in which case the recipient must continue to honor this Policy and we will notify you. Photos you place in a gallery are shown to the people you choose to share that gallery with; that is your content and your sharing choice.

Limited Use

Osvio's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use or transfer Google user data for targeted, personalized, retargeted or interest-based advertising; we do not sell it or provide it to data brokers or information resellers; we do not use it to determine creditworthiness or for lending purposes; and we do not use it to build databases unrelated to the features described above. Our personnel do not read the content of your Drive files except where you ask for support, where needed for security or abuse investigations, or where required by law.

Google user data is not used to develop, improve or train generalized or non-personalized artificial intelligence or machine-learning models. Where face detection and grouping is enabled for a gallery (Section 3.5), it runs on Osvio's own infrastructure, per gallery, solely to provide that feature to the photographer; photographs and embeddings are not sent to any third-party AI provider for this purpose.

How we protect it

Google OAuth tokens are stored encrypted at rest, are never returned in API responses, and are transmitted only over encrypted (TLS) connections. Access to production systems is restricted to what is necessary to operate the Service.

Retention and deletion

• Sign-in data (name, email, Google account identifier, profile picture URL) is kept while your Osvio account exists and is deleted when the account is deleted.
• When you disconnect Google Drive in Storage settings, Osvio revokes the grant with Google and erases the stored tokens right away. The connection record (the connected account's email and the Osvio folder reference) remains until you remove the connection or delete your account. Files already in your Drive stay there and under your control (see Section 3.10).
• You can also revoke Osvio's access at any time from your Google Account permissions page (myaccount.google.com/permissions).
• To ask for your Google user data to be deleted, write to [email protected]. Deleted data may remain in backups for up to 28 days (Section 11).

Changes

If we change how Osvio accesses, uses, stores or shares Google user data, we will update this Section and tell you in the Service or by email before the change takes effect, and we will ask for your consent where required, including any new Google permission.

4. Purpose of personal data processing

We may process personal data for:

• creating and managing an account;
• providing, supporting, and developing Osvio functionality;
• uploading, storing, processing, delivering, and displaying content;
• providing access to galleries and managing access rights;
• keeping a photographer’s records of their clients: contact details and the history of their interaction with galleries;
• operating AI, analytics, search, and automation features, if available;
• processing payments, subscriptions, fees, invoices, and other transactions;
• ensuring security, preventing fraud, abuse, and unauthorized access;
• responding to inquiries and providing technical support;
• analyzing usage and improving the Service;
• sending service messages;
• marketing communications based on a proper legal basis;
• complying with legal obligations and protecting Osvio's rights.

5. Legal grounds for processing

For individuals subject to the GDPR or other similar legislation, we process personal data depending on the situation on one or more of the following grounds:

• performance of a contract or taking steps prior to entering into a contract;
• legitimate interest, provided that such interest is not overridden by the rights and freedoms of the data subject;
• consent, if required by law;
• compliance with a legal obligation;
• protection of vital interests — only in cases provided for by applicable law.

Where Osvio acts as a data processor on behalf of a professional user, that user, as the data controller, is responsible for determining and having the appropriate legal basis for the initial collection of the data and its transfer to Osvio.

6. Photographers, clients, and role distribution

Photographers are the controllers of their clients' data. A photographer or other professional user who creates a gallery, determines its purpose, uploads photos, and sets access rules decides why and how the personal data of their clients and of the people in their photos is processed. For that data — photos, client records and gallery-visitor data — the photographer is the data controller and Osvio is the processor, providing the infrastructure for storing, processing and delivering it on the photographer's documented instructions (see the Data Processing Agreement).

Osvio is a controller only for its own processing. Osvio is the data controller solely for the data it processes for its own purposes: account and sign-in data, billing, security and abuse prevention, product analytics and communications with users. Osvio does not review the content users upload and is not responsible for the content users upload or for how photographers collect, use or share their clients' data, except where applicable law provides otherwise.

7. AI and automated processing

Osvio may use algorithmic or AI tools to analyze photos, automatically sort, search, group, recognize objects or faces, generate recommendations, analytics, and other functions. Face-related processing described in Section 3.5 runs on Osvio's own infrastructure, not on a third-party AI provider.

We do not use such features for decision-making that have legal consequences for an individual or similarly significantly affect them, unless otherwise explicitly stated for a specific feature and the necessary safeguards are provided.

If a certain AI feature requires additional consent, special notice, or a data protection impact assessment, the corresponding mechanism must be implemented before its use.

8. Cookies and similar technologies

Osvio may use cookies, local storage, pixels, SDKs, and other similar technologies for:

• ensuring the operation and security of the Service;
• saving session and user settings;
• usage analytics;
• measuring the effectiveness of marketing campaigns;
• other purposes for which the user is provided with the necessary information and, if required, the ability to give or withdraw consent.

Necessary cookies may be used without separate consent if permitted by applicable law. Optional analytical, advertising, and other similar technologies are used only in accordance with applicable consent requirements.

9. Who we may disclose data to

We may disclose personal data to:

• hosting, cloud storage, and content delivery providers;
• payment providers;
• email, communication, and support service providers;
• identity or sign-in providers, where you choose to sign in with a third-party account;
• push notification infrastructure, where you enable browser or device notifications;
• analytics, security, and monitoring providers, if such services are used;
• AI or other technology service providers — if such integrations are used;
• a third-party cloud storage provider a photographer chooses to connect (Section 3.10, Bring Your Own Storage), and only for the original files stored through that connection;
• the professional user who created the gallery, within the data related to the use of their gallery;
• competent government authorities or other persons if required by law;
• successors in the context of a reorganization, sale of business, or other corporate transaction.

The providers currently used for these purposes are: Cloudflare R2 (object storage and content delivery), Hetzner (server hosting), Resend (transactional and account-related email), Google (sign-in via Google OAuth, where you choose that option), and LiqPay, Monobank (Monopay) and Stripe (payment processing). Where you enable browser push notifications, we also use the push notification infrastructure of your browser or device provider (such as Google, Mozilla or Apple) to deliver those notifications. Where a photographer enables Bring Your Own Storage (Section 3.10), the original files for their galleries are additionally stored with the provider they connect — currently Google Drive — under that photographer's own account. Face detection and related processing (Section 3.5) runs on Osvio's own infrastructure and is not disclosed to a third party for that purpose. This list may change as Osvio's infrastructure evolves; material changes will be reflected in an updated version of this Policy.

10. International data transfer

Depending on the user's location and Osvio's infrastructure, personal data may be processed or stored outside Ukraine, the European Union, or the European Economic Area.

If applicable law requires a specific mechanism for international data transfer, Osvio uses appropriate safeguards, including adequacy decisions, standard contractual clauses, or other legal mechanisms available under applicable law.

11. Data retention

We retain personal data no longer than necessary for the purposes for which it was collected, unless a longer period is required by law, contract, or legitimate security and rights protection needs. The table below sets out the concrete periods currently in force for the main categories of data described in Section 3.

Archived content should not be automatically deleted solely due to the expiration of the archiving period unless specific product conditions provide otherwise. After deletion, data may remain in backups for the period stated above, after which it is deleted or becomes inaccessible according to backup procedures.

12. Security

We implement technical and organizational measures aimed at protecting personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

Such measures include access control, authentication (with optional two-factor authentication for accounts), encryption of data during transmission, encryption at rest of third-party OAuth tokens (such as Google Drive tokens), access restriction based on necessity, logging, and other appropriate mechanisms. However, no system can guarantee absolute security.

13. Your rights

Depending on applicable law, you may have the right to:

• to obtain information about the processing of your personal data;
• to access the data;
• to request correction of inaccurate data;
• to request deletion of data in cases provided by law;
• to request restriction of processing;
• to object to certain types of processing;
• to receive data in a portable format, if GDPR applies;
• to withdraw consent if processing is based on consent;
• to lodge a complaint with the competent data protection authority.

To exercise your rights, contact us at: [email protected]. We may ask you to verify your identity before fulfilling the request.

14. Marketing communications

You can opt out of marketing email communications at any time via the unsubscribe link or by contacting us. Opting out of marketing communications does not affect service or transactional messages necessary for account operation or contract fulfillment.

15. Children's data

The Service is not intended for independent use by children in cases where parental or legal guardian consent is required under applicable law.

Photos uploaded by professional users may contain images of children. Osvio does not review uploaded content and does not determine whether it shows children. The photographer who uploads or shares such photos is solely responsible for having the proper legal basis, any required consent of parents or legal guardians, and for meeting every other legal requirement for that content. Osvio processes such content only as a processor on the photographer's instructions.

16. Obligations of professional users

A professional user who uploads personal data of others to Osvio is solely responsible for the content they upload and for ensuring the necessary legal grounds, notices, consents, or other requirements for the lawful collection and processing of such data, including the consent of individuals depicted in their photos. Osvio does not verify or endorse user content and is not responsible for the legality of that content or for users' compliance with data protection law in their own activities. See also Section 11 of the Terms of Use.

The user must also properly configure access to galleries, passwords, and other security mechanisms if the appropriate level of protection is required for specific content.

17. Account and content deletion

A user may request the deletion of their account or content through the available Service features or support. Deletion may be restricted if certain data needs to be retained for legal obligations, dispute resolution, security, or other legitimate purposes.

Content deletion by the user may affect the access of their clients or other individuals to the respective galleries.

18. Changes to this Privacy Policy

We may update this Policy due to changes in functionality, legislation, infrastructure, or data processing practices. The current version is published on the relevant Osvio page with the date of the last update indicated.

If the changes are significant, we may additionally notify users through the Service or by other appropriate means. If we change how Osvio accesses, uses, stores or shares Google user data (Section 3.11), we will notify affected users in the Service or by email before the change takes effect.

19. Contacts