Privacy and cookies

1. Controller and contact details

The data controller is Pierquinto Manco, Via Eugenio Villoresi 5, 20143 Milan (MI), Italy, VAT no. IT14714130961. For information, to exercise your rights or report an issue, email hello@poseaway.com, with “Privacy” in the subject line.

This notice describes the current service under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

2. What data we use and why

• Customer enquiries: name, email, destination, travel date or period, group size, session type, preferences, notes and any chosen photographer. These help us assess availability, assign enquiries and prepare proposals.
• Accounts: verified email, identifiers, sign-in dates, session, preferred service language, IP address and browser information. The emailed link creates an account on first sign-in and provides access to requests associated with that address. We do not ask for a password.
• Photographers: name, email, city, service areas, languages, introduction, specialities, portfolio, sample images, professional details and offer (price, duration, included photos and delivery), material declarations and publication choices. These are used to review applications and manage profiles.
• Interactions: messages, proposals, financial terms and acceptances, dates and notifications, used to manage exchanges and support. Accepting a proposal does not record a payment.
• Surveys and analytics: answers and preferences, optional contact details; only with consent, a pseudonymous visit identifier, visit source and usage events to understand which journeys work. We do not sell data or automatically subscribe anyone to newsletters.
• Security: technical request data, errors and abuse prevention counters; we also use email and IP fingerprints to limit submissions. Hosting and email providers process technical metadata for delivery and security.

Provide only relevant information: avoid identity documents, health data, confidential information and unnecessary details about other participants. If you share photos of others, you must have the right to do so and inform them of their use for private review. We do not perform facial recognition. Accounts are intended for adults.

3. Legal bases and your choices

Enquiries, accounts, applications, messages, proposals and support are based on providing the service or taking pre-contractual steps at your request (Article 6(1)(b) GDPR). Security, abuse prevention and protection of rights are based on our legitimate interest in protecting the service and its users (Article 6(1)(f)), balanced against your rights. Legal obligations are based on Article 6(1)(c).

Optional analytics and authorised profile publication are based on consent (Article 6(1)(a)), which can be withdrawn. Reading this notice does not constitute consent to marketing or tracking. Without required data we cannot handle that request or sign-in; optional fields and declining analytics do not prevent use of the service.

4. Visibility, portfolios and importing

Requests and messages are accessible to the verified customer, assigned photographer and authorised administrators as needed to provide the service. Photographers cannot access other photographers’ enquiries. Profile text and offers become public only after separate photographer authorisation and administrative approval. Application images remain private: profile authorisation does not publish them.

If you import your portfolio, we read the public page you specify or the text you paste to prepare editable introduction fields. When AI assistance is available, we send Groq up to 6,000 characters of this text to suggest a professional name, introduction, location, service areas, languages and specialities. We remove recognisable email addresses and phone numbers before sending. We do not send private images, conversations or customer enquiries. Please avoid pasting confidential data or information about others.

This processing helps create the profile you request, under Article 6(1)(b) GDPR. It is optional: choose “I’d rather introduce myself” to avoid sending text to AI. You always control which fields to use and what to save. If assistance is unavailable, you can complete the form manually or reuse source text. We do not make solely automated decisions with legal or similarly significant effects.

External portfolio links lead to websites with their own privacy notices. When providing the photography service, the photographer may act as an independent controller for their own purposes and must provide their own notice.

5. Providers and transfers

We use technical providers and their subprocessors, with access limited to assigned tasks and applicable data processing agreements:

• Vercel: hosting, delivery and website and app functions; web request data, IP addresses and technical logs. Data processing agreement.
• Neon: database for accounts, sessions, profiles, enquiries and conversations, configured in Frankfurt. Data processing agreement.
• Upstash: storage of early submissions, applications and private images, surveys and authorised events. Data processing agreement.
• Resend (Plus Five Five, Inc.): delivery of sign-in emails and notifications; recipient address, content and delivery metadata. The sending region is Ireland, but emails and logs are stored in the United States; the provider states a standard retention period of 30 days. Data processing agreement and security and retention.
• Groq: optional analysis of portfolio text, when available. Processing may take place outside the EEA, including in the United States. Activating this feature requires Zero Data Retention configuration so that inputs and outputs are not retained for abuse monitoring or reliability. Technical usage metadata remains subject to the provider’s terms; we do not use training features or AI stores. Data processing agreement and transfer safeguards and data handling.
• Cloudflare: domain DNS management and related technical data; in the current configuration, website traffic does not pass through its proxy. Data processing agreement.

The database’s European location does not rule out processing outside the EEA for hosting, email, support and subprocessors, including in the United States. Transfers rely on applicable adequacy decisions, including the Data Privacy Framework for certified recipients and covered processing, or on standard contractual clauses and any necessary supplementary measures. You can request information and copies of safeguards from the controller.

Authorised staff, advisers for professional needs and authorities where required by law may also access data. We do not disclose enquiries, emails or conversations to the public.

6. How long we retain data

• Accounts and profiles: for the active relationship; on closure, we delete or anonymise data no longer needed. Inactive accounts are reviewed after 24 months without interactions.
• Applications not activated and review images: up to 12 months after the last contact, unless you request earlier deletion.
• Identifiable enquiries, conversations and surveys: up to 24 months after the last interaction. If needed for an obligation or a specific dispute, we retain only relevant data for the applicable legal period.
• Analytics events: up to 180 days, then deletion or non-identifiable aggregation. Providers’ technical copies follow their own deletion and backup cycles.
• Sign-in links expire after 10 minutes and can be used once; sessions last up to 7 days and may renew during use. Temporary request submission counters expire after one hour and are removed on subsequent submissions.

Application archive review and deletion are also managed manually: the periods above are retention limits, not a promise of automatic deletion. You can request deletion before they expire, subject to GDPR limitations.

7. Cookies and device storage

The website and app use separate storage, so each may ask for your preferences. Essential cookies enable sign-in and remember choices; analytics starts only after “Accept analytics”. Choosing “Decline” is equally easy.

poseaway.* — essential

App authentication cookies, secured and not accessible to scripts for the session token. Sessions last up to 7 days and may renew.

lw_consent — essential

Remembers your accept/decline choice for 180 days on the relevant domain.

Photographer draft and administrator access — functional

The local key lw_photographer_onboarding_v1 stores a private draft on the device: recovery expires after 30 days and the draft can be deleted. lw_admin_token is reserved for administrators and remains in tab memory for the session.

lw_vid, lw_source, lw_segment — optional

With consent: a visit identifier stored in a cookie for 180 days, and visit source and segment in local storage until consent is withdrawn or browser data is cleared. These support internal analytics, not advertising.

You can reopen cookie preferences from the bottom of every page. Withdrawal stops future analytics and deletes identifiers on the device concerned; it does not make past use unlawful. You can also clear cookies and storage in your browser settings; deleting sign-in cookies requires you to sign in again. Google Analytics, advertising pixels, payments and calendar connections are not active. Fonts and illustrative images are served by the website.

8. Your rights

Where provided by Articles 15–22 GDPR, you can request access, rectification, erasure, restriction and data portability, object to processing based on legitimate interests and withdraw consent. Email hello@poseaway.com: we normally reply within one month, subject to justified extensions permitted by the GDPR. To protect you, we may verify your identity using proportionate methods.

You can lodge a complaint with the Italian Data Protection Authority or the competent authority where you live, work or believe an infringement occurred.

9. Updates

The date above identifies the current version. We will highlight material changes in the service and, where necessary, by email before new processing begins; we will obtain fresh consent if required. You can request clarification and previous versions using the contact details provided.