Legal
Privacy Policy
Last updated 23 September 2026 · Placeholder text, to be reviewed by counsel before launch.
Who we are
Shyreo is operated from Amsterdam, the Netherlands. This policy explains what personal data we process when photographers use Shyreo and when their clients view galleries.
Photographer accounts
Email address, studio name, billing details and the content you upload. We process this to provide the service (contract) and to send transactional email about your account and galleries.
Gallery visitors
When a client opens a gallery we store a random visitor identifier in a cookie so favorites and selections stay attached to that browser. We record gallery and photo views with a device type (mobile, desktop, tablet) and a date. We do not store IP addresses or user agents. If a client leaves a name or email to download or to sign in, that is shared with the photographer who owns the gallery.
Photographers as controllers
For client data inside galleries, the photographer is the data controller and Shyreo the processor. Our Data Processing Agreement applies.
Storage and location
Accounts, galleries, favorites and client data are stored in Ireland (Supabase, AWS eu-west-1), and the application runs in Dublin (Vercel). Photo files are stored on Cloudflare R2 in Western Europe, in private buckets, and served through short-lived signed URLs. Email is sent from Ireland (Resend).
Face search
Only in galleries where the photographer has switched it on, and has confirmed the people in the photographs were informed. The faces in those photographs are turned into numerical templates by Amazon Rekognition in Ireland (eu-west-1), kept per gallery and compared only within that gallery, never across galleries or studios. A visitor who searches agrees to it each time, before their photo is used. That photo is made smaller and stripped of its location data in their own browser, compared, and then discarded: it is not stored by us or by Amazon. Amazon may not use these images to improve its own services. The face templates of a gallery are deleted when the photographer switches face search off, when the gallery closes or is deleted, and those of a single photograph when it is removed. We keep a record that a search took place and how many photographs it found, which contains nothing biometric.
Retention
Deleted galleries are recoverable for 30 days and then permanently removed. Closing your account deletes your studio, galleries, files and client data within 30 days. You can export your data at any time from Settings.
Your rights
Access, rectification, erasure, portability, objection. Email privacy@shyreo.com. You may complain to the Autoriteit Persoonsgegevens.
Sub-processors
Supabase (database, auth, Ireland), Cloudflare (file storage, Western Europe), Vercel (hosting, Dublin), Amazon Web Services (face search, Ireland, only for galleries where it is switched on), Mollie (payments, the Netherlands), Resend (email, Ireland).