Privacy policy

Introduction

This policy explains what personal data Picclou collects, how we use it, and the safeguards we apply to protect it. It covers our website (picclou.com), the Picclou application (the “app”), and any related services or applications we offer. “Picclou” refers to the company operating these services.

We keep data collection to the minimum needed to run the service. Picclou is end-to-end encrypted: content is locked on your device before it is uploaded, so no one — including us — can open your galleries, photos, or proofing activity. This policy is intended to be read alongside our terms of service.

Data we collect and how we use it

Encrypted content. Your photos, galleries, and client-facing content are encrypted on your device before upload and stored only in encrypted form. We do not have the keys required to read them, and we cannot view, index, or otherwise access them. Because we hold no readable copy and no keys, we are also unable to sell, share, or train models on this content — the technology makes it impossible, not just against our principles.

Account and authentication. To create an account you provide an email address, which we use as your identifier and to send account-related communications, security notices, and password or key-recovery information if you request it. We may use verification measures to prevent the creation of accounts by automated bots. Legal basis: performance of the contract with you.

Payments and billing. If you subscribe, payment details are collected and processed by our payment provider. We do not store full payment card numbers; we retain only the information needed for billing and receipts. Legal basis: performance of the contract with you.

Usage and account activity. We collect minimal usage information needed to run the service, such as storage used, number of transfers or restores, and plan status. This is used to enforce plan limits, measure entitlements, and improve the product. IP addresses may be retained temporarily to detect and prevent abuse, fraud, or breaches of our terms; we do not keep permanent IP logs in relation to ordinary account use. Legal basis: our legitimate interest in operating a secure and reliable service.

Website analytics. Our website uses self-hosted analytics software. Analytics data is aggregated and, wherever possible, anonymized, and is not used to identify you. We do not use advertising or cross-site tracking technologies. Legal basis: our legitimate interest in understanding how our website is used and improving it.

Communications with us. If you contact us for support, we may retain the contents of that communication to resolve your request and improve the service. We may also send you product-related updates; you can opt out of non-essential communications at any time.

Native applications. If we offer desktop or mobile applications, they may collect technical information such as device type, operating system, and app version, and may use crash reporting to diagnose and fix issues. Where app stores provide aggregate statistics, those are governed by the respective store policies.

Cookies

Our website and app use no tracking cookies. We use only essential storage required for core functionality, such as authentication. If you enable a browser-level Do-Not-Track preference, we honor it.

Data processors and disclosure

We rely on a small number of service providers (for example, payment processing, infrastructure, and support tools) to operate the service. These providers process data only for the purposes described in this policy and are bound by appropriate data-protection agreements. Your encrypted content is never disclosed to third parties.

We will disclose personal data only where the law requires us to, and we push back against requests we believe are not properly grounded. We cannot disclose the content of encrypted galleries because we do not hold the keys to decrypt them.

Your rights

You can access, correct, or delete the personal data associated with your account through the app, and you may export or delete your content at any time. Depending on where you live, you may also have the right to request a copy of your personal data, restrict or object to certain processing, and lodge a complaint with your local supervisory authority. To exercise any of these rights, email hello@picclou.com.

Retention and deletion

You can delete content or your account at any time. Deleted data is held for a short recovery window before permanent purge, so that an accidental deletion is not irreversible. We retain personal data only as long as necessary to provide the service and comply with our legal obligations.

Changes to this policy

We may update this policy as our services evolve. Material changes will be communicated through the app and this page will be revised accordingly. Continued use of the service after such changes constitutes acceptance.