Privacy Policy

Last updated: 2026-05-27

Denne personvernerklæringen er foreløpig kun tilgjengelig på engelsk. Har du spørsmål på norsk, kontakt privacy@photador.com.

This Privacy Policy describes how Photador AS ("we", "us") handles information when you use the Photador Scout Android application, the Photador Scout desktop application, and photador.com(together, the "Services"). Photador Scout is a wireless companion for your Canon camera that helps photographers cull, score, and critique their images.

1. Data we collect

1.1 Account information

When you sign in we receive your email address and (for Google sign-in) your Google account ID via Supabase Auth. We use this only to identify your account, deliver service emails (sign-in codes, receipts), and enforce billing entitlements.

1.2 Anonymous device identifier

If you use the app without signing in, we generate a random device identifier (UUID v4) on first launch and store it locally on your device. The identifier accompanies every cloud AI request so we can enforce the lifetime free allowance. It is not linked to any personal information and cannot be used to identify you.

1.3 Photos and metadata you score in the cloud

When you opt to use cloud-based AI scoring or critique, the relevant image is transmitted to our cloud inference service (Big Scout) over TLS, processed in memory, and discarded immediately after the response is returned. Image bytes are not stored, logged, or used to train any model. EXIF metadata you submit alongside an image (camera body, lens, ISO, aperture, shutter speed) is processed the same way.

Local AI scoring runs entirely on your device — no image leaves your phone or PC.

1.4 Voice commands (microphone)

Photador Scout includes an optional voice-command feature that lets you change camera settings hands-free. When you enable this feature in Settings, the app activates the microphone and runs Vosk, an on-device speech-recognition model. Audio is processed locally in real time; raw audio and transcripts are never transmitted off your deviceand are not retained after the spoken phrase has been interpreted. Voice commands are disabled by default; you may enable or disable them at any time in the app's Settings, and you may revoke the microphone permission via Android Settings → Apps → Photador Scout → Permissions.

1.5 Diagnostic and operational data

We log request metadata required to operate the cloud services (timestamp, route, latency, error code, anonymous device ID or hashed user ID, IP address). These logs are retained for up to 30 days for operational debugging and abuse prevention, then deleted. We do not sell, share, or use logs for marketing.

1.5b Website analytics

photador.com uses Vercel Analytics, a privacy-respecting first-party analytics service provided by our hosting platform. It records aggregate page views and Web Vitals (loading-performance numbers) without cookies and without third-party tracking. We use it to understand which pages are useful and to detect performance regressions. No personal data is sent to Vercel Analytics.

1.6 Billing data

When you purchase a subscription or top-up through Google Play Billing or Apple StoreKit, the store handles the transaction and shares the purchase token with our server so we can credit your Scout Cloud Units balance. We never see your payment-card details. Transaction identifiers are stored to prevent duplicate credits and to support refund handling.

1.7 Information we do NOT collect

• We do not access your phone's photo library beyond the images you explicitly select for cloud scoring.
• We do not collect contacts, calendar, location, browsing history, installed apps, or advertising identifiers.
• We do not use third-party analytics or advertising SDKs. (We do use Vercel Analytics, our hosting platform's privacy-respecting first-party service — see §1.5b.)

2. How we use your data

• To provide and improve the Services you actively request.
• To enforce subscription tiers, free-allowance limits, and prevent abuse.
• To send transactional email (sign-in codes, receipts).
• To comply with legal obligations (tax records on subscription purchases).

We do not use your data for personalised advertising, profiling, or any purpose other than operating the Services.

3. Service providers

We share information with third parties only as strictly necessary to operate the Services:

• Supabase (Frankfurt, EU) — authentication and database hosting.
• Google Cloud / RunPod — overflow GPU inference for cloud AI scoring.
• Cloudflare — TLS termination and DDoS protection.
• Resend — transactional email delivery.
• Google Play Billing / Apple StoreKit — payment processing.

Each provider is bound by its own privacy commitments and processes data only on our instruction.

4. Data retention

• Account data: retained while your account is active. Delete the account and we erase the row within 30 days.
• Anonymous device counters: retained until you reinstall the app (which generates a new device ID).
• Operational logs: 30 days, then deleted.
• Receipts and tax records: retained for the period required by tax law (typically 5 years in Norway).

5. Your rights

Under the GDPR and similar laws you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your account and associated data deleted.
• Receive your data in a machine-readable format.
• Withdraw consent and object to processing.
• Lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

Contact us at privacy@photador.comto exercise any of these rights. Account deletion is also available in-app: Settings → Account → Delete account.

6. Children

Photador Scout is not directed at children under 13 (or the equivalent minimum digital-consent age in your country). We do not knowingly collect personal data from children.

7. International transfers

Data is processed primarily in the EU (Supabase Frankfurt, RunPod EU regions). When data is transferred outside the EEA we rely on Standard Contractual Clauses or equivalent safeguards.

8. Security

All traffic uses TLS. Authentication tokens are short-lived JWTs. Receipts are validated server-side. We use industry-standard practices and minimise the data we retain. No system is perfectly secure; if a breach occurs that is likely to result in risk to your rights we will notify you and the relevant authority within 72 hours as required by law.

9. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of the page reflects the latest version. Material changes will be announced in-app or by email at least 30 days before they take effect.

10. Contact

Photador AS
Norway
Email: privacy@photador.com