Photobook Noir ("Photobook Noir," "we," "us," or "our") respects your privacy. This Privacy Policy explains what personal data we collect, why we use it, when we disclose it, how long we retain it, and the rights available to you when you use the Photobook Noir mobile or desktop application and its related online services (collectively, the "App").
For purposes of the General Data Protection Regulation ("GDPR"), Photobook Noir is the controller of the personal data described in this policy. You can contact us using the details in Section 12.
1. Scope and Data-Minimization Principles
Most App features work locally on your device and do not require an account. Signing in is optional and is required only for features that use AI credits.
We collect only the information reasonably necessary to operate, maintain, secure, and improve the App and to provide features you choose to use. We do not sell personal data, use it for targeted advertising, or disclose it to data brokers.
2. Personal Data We Collect
2.1 Crash and diagnostic data
When the App encounters a technical problem, our crash-reporting provider may receive diagnostic information such as crash logs, device and operating-system information, App version, and technical details about the failure. We use this information to identify and fix defects. Crash data is not combined with data from other sources for tracking, and we do not access your device's advertising identifier (IDFA).
2.2 Product usage data
We collect limited product analytics about how App features are used. This may include events such as creating a project, importing or staging images, starting or completing an export, or requesting an AI plan, together with event counts, App version, and platform.
This data is associated only with a random identifier generated on your device. Although we do not use that identifier to identify you, data associated with an identifier may be considered pseudonymous personal data under some laws. We do not include your name, email address, account identifier, project names, file paths, photos, or AI instructions in product analytics, and we do not combine analytics data with account data or data from other sources.
2.3 Newsletter information
If you subscribe to news and product updates, we collect your email address for that purpose. We do not associate your newsletter subscription with other App data or disclose your email address to third parties for their own marketing.
2.4 Account and authentication data
If you choose to sign in with Apple, Apple provides us with an identity token containing a pseudonymous user identifier and, if you choose to share it, your email address. We use this information to create and maintain your account and associate your AI credit balance with it. The App stores a session token securely in your device's keychain. We never receive or store your Apple ID password.
2.5 AI credit and purchase data
If you purchase or use AI credits, we record the Apple product identifier and transaction identifier for redeemed credit packs, your current credit balance, and credit deductions or refunds for individual requests. Apple processes the payment. We do not receive your payment-card or bank-account details.
2.6 AI request data
When you initiate an AI-assisted feature, such as AI Auto-Stage, the App sends your written instructions and limited metadata about the selected photos to our servers. That metadata may include:
- File names;
- Image dimensions;
- Capture dates;
- Location metadata embedded in the photos;
- Captions; and
- Quality or subject-detection scores computed on your device.
We forward this request data to an AI service provider to generate the requested result. We also use your pseudonymous account identity to account for the credits used by the request.
Your photos and other media are not uploaded. They remain on your device. Only the request data listed above is transmitted, and only when you choose to run an AI-assisted feature. Before using such a feature, you may remove embedded location metadata or rename files if you do not want that information included in the request.
2.7 Communications
If you contact us for support or otherwise communicate with us, we receive the information you provide, such as your email address, message, and any diagnostic details or attachments you choose to send.
3. How and Why We Use Personal Data
We use personal data for the following purposes:
- To create, authenticate, and manage accounts;
- To process AI requests and return generated results;
- To redeem purchases, maintain credit balances, deduct credits, and refund credits for failed requests;
- To operate, maintain, troubleshoot, and improve the App;
- To detect and prevent fraud, abuse, and security incidents;
- To respond to support requests and other communications;
- To send news and product updates when you have subscribed; and
- To comply with applicable law and enforce our legal rights.
If the GDPR applies, we rely on the following legal bases:
- Performance of a contract: to provide account, purchase, credit, and AI services you request;
- Legitimate interests: to operate, secure, troubleshoot, and improve the App, prevent fraud and abuse, and respond to non-marketing communications, where those interests are not overridden by your rights;
- Consent: to send newsletters and where we otherwise ask for consent. You may withdraw consent at any time without affecting processing that occurred before withdrawal; and
- Legal obligation: to retain or disclose information when applicable law requires us to do so.
4. When We Disclose Personal Data
We disclose personal data only as described in this policy:
- Apple provides Sign in with Apple and in-app purchase services;
- Our AI service provider processes AI request data to generate the result you request;
- Crash-reporting and analytics providers process diagnostic and product usage data;
- Our cloud hosting provider stores and processes account, credit, purchase, and AI request data on our behalf; and
- Professional advisers, regulators, courts, law enforcement, or other authorities may receive information when reasonably necessary to comply with law, protect rights and safety, or establish, exercise, or defend legal claims.
Service providers acting on our behalf are contractually required to process personal data only for the services we request and to protect it appropriately. They may not use it for their own advertising or independent marketing purposes. You may request our current list of service providers by contacting us.
We may also transfer information as part of a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets. Any recipient in such a transaction must handle personal data consistently with this policy and applicable law.
5. International Data Transfers
Account and AI credit data is stored in the European Union. Some providers may process personal data outside the EU or European Economic Area, including in the United States. In particular, this may occur for AI request data when you initiate an AI-assisted feature and for crash-reporting or product analytics data.
Where required, we use safeguards recognized by applicable data-protection law, such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with supplementary measures where appropriate. You may contact us for more information about the safeguards relevant to your data.
6. Data Retention and Account Deletion
We retain personal data only for as long as reasonably necessary for the purposes described in this policy, including to provide the App, maintain security and transaction records, resolve disputes, and meet legal, tax, accounting, or reporting obligations. Retention periods depend on the type of data, why it was collected, and applicable legal requirements.
Account data, credit balances, and associated purchase and usage records are generally retained while your account remains open. You may delete your account from within the App. Account deletion permanently removes your account data and any remaining credit balance, except for limited information we must retain to comply with law, prevent fraud, resolve disputes, or enforce our agreements. You may also request deletion by contacting us.
7. Data Security
We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures include encryption in transit and appropriate protections for stored data. Authentication is handled by Apple, and the App stores its session token in your device's secure keychain.
No method of transmission or storage is completely secure. We therefore cannot guarantee absolute security. If you believe your account or data may have been compromised, contact us promptly.
8. Your Privacy Rights and Choices
8.1 General choices
You may choose not to create an account or use AI-assisted features. You may unsubscribe from newsletters using the unsubscribe method in the message or by contacting us. You can delete your account from within the App.
8.2 GDPR rights
If the GDPR applies to you, subject to applicable conditions and exceptions, you may have the right to:
- Access your personal data and receive information about its processing;
- Correct inaccurate or incomplete personal data;
- Request deletion of your personal data;
- Restrict certain processing;
- Receive certain data in a portable format;
- Object to processing based on legitimate interests;
- Withdraw consent at any time; and
- Lodge a complaint with your local data-protection authority.
8.3 California privacy rights
If you are a California resident and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), applies, you may have the right to:
- Know the categories and specific pieces of personal information we collect, use, and disclose;
- Request correction or deletion of personal information;
- Obtain a portable copy of personal information; and
- Exercise your rights without discriminatory treatment.
We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined by the CCPA. We do not use or disclose sensitive personal information to infer characteristics about you or for purposes that require offering a right to limit under the CCPA.
To exercise a privacy right, email us at office@photobook-noir.com and describe your request. We may need to verify your identity before completing it. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and identity verification. We will respond within the period required by applicable law. If we cannot fulfill all or part of a request, we will explain the reason, subject to legal restrictions.
9. Tracking and Advertising
We do not access the IDFA, track your activity across other companies' apps or websites, combine App data with third-party data for advertising or profiling, or share data for targeted advertising. Based on these practices, the App does not request permission through Apple's AppTrackingTransparency framework. If our practices change in a way that requires permission, we will request it before engaging in that activity.
10. Children's Privacy
The App is not directed to children under 13, or to anyone below the minimum age required to consent to data processing in their jurisdiction. We do not knowingly collect personal data from children who are not legally permitted to provide it. If you believe a child has provided personal data to us improperly, contact us so we can investigate and delete it as required.
11. Changes to This Policy
We may update this Privacy Policy to reflect changes to the App, our data practices, or applicable law. We will post the revised policy in the App or on our website and update the effective date. Where required by law, we will provide additional notice or request consent before a material change takes effect.
12. Contact Us
For questions about this policy or to exercise your privacy rights, contact:
Photobook Noir
Email: office@photobook-noir.com
Website: www.photobook-noir.com