Privacy policy
Effective 5 September 2026
1. Information we process
Pici processes photographer account details, including names, studio names, email addresses, password hashes, subscription status, and service activity. Photographer-provided gallery data may include client names, photographs, gallery passwords, expiry settings, and favourites recorded through a client’s browser. Legacy galleries created before client-email collection was removed may still retain a client email address.
2. How we use information
We use this information to operate accounts, secure private galleries, store and deliver photographs, enforce plan limits, record client favourites, process subscriptions, prevent abuse, troubleshoot the service, and comply with legal obligations.
3. Photographer responsibilities
Photographers determine which client information and photographs are uploaded to their galleries. They are responsible for providing any notice and obtaining any consent required for that processing. Clients should contact their photographer first about a specific gallery or photograph.
4. Service providers
We may use infrastructure and storage providers to host Pici and Paystack to process paid subscriptions. Paystack receives payment information directly; Pici does not store complete card details. Providers may process information only as needed to supply their services or meet legal obligations.
5. Cookies
Pici uses essential cookies for photographer sessions, gallery access, client favourites, security, and short-lived interface messages. These cookies are necessary for the requested service. Pici does not currently use advertising or behavioural-tracking cookies.
6. Security
We use access controls, password hashing, signed session data, private object storage, and encrypted HTTPS transport in production. No service can guarantee absolute security, so photographers should keep independent copies of their original photographs and use strong, unique passwords.
7. Retention
We retain account and gallery information while it is needed to provide Pici, meet contractual or legal obligations, resolve disputes, and protect the service. Gallery expiry restricts access but does not delete stored files. Backup copies may remain for a limited period after primary data is removed.
8. Your rights
Subject to applicable law, including South Africa’s Protection of Personal Information Act, you may request access to or correction or deletion of personal information, object to certain processing, or raise a concern about how information is handled. Identity may need to be verified before a request is completed.
9. Cross-border processing
Infrastructure or service providers may process information outside the country where it was collected. Where required, we use appropriate contractual or legal safeguards for those transfers.
10. Contact
Privacy questions and rights requests can be sent to [email protected]. You may also lodge a complaint with the Information Regulator of South Africa.