Privacy Policy

Heirloom Folio is made and run in Portugal. Write to hello@heirloomfolio.com about anything in this policy.

We decide how data about photographers who use Heirloom Folio and visitors to heirloomfolio.com is used, so for that data we are the controller. The photos in a gallery and the details of the people who open it belong to the photographer: they are the controller, and we handle that data only on their behalf (see Galleries and their visitors).

We keep:

• your email address, and your password in a form nobody can read — or, if you sign in with Google, the name, email address and picture Google shares with us;
• your studio: its name and link, logo, colours, typefaces, homepage, email wording, the contact details you add and any domain you connect;
• what you put in your galleries: photos and videos, titles, dates, places, names, letters and settings;
• a record of activity in your studio, such as when galleries were published, visited and downloaded from, so we can show you your numbers and keep the service healthy.

We use it to run your account and deliver your galleries (our agreement with you), to keep the service secure and working, and to answer you when you write to us (our legitimate interests).

When a photographer shares a gallery, we store it and show it for them. The photographer decides what is uploaded and who can open it, and we process that data only to provide the gallery, as set out in our Terms.

If you are a client or a guest, depending on the gallery’s settings we may record the email address and name you enter to open it, the photos you mark as favourites, what you download and when you visit. A cookie remembers your access to that gallery for up to 400 days. The photographer can see this. Questions about a gallery are best sent to the photographer first; we will help them answer.

Our hosting and security providers see your IP address and browser details, which are kept for a limited time to keep the service safe and running. If you allow it, we also use Google Analytics on our own pages to understand how people find and use Heirloom Folio — see Cookies.

If you use Import from your website, we read the public pages of the address you enter. To choose your colours and typefaces, we may send that page’s text and styles — never your galleries — to Claude, by Anthropic. We count these imports for 24 hours to limit how often they can run.

We send the emails the service needs, such as confirming your email address or resetting your password, from noreply@heirloomfolio.com. We don’t send marketing without your permission.

• Lovable, on infrastructure by Supabase — hosting the app, the database, sign-in and service emails.
• Cloudflare — storing photos in the EU, delivering them quickly, DNS and security.
• Google — Sign in with Google if you use it, Google Analytics if you allow it, and our own email.
• Anthropic — the website import, and only when you use it.

They handle data under their data processing terms. Where data leaves the European Economic Area, it is protected by an adequacy decision, such as the EU–US Data Privacy Framework, or by the European Commission’s standard contractual clauses.

We don’t sell personal data, and we don’t use photos to advertise or to train AI.

• Your account and studio: until you delete them. Deleting your account removes your studios, galleries and photos — except a studio you share with another member, which stays with them.
• Galleries and their visitor records: until the photographer deletes them.
• Security logs: for a limited time, then they are discarded.
• Google Analytics data: 14 months.
• Website import counts: 24 hours.

Our providers’ backups may hold copies for a short while after deletion.

You can ask us for a copy of your data, to correct or delete it, to limit or object to how we use it, and to receive it in a form you can take elsewhere. Where we rely on your consent, you can withdraw it at any time. Write to hello@heirloomfolio.com and we will answer within one month.

If you are unhappy with our answer, you can complain to a data protection authority — in Portugal, the Comissão Nacional de Proteção de Dados (cnpd.pt).

Heirloom Folio is for photographers working professionally and isn’t meant for anyone under 16. Galleries may contain photos of children; sharing them with care is the photographer’s responsibility.

Always on, because the service needs them:

• your sign-in, kept in your browser’s storage so you stay signed in;
• yyv_… cookies that remember your access to a gallery, for up to 400 days;
• cookies from Cloudflare that protect the site from bots, such as __cf_bm;
• small preferences, such as your cookie choice and the brand you opened last.

Only if you agree, and only on heirloomfolio.com’s own pages — never in galleries or on studio pages:

• Google Analytics cookies _ga and _ga_…, which tell visits apart, kept for 13 months.

Cookie settings

If we change this policy in a way that matters, we will update the date above and tell account holders by email before the change takes effect.