1. Scope and Applicability

This Privacy Policy applies to personal information Viewdora collects or receives when you use or interact with the Services, including when you:

1. Create or manage an Account;
2. Use the Photographer dashboard or upload and manage galleries;
3. Access a gallery as a Client;
4. Purchase or manage a Subscription;
5. Participate in or sign up through a referral, affiliate, or ambassador program;
6. Visit our website or mobile applications; or
7. Contact Viewdora for support or other communications.

Third-Party Services may have their own privacy notices governing information they collect and process independently (e.g., AWS, Brevo, PostHog, Rewardful, Stripe, Stytch). This Privacy Policy does not control those independent practices. However, where Viewdora receives personal information from a Third-Party Service and processes that information for Viewdora’s own purposes, our processing is covered by this Privacy Policy.

Photographer-Provided Client Data: When a Photographer provides Client information or User Content through the Services, Viewdora may process that information on the Photographer’s behalf where applicable law treats Viewdora as a processor, service provider, or contractor. Viewdora may separately process certain Account, billing, security, fraud-prevention, analytics, support, and compliance information for its own purposes as described in this Policy.

2. Information We Collect

2.1 Information You Provide

We may collect information you provide directly, including:

Account and Profile Information: Your name, email address, organization or business information, Account preferences, and authentication-related identifiers or tokens used to create and secure your Account.

Billing and Subscription Information: Billing contact information, billing address, Subscription plan, payment status, transaction identifiers, invoices, refunds, chargebacks, and related transaction information. Full payment-card or bank-account credentials may be collected directly by our payment processor rather than by Viewdora.

Photographer Content: Photos, galleries, project names, file and image metadata, and other content uploaded or managed by Photographers. This material may include personal information relating to Clients or other identifiable individuals depicted in or associated with the content.

Original uploaded files may retain embedded image metadata, including EXIF metadata such as camera information, timestamps, and location information where present in the original file. Viewdora retains that metadata in original files and original-quality downloads but strips it from thumbnails and watermarked versions. Photographers should therefore understand that a recipient who receives an original quality download may also receive metadata embedded in the original image.

Client Information: Information associated with gallery access and interaction, such as name, email address, photo selections, comments, download activity, and related gallery activity. A Client’s name and email address are also added to a contact list that Viewdora maintains with its email provider, as described in Section 10.

Communications: Information contained in emails, messages, support requests, feedback, and other communications you send to us.

Referral and Ambassador Program Information: If you participate in our referral, affiliate, or ambassador program, we may collect your name, email address, payout information, tax-related information, referral links, promo codes, referred-customer activity, commission and reward history, payout status, submitted promotional-content links, social-media handles, records of your acceptance of the applicable program terms, and related communications.

2.2 Information Automatically Collected

When you use the Services, we may automatically collect:

Usage and Log Data: IP address, access dates and times, pages or screens viewed, actions taken within the Services, session information, error reports, and security or diagnostic logs. Our website host also logs each page request to viewdora.com (the time, the page address including campaign tags such as utm_source and any ad click identifier, the referring page, browser type, and country, but not your IP address or cookies), so we can count visits from our ads.

Device and Technical Information: Browser type, device type, operating system, application version, device or browser identifiers, and technical information used for security, troubleshooting, performance, and optimization.

Cookies and Similar Technologies: Information collected through cookies, pixels, local storage, SDKs, and similar technologies used for authentication, security, preferences, analytics, performance, and other purposes described in Section 5.

Referral Attribution Data: When you arrive through a referral or ambassador link or use an approved promo code, we may collect referral identifiers, referral links, promo-code usage, landing-page information, IP address, device information, timestamps, signup and conversion events, and related attribution information. Where Rewardful is used, the current program configuration uses a first-party referral cookie with a 30-day attribution period.

Analytics, Performance, and Session Replay Information: We use analytics technologies, including PostHog, to understand use of the Services, diagnose issues, measure performance, and improve functionality. PostHog may process IP addresses, device and browser information, interaction and event data, console logs, and, for identified Studio users, email address as a user property. In Studio, the sign-up event also records the campaign tags (such as utm_source) from the sign-up link, so we can measure which of our campaigns lead to sign-ups; it does not record ad click identifiers. Event data is retained for approximately 12 months.

Viewdora also uses PostHog session replay in Studio. Session recordings are retained for approximately 30 days. Since October 1, 2026, recordings mask all on-screen text and images as well as form inputs, so a recording shows page layout and interactions but not Client names, gallery photographs, or other on-screen content. Recordings made before that date may contain such content and are deleted when their 30-day retention ends. Autocapture is enabled on the marketing site and disabled in Studio, although other configured analytics and session-replay events may still be collected in Studio.

2.3 Information from Third Parties

We may receive additional information from:

Photographers: A Photographer may provide information about a Client when inviting the Client to a gallery, managing Client access, or otherwise using the Services.

Authentication Services: If you log in via Stytch or similar, we receive data as permitted by their privacy policies.

Payment Processors: Confirmation of payment or subscription status from Stripe or equivalent providers.

Service Providers: Cloud and infrastructure data from AWS or related partners.

Referral and Marketing Platforms: We may receive referral, affiliate, billing, subscription, payment, refund, chargeback, and commission-related information from third-party providers such as Stripe, Rewardful, PostHog, payment processors, analytics tools, and marketing platforms.

3. How We Use Information

We use personal information for the following purposes:

1. To create, authenticate, secure, and administer Accounts;
2. To provide, operate, maintain, and support the Services;
3. To host, organize, process, display, and deliver galleries and other User Content as directed by Photographers;
4. To process Subscriptions, payments, refunds, billing events, and related transactions;
5. To provide customer support and respond to inquiries;
6. To communicate service, security, policy, billing, and operational information;
7. To send marketing emails about Viewdora to Account holders, trial users, and Clients where applicable law allows it, as described in Section 10;
8. To understand usage, troubleshoot problems, measure performance, and improve the Services;
9. To administer referral, affiliate, and ambassador programs, including attribution, reward and commission calculations, payouts, fraud controls, and Program communications;
10. To detect, investigate, and prevent fraud, abuse, unauthorized access, security incidents, and violations of our Terms;
11. To establish, exercise, or defend legal claims and enforce our agreements; and
12. To comply with legal, tax, accounting, regulatory, and reporting obligations.

Viewdora does not use facial-recognition technology to identify individuals depicted in User Content and does not use customer User Content to train artificial-intelligence models.

Where the GDPR or UK GDPR applies, our legal basis depends on the processing activity and may include performance of a contract, compliance with a legal obligation, our legitimate interests or those of a third party, and consent where required. Where we rely on legitimate interests, those interests may include operating and securing the Services, preventing fraud, improving the product, measuring which of our ads and campaigns lead to visits and sign-ups, supporting users, protecting Viewdora’s legal rights, and, where the law allows it, telling Account holders, trial users, and Clients about Viewdora’s own products and services. Where we rely on consent, you may withdraw that consent as permitted by applicable law without affecting processing already lawfully undertaken. For marketing email, we rely on your consent where the law requires consent. Where the law allows us to send marketing email without asking first, we may instead rely on our legitimate interests. In that case we give you a clear way to refuse in every marketing email. You can object to marketing at any time, and we will stop.

4. Data Sharing and Disclosure

We do not sell your data. We may share data only as needed to operate our Services or comply with the law:

Service Providers: We may disclose Account, technical, usage, billing, Client, User Content, referral, and other information to service providers that perform functions for us, such as cloud hosting and content delivery, authentication, payment processing, referral tracking, payouts, email and communications, analytics, customer support, security, fraud prevention, and professional services. Where applicable, we use contractual or other safeguards appropriate to the provider’s role and the information involved.

Photographer Sharing: User Content and Client information may be made available to Photographers, Clients, or other recipients as directed or authorized by the Photographer through the Services.

Referral & Ambassador Program (Rewardful): If your signup was referred through our referral or ambassador program, we attach the referral identifier from your cookie (or your promo-code usage) to your Stripe billing customer record. Rewardful, which connects directly to our Stripe account, uses that identifier together with limited billing data (your email address, subscription status, and payment amounts, refunds, and chargebacks) to attribute the referral and calculate the referrer’s commission. Rewardful does not receive your photos, galleries, or client data, and referrers do not receive access to your Viewdora account or its contents. The referral identifier is retained with your billing records (see Section 6). If you join the program as a participant, the information you provide (name, email, payout details, tax information) is processed by service providers that help us operate the program, including our referral-tracking platform (Rewardful), payment processors, our payout provider (PayPal), tax compliance providers, analytics services, email platforms, and fraud-prevention tools, under their own terms; see the Referral & Ambassador Program Terms and Rewardful’s Privacy Policy.

Legal Obligations: We may disclose personal information where we reasonably believe disclosure is required by law or legal process, or is necessary to protect rights, safety, security, prevent fraud or abuse, enforce our agreements, or investigate unlawful activity.

Business Transfers: Personal information may be disclosed or transferred in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction, subject to applicable law.

Professional Advisers: We may disclose information to lawyers, accountants, auditors, insurers, and other professional advisers where reasonably necessary for professional services or legal compliance.

Sale, Sharing, and Targeted Advertising: Viewdora does not sell personal information for money. Viewdora may, however, disclose certain personal information to advertising and measurement providers, including Google and Meta, for advertising measurement, attribution, audience, and targeted-advertising purposes. Depending on the applicable law, these disclosures may constitute “sharing” or processing for targeted advertising even though Viewdora does not receive money in exchange for the information.

Information disclosed for these purposes may include IP address, device and browser information, cookie or advertising identifiers, page or screen activity, interactions with Viewdora, conversion and event information, and other measurement information generated through the applicable advertising or analytics technology. Google Analytics runs on viewdora.com and on the Studio sign-in and sign-up pages (the sign-in page, the one-time code page that follows it, and the sign-up page), in each case only after the visitor accepts analytics cookies, and in Studio it records page views and a sign-up event when an account is created. Google Signals may associate eligible measurement information with users’ Google accounts according to Google’s settings and policies. Meta Pixel may receive event information from viewdora.com and from the Studio sign-in and sign-up pages, including a registration event when a Studio account is created, in each case only after the visitor accepts advertising cookies. The Google tag for Google Ads loads on viewdora.com and on the Studio sign-in and sign-up pages before the visitor makes a cookie choice. Until the visitor accepts advertising cookies it runs in Google Consent Mode with advertising storage denied and sends Google only cookieless pings (page address, IP address, browser information, and ad-click information with the click identifier redacted). After the visitor accepts, Google Ads may also receive the ad click identifier, first-party Google Ads cookies, and a sign-up event. If the visitor declines, or the browser sends a Global Privacy Control or Do Not Track signal, Google Ads receives nothing. Google ad personalization (remarketing) is not enabled. Meta Advanced Matching is not enabled. Neither Google Analytics, Google Ads, nor the Meta Pixel is used on Client gallery pages, Client download pages, or elsewhere in the signed-in Studio application.

Where applicable law gives you a right to opt out of targeted advertising or qualifying sharing, you may exercise that right through Viewdora’s Privacy Choices mechanism described in Section 9.

Where Viewdora engages a service provider or contractor to process personal information on Viewdora’s behalf, Viewdora uses contractual or other safeguards appropriate to the provider’s role and requires the provider to process the information consistently with the applicable agreement and legal requirements. Independent third parties may process information under their own terms and privacy notices.

5. Cookies and Tracking Technologies

We use cookies and similar technologies, which may include browser cookies, local storage, SDKs, pixels, or comparable technologies, for purposes such as:

Strictly Necessary and Security Technologies: To authenticate users, maintain sessions, secure Accounts, prevent fraud, remember essential settings, and provide requested functionality.

Analytics and Performance Technologies: To understand use of the Services, measure performance, diagnose technical issues, and improve functionality.

Referral Attribution Technologies: To attribute signups and purchases to approved referral or ambassador links or promo codes, administer rewards and commissions, measure Program performance, and prevent referral fraud. Where Rewardful is used under the current Program configuration, the referral cookie has a 30-day attribution duration.

Where applicable law requires consent before a non-essential cookie or similar technology is used, Viewdora will obtain the required consent and provide a mechanism to manage or withdraw those preferences. You may also be able to control certain technologies through your browser or device settings.

Additional details about the technologies used, their providers, purposes, and durations are set out in our Cookie Policy.

6. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain security, resolve disputes, enforce agreements, and meet legal, tax, accounting, and compliance obligations.

Account and User Content: Cancellation of a paid Subscription does not by itself constitute a request to delete an Account or User Content unless Viewdora expressly states otherwise for the applicable plan. If you submit and verify a permanent Account-deletion request, Viewdora will delete or de-identify the Account and associated User Content from active systems within 30 days, subject to lawful retention requirements and the technical limitations described below.

Backups: Residual backup copies may remain for up to 90 days before being overwritten or deleted in accordance with Viewdora’s backup-retention procedures. Backup data is not retained for ordinary active use and remains subject to appropriate protections while retained.

Analytics Records: PostHog session replay recordings are retained for approximately 30 days, while PostHog event data is retained for approximately 12 months.

Contact List Records: Contact-list entries maintained with Viewdora’s email provider are retained while the contact remains on the list. Where a Client unsubscribes or a Photographer asks Viewdora to exclude that Photographer’s Clients, Viewdora retains a suppression record for as long as necessary to ensure no further marketing is sent. We keep records of marketing choices made by Account holders and trial users, including opt-ins, opt-outs and unsubscribe requests, for as long as needed to respect those choices and to show what was agreed.

Billing, Transaction, Tax, and Program Records: Payment, billing, referral, commission, payout, tax, accounting, fraud-prevention, and related business records may be retained for the period reasonably necessary to comply with legal obligations, maintain accurate records, prevent fraud, and resolve disputes.

Acceptance Records: Viewdora retains records showing the version of applicable Terms accepted by an Account holder and the date and time of acceptance for approximately seven years, for contract administration, recordkeeping, and legal purposes.

Security, Logs, and Support Records: Security logs, diagnostic data, support communications, and enforcement records may be retained for periods reasonably necessary for security, troubleshooting, legal compliance, fraud prevention, and dispute resolution. Website request logs are kept for 90 days.

When retention is no longer reasonably necessary, we will delete, de-identify, or otherwise dispose of personal information as appropriate and subject to applicable law.

7. Data Security

Viewdora maintains reasonable administrative, technical, and organizational safeguards designed to protect personal information and User Content against unauthorized access, acquisition, alteration, disclosure, loss, misuse, or destruction, taking into account the nature of the information and the risks associated with the processing. These safeguards may include authentication measures, access controls, encryption or other protective measures where appropriate, logging, monitoring, and security procedures designed to identify and respond to unauthorized activity. No method of transmission, storage, or information-security system is completely secure, and Viewdora cannot guarantee absolute security.

8. International Data Transfers

Personal information may be stored and processed in the United States and in other countries where Viewdora or its service providers operate. Those countries may have privacy and data-protection laws that differ from the laws where you live.

Where applicable law requires safeguards for an international transfer of personal information, Viewdora will use a legally recognized transfer mechanism appropriate to the circumstances. Depending on the jurisdiction and the transfer, this may include an adequacy decision, approved standard contractual clauses, a UK international-transfer mechanism, or another lawful safeguard.

Where applicable, information about the transfer safeguards used and how to request additional information may be obtained by contacting hello@viewdora.com.

9. Your Privacy Rights

Depending on where you live and subject to applicable legal exceptions, you may have some or all of the following rights concerning your personal information:

1. To confirm whether we process your personal information and request access to it;
2. To request correction of inaccurate personal information;
3. To request deletion of personal information;
4. To obtain a copy of certain personal information in a portable format;
5. To object to or request restriction of certain processing where applicable;
6. To withdraw consent where processing is based on consent;
7. To opt out of targeted advertising, the sale of personal data, or qualifying profiling where applicable law grants those rights; and
8. To appeal our refusal to act on a privacy-rights request where applicable law provides an appeal right.

Targeted Advertising and Privacy Choices: Where applicable law gives you the right to opt out of targeted advertising, the sale of personal information, or qualifying sharing of personal information, you may exercise that right through the Cookie Preferences control in the footer of every page on viewdora.com (switch off Advertising), through the cookie banner, the Cookie preferences link on the sign-in and sign-up pages, or account settings in Viewdora Studio, or by emailing hello@viewdora.com with “Privacy Request” in the subject line. Viewdora treats a Global Privacy Control or Do Not Track signal as a decline of analytics and advertising cookies on viewdora.com and in Viewdora Studio, for the browser or device from which the signal is received, unless you later opt in yourself. PostHog analytics in Studio also stops capturing while either signal is present.

Submitting a Request: You may submit a privacy-rights request by contacting hello@viewdora.com or through any privacy-request mechanism Viewdora makes available through the Services. We may request information reasonably necessary to verify your identity and authority to make the request. Where applicable law permits an authorized agent to submit a request for you, we may request proof of the agent’s authority and may verify your identity directly.

Response Timing: We will respond within the period required by applicable law. If the law permits an extension because of the complexity or number of requests, we will notify you as required.

Appeals: Where applicable law gives you a right to appeal a denied request, you may submit an appeal to hello@viewdora.com with “Privacy Appeal” in the subject line. We will review and respond to the appeal within the period required by applicable law and provide any further complaint information that the law requires.

Non-Discrimination: Where prohibited by applicable law, Viewdora will not discriminate against you for exercising an applicable privacy right.

10. Marketing and Communications

Service emails. We send emails that we need to send to provide the Services. These include sign-in codes, account and security notices, billing and Subscription messages, trial reminders, notices about changes to our terms or policies, and replies to your requests. Service emails are not marketing. We send them even if you unsubscribe from marketing.

Marketing emails to Account holders and trial users. If you create an Account or start a free trial, we may send you marketing emails about Viewdora. These can include product news, tips, offers, and invitations to start or restart a Subscription. We send these emails only where applicable law allows it.

• Where the law requires your consent before we send marketing email, for example in the European Union, the European Economic Area, the United Kingdom, Canada, and Australia, we send you marketing email only if you have opted in. You can opt in by ticking the optional marketing box when you sign up, by turning on marketing emails in your Profile, or in another way we offer that clearly asks for your consent.
• Where the law allows us to send marketing email without asking first, such as in the United States, and you created your Account or started your free trial on or after November 2, 2026 without telling us your choice, we may send you marketing email about Viewdora. If you left the marketing box unticked when you signed up, or turned marketing emails off in your Profile, we will not send you marketing email. If you created your Account or started your free trial before November 2, 2026, we send you marketing email only if you opt in, for example by turning on marketing emails in your Profile. You can unsubscribe at any time.

Client Contact Lists: When a Photographer invites a Client to a gallery, the Client’s name and email address are also added to a contact list that Viewdora maintains with its email provider. Viewdora uses that list to send its own messages to Clients, including marketing communications, where permitted by applicable law. For that use Viewdora acts as an independent controller rather than as the Photographer’s processor or service provider, and that use is addressed in the Viewdora Data Processing Addendum. Every Viewdora marketing message to a Client includes a one-click unsubscribe, and a Client who unsubscribes is permanently suppressed. A Photographer who does not want Viewdora to send its own marketing to that Photographer’s Clients may email hello@viewdora.com with “No Viewdora marketing to my clients,” and Viewdora will exclude them. Opting out of marketing does not stop gallery-access, transactional, or other service messages.

Unsubscribing and your choices. Every marketing email we send includes a working unsubscribe link. When you unsubscribe, we stop sending you marketing email and we keep a record so that it does not start again. We act on unsubscribe requests promptly and within any time limit the law sets. You can also opt out by emailing hello@viewdora.com. If you gave consent, you can withdraw it at any time. This does not affect emails we sent before you withdrew it. Unsubscribing from marketing does not stop service emails.

Records of your choice. When you make a marketing choice, we record whether you opted in, the date and time, where you made the choice (for example, at signup), and the wording you were shown. We use this record to respect your choice and to show what you agreed to.

11. Children’s Privacy

Viewdora Accounts and paid Subscriptions are intended for individuals who are at least 18 years old, or the age of legal majority where higher. Viewdora does not independently verify the age of individuals whom a Photographer invites to access a Client gallery, and Client gallery access may occur without the Client creating a Viewdora Account. Photographers determine whom they invite to galleries and are responsible for obtaining any parental, guardian, or other permission or consent required by applicable law when inviting a minor Client or processing information relating to that minor.

If we learn that we collected personal information directly from a child under 13 in circumstances subject to the Children’s Online Privacy Protection Act (COPPA) without the required parental consent, we will take appropriate steps to delete the information or otherwise comply with applicable law.

Photographers may upload photographs or other User Content depicting minors. The fact that a minor appears in User Content does not by itself mean that the minor is a Viewdora Account holder. Photographers are responsible for obtaining any permissions, notices, consents, or other rights required for the content they upload and their own collection and use of personal information.

If you believe a child has provided personal information directly to Viewdora in violation of this Policy, contact hello@viewdora.com.

12. Legal Obligations and Enforcement

We may process, preserve, or disclose personal information where reasonably necessary to:

• comply with applicable law, regulation, subpoena, court order, or other lawful process;

• respond to lawful requests from governmental or regulatory authorities;

• establish, exercise, or defend legal claims;

• enforce our Terms of Service, Referral & Ambassador Program Terms, and other agreements;

• investigate or prevent fraud, abuse, security incidents, unauthorized access, or unlawful activity; or

• protect the rights, property, safety, or security of Viewdora, our users, or other persons.

Where legally permitted and reasonably practicable, Viewdora may take appropriate steps to evaluate the validity and scope of a legal request before disclosure.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, information practices, legal requirements, or business operations.

We will post the revised Privacy Policy with an updated “Last Updated” date. Where a change materially affects how we process personal information, we will provide additional notice where reasonably appropriate or required by applicable law, such as by email, an in-app notice, or another prominent notice through the Services.

If applicable law requires consent for a new processing purpose, we will seek that consent separately rather than relying solely on publication of an updated Privacy Policy.

14. Contact Us

Email: hello@viewdora.com
For account deletion requests: hello@viewdora.com
Mailing Address: 4680-18 I Monticello Ave, PMB 121, Williamsburg, VA 23188
Operated by: Forged Concepts LLC

Effective Date: November 2, 2026 · Last Updated: November 2, 2026 · Version: 2.2 · Supersedes Version 2.1, effective October 1, 2026 (last updated October 2, 2026).