Legal
Data Processing Agreement
Last updated 23 September 2026 · Placeholder text, to be reviewed by counsel before launch.
Parties
This agreement is between you (the photographer or studio, the controller) and Shyreo (the processor) and forms part of the Terms of Service.
Subject matter
Processing of personal data of your clients and gallery visitors: names, email addresses, favorites, selections, comments, downloads and view statistics. Where you switch on face search for a gallery, also biometric data: face templates of the people in its photographs, and the face of a visitor who searches.
Face search
Switching face search on for a gallery is your instruction to process the faces in it, and your confirmation that the people photographed were informed and that you have a lawful basis for it under article 9 GDPR. Visitors give their own explicit consent before each search. Templates are kept per gallery, are never compared across galleries, and are deleted when you switch it off or the gallery closes or is deleted.
Instructions
Shyreo processes this data only to provide the service and on your documented instructions given through the product.
Security
Private storage buckets, signed URLs, encrypted transport, role-based access, audit logging, and EU hosting.
Sub-processors
Supabase, Cloudflare, Vercel, Amazon Web Services (face search only), Mollie and Resend, all processing in the European Union. We notify you of changes and you may object.
Assistance
We help you respond to data subject requests: export and deletion of client data are available in the product.
Deletion
On termination, data is deleted within 30 days unless law requires retention.
Audits
On request we provide the information necessary to demonstrate compliance.