What Phototory collects, why, who else handles it, and how long it lasts. The short version: we hold your photographs and your email address for as long as it takes to give you your report and let you download it again, and then we delete them. The one thing we keep for longer is an address you have asked us to keep, by subscribing to our mailing list — and we only ever send you marketing if you ask.
1. Who this policy covers
This policy covers phototory.com and the Phototory service. It applies whether you buy a report or only try the free sample.
Phototory is operated by Deeko Global LLC, an Ohio limited liability company, of PO Box 37, Mason, OH 45040, United States.
Phototory is offered to people in the United States. We do not currently market or offer the service elsewhere, and it is not built to meet the requirements of privacy laws outside the United States.
2. What we collect
Photographs you upload, and the report generated from them.
Your email address, when you give one for report delivery, to sign in, through the contact form, or when you subscribe to our mailing list.
Payment records. Stripe processes the payment itself; we keep the transaction identifiers and the amount, and never receive your card number.
Contact form submissions: your name, email address, the topic you chose, and your message.
Basic technical information needed to operate and protect the service, including a one-way hash of the IP address a contact form submission came from. We store the hash, not the address itself.
If you redeem a promotion code that limits redemption to one per customer, a one-way hash of the delivery address you give, so a second attempt to redeem the same code can be recognized. We store the hash, not the address itself.
If you arrive through a partner’s referral link — a moving company, a university, an insurance agent, an accountant — the code from that link, and a random identifier for your browser so that the visit and any purchase that follows it can be counted as one. That identifier is a random value and nothing else: it is not your name, your address or an account, and it is never combined with any of them.
If you write a review for us, the U.S. state you tell us you are writing from, if you choose to share one — we never ask for a city, ZIP code or more specific location. Because a review is feedback rather than part of a report, it is not covered by the 30-day report retention window described in section 6.
If you accept analytics and advertising cookies, information about how you move through the site. If you decline, they are never set and none of it is collected.
In the categories California law uses, that is: identifiers, commercial information, internet or network activity, and visual information. We do not collect Social Security or government identification numbers, precise geolocation, biometric identifiers, or health information.
We collect all of it from you directly. We do not buy personal information about you from data brokers or anyone else.
3. What we do with it
Produce your report, deliver it, and let you download it again while it is retained.
Take payment, and keep the records of it that financial and tax rules require.
Reply when you contact us, and recognize repeated automated submissions so the contact form stays usable.
Apply the discount a partner’s referral link carries, and credit that partner for the referral so we can pay them what their agreement with us provides.
Enforce a one-per-customer limit on a promotion code, using the hash described in section 2, so a discount meant for a single use is not redeemed twice.
Send you marketing email — news, guidance and offers about Phototory — but only to an address that has been subscribed to our mailing list, and only for as long as it stays subscribed.
Subscribing is a thing you do on purpose. You enter your address in a subscribe form and confirm it, and that is the only way onto the list. Buying a report, creating an account, contacting us and downloading the free sample do not add you to it. We do not add addresses ourselves, buy them, or take them from anywhere else.
Every marketing email has an unsubscribe link, and using it stops them. It has no effect on email you need — a report you bought, a sign-in link, a receipt or a reply from us are sent because of something you asked for, and they keep coming.
Understand, with your consent, which parts of the site work and which do not.
We do not use your photographs or the contents of your reports for advertising, and we never disclose them to advertisers. Analytics events carry no photograph, no report line, and no email address.
4. Your photographs
Your photographs are sent to an automated image-analysis service operated by Anthropic, which identifies the items visible in them. No human at Phototory reviews your photographs as a matter of routine.
We do not use your photographs to train any model, and under the terms we use that analysis service on, material sent to it is not used to train its models either.
They are stored so your report can be regenerated and re-downloaded during the retention period, and are then deleted along with it.
If you are signed in and attach a photo to an item you added yourself — a picture of the item, a receipt — that photo is stored with your report and is not sent to the image-analysis service or anyone else for analysis.
A photograph of a room can contain more than furniture: documents, screens, pictures of people, personal effects. Everything visible in the frame is uploaded with it, so upload only what you are comfortable sending.
5. Who else handles your data
Anthropic, for automated analysis of uploaded photographs.
Stripe, for payment processing on one-time report purchases and extended-storage subscriptions.
Amazon Web Services, for storage of photographs and reports, delivery of email, and hosting.
Mailchimp, which holds our mailing list and sends marketing email, if you have subscribed to it. It receives your email address and whether you opened or clicked; it never receives your photographs or anything from your report.
Cookiebot, which presents the cookie banner, records your consent choice, and keeps a record of it so it can be honored on your next visit.
Google, for Tag Manager, which loads on every page and decides which measurement tags may run, and for Analytics, only if you accept analytics cookies.
Meta, only if you accept advertising cookies.
Neither Google Analytics nor Meta receives photographs, report contents, or your email address.
Each of these handles your information to provide the service described above, under contract with us, and none is permitted to use it for their own unrelated purposes.
6. How long we keep things
Photographs and reports: 30 days from your first upload, even if more photographs are added to the same report later. At that point the report can no longer be reached and the record of it is deleted. If an active extended-storage subscription is attached to the account that owns them, they are kept while it runs. If that subscription is canceled, a further 30 days runs from the cancellation date and the same thing happens then.
Erasure completes within 7 days after that. The stored files are held briefly after deletion so an accidental deletion can be undone, and are then erased. So everything is gone within 37 days of your first upload at the latest, and within 7 days of whichever later date applies to you.
Contact form messages: up to 12 months, so a conversation outlives the report it was about.
Sign-in links: minutes. They expire shortly after being sent, can be used only once, and are stored hashed, so the stored value cannot be used to sign in.
Account records: until you ask us to delete the account.
Mailing list: until you unsubscribe, and then only a record that the address unsubscribed, so we do not mail it again by accident.
The cookie recording whether you said you are a renter, a homeowner or a short-term rental owner: 30 days from the visit you answered in.
Referral cookies: 30 days from the visit that set them. The record that a referred purchase happened is kept for as long as tax and payment records are, because it is what a partner is paid on — but it holds amounts and dates, never your address, your photographs or anything from your report.
The one-way hash used to enforce a one-per-customer limit on a promotion code: kept for as long as that code remains usable, and deleted once it is deactivated or expires. It holds no address, no photographs and nothing from a report.
Payment records: seven years, which is how long we keep financial records for tax purposes.
Deletion is enforced by a scheduled job, not by a promise. When the window passes, the photographs, the generated PDF and the underlying record are removed, and once erasure has completed nothing can be restored.
7. Cookies, analytics and advertising
Cookies strictly necessary to operate the site, which keep you signed in and remember your cookie choice, are always set.
If you follow a partner’s referral link we also set two cookies for 30 days: the partner’s code, and a random identifier for your browser. They exist so the discount you were sent for still applies when you come back to buy, and so the partner is credited. They are ours alone, are not shared with anyone, and do not follow you to other sites — they are neither analytics nor advertising, and they are not used to build a profile of you.
If you dismiss a promotional banner or pop-up, we set a cookie for up to 90 days remembering which ones, so we do not show you the same one again. It identifies the promotion, not you, and like the referral cookies above it is ours alone and is never shared with anyone.
If you tell us whether you are a renter, a homeowner or a short-term rental owner, we set a cookie for 30 days remembering which, so the site can show you the version of the product written for you and does not have to ask again. It records the answer you gave and nothing else. Like the cookies above it is ours alone, is never shared with anyone, does not follow you to other sites, and is not used to build a profile of you. You never have to answer — nothing on the site is behind that question.
Analytics and advertising cookies are set only after you accept them.
Our cookie banner is provided by Cookiebot, which records your choice and enforces it. A tag manager, Google Tag Manager, loads on every page and sets no cookies of its own; it is told at the outset that analytics and advertising storage are denied, and holds those tags back until you accept. The advertising pixel is not loaded at all until then.
Declining is presented as plainly as accepting, and you can change your mind at any time by choosing Cookie settings at the bottom of any page.
Because these are off until you turn them on, you do not need to send us an opt-out signal to stay out of them. If you have a Global Privacy Control setting enabled in your browser, leaving analytics and advertising cookies declined achieves the same result.
8. Selling and sharing your information
We do not sell your personal information for money, and we never sell or disclose your photographs or report contents to anyone for advertising.
If you accept advertising cookies, information about your visit to this site is shared with Google and Meta so that we can measure advertising. Some state privacy laws, California's in particular, define selling and sharing broadly enough that this can count as sharing for cross-context behavioral advertising.
That is the only thing on this site that could fall under those definitions, it is off unless you switch it on, and switching it back off in the cookie notice stops it.
9. Your privacy rights
Depending on the state you live in, you may have the right to know what personal information we hold about you and to get a copy of it, to have it corrected, to have it deleted, and to opt out of its sale or sharing or of targeted advertising.
We will not deny you service, charge you a different price, or give you a worse experience for exercising any of these rights.
You can leave the mailing list at any time, wherever you live and whatever rights your state gives you, using the unsubscribe link in any marketing email or by asking us through the contact form. We do not ask for a reason.
To make a request, use the contact form at /contact and choose Privacy or data request, or write to us at the postal address below. We will ask you to confirm control of the email address involved, so that nobody else can make a request about your information. An authorized agent may make a request for you, and we will ask for proof that you authorized them.
We respond within 45 days. If a request is complex we may take up to another 45 days, and we will tell you within the first 45 if that happens. If we refuse a request you can ask us to reconsider by replying to our response, and we will answer that appeal in writing.
Because reports are deleted automatically after 30 days and erased within 37, a deletion request about an old report may find nothing left to delete. We will tell you if that is the case.
If you ask us to delete the fingerprint that enforces a one-per-customer promotion limit, we do — without a carve-out for the deletion right — and the effect is that the same address could redeem that code again.
10. Security
Photographs and reports are stored encrypted, and are not publicly listed or browsable.
A report link contains a long random identifier and is not guessable, but it is not password-protected either: anyone you forward it to can open the report while it exists. Treat it like a document, not a login.
Sign-in links and the stored fingerprints of IP addresses are hashed, so the stored values cannot be reversed into a usable credential or an address.
No service can promise perfect security. If a breach affects your personal information we will notify you, and the authorities we are required to notify, as promptly as the law requires.
11. Children
Phototory is not intended for children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has sent us information, contact us and we will delete it.
If you are between 13 and 18, use Phototory only with the involvement of a parent or guardian.
12. Changes to this policy
If this policy changes materially we will say so on the site, and by email where we hold your address and the change affects you. The effective date at the top of this page always reflects the current version.
13. Contacting us
Use the contact form at /contact and choose Privacy or data request. It reaches us directly and we reply to the address you give.
You can also write to us at: Deeko Global LLC, PO Box 37, Mason, OH 45040, United States.