Privacy Policy

Last updated: August 10, 2026

1. Scope and controller

This policy explains how PhotoCalia processes the data needed to turn images and PDFs into calendar events. PhotoCalia is responsible for the processing described here. For questions or requests, email privacy@photocalia.com.

2. Data we process

2.1 Google account

When you sign in with Google through Firebase Authentication, we receive your technical user identifier, email address and, when available, your name and profile image.

2.2 Conversion content

Uploaded images, screenshots and PDFs, together with the dates, times, locations and text they contain, are sent to the PhotoCalia API and the server-configured AI provider to produce the requested events. The generated ICS result may be associated with a technical reservation so the same request is not charged or processed twice.

2.3 Operational tracking

To operate the service, detect abuse and calculate aggregate statistics, the API may record the following in a private Notion workspace: user identifier, email, timestamp, origin domain, conversion outcome, file and event counts, duration and a limited error message. Uploaded file content is not stored in this Notion tracking record.

2.4 Payments, security and analytics

Stripe receives the information needed for subscriptions and payments. Vercel and Google Cloud process technical data such as IP addresses, request logs and browser characteristics to host and secure the service. Vercel Analytics is enabled only after you consent.

To prevent repeated circumvention of the free allowance, PhotoCalia creates a random installation identifier in your browser that is strictly necessary for service security. The API retains only pseudonymized HMAC fingerprints of that identifier, the account and, for a shared daily safeguard, the network. Raw identifiers and the raw IP address are not stored in these quota counters.

3. Purposes and legal bases

  • Service performance: authentication, conversion and ICS export.
  • Contract performance: subscriptions, payments and quota management.
  • Legitimate interests: security, abuse prevention, diagnostics and minimal operational statistics.
  • Consent: optional audience measurement.
  • Legal obligations: accounting records and regulatory requests.

4. Processors and recipients

One AI provider is selected server-side for a given conversion. The frontend does not depend on one fixed commercial model, and this page will be updated if the providers actually used by the service change.

5. Retention and deletion

  • Uploaded files: PhotoCalia does not intentionally store them after the request completes. They may transit temporarily through the infrastructure and AI provider while processing takes place.
  • Account and quota data: retained in Firebase/Firestore while the account or associated operational obligations remain active.
  • Pseudonymized anti-abuse counters: installation counters follow the free plan's monthly period; network and service-capacity safeguards follow a daily period. Their technical deletion may occur asynchronously.
  • Notion tracking: retained for security, support and usage measurement until deletion or anonymization following a verified request. These entries do not currently have a short automatic expiry.
  • Payment records: retained by Stripe and PhotoCalia for applicable accounting and fraud-prevention periods.

PhotoCalia coordinates deletion requests across systems it controls. Self-service deletion is not currently available, so contact privacy@photocalia.com. Some records may be retained when required by law.

6. Your rights

Depending on your location, you may request access, correction, erasure, restriction or portability, or object to processing. You can withdraw analytics consent from Cookie Preferences. We may request reasonable proof of identity before acting on a request.

You may also complain to the CNIL or your competent supervisory authority.

7. Security and international transfers

Traffic uses HTTPS, the API verifies Firebase tokens and secrets remain server-side. Providers may process data outside the European Economic Area under their processing agreements, Standard Contractual Clauses and other applicable transfer mechanisms.

8. Children and third-party content

PhotoCalia is not intended for children under 16. Do not upload another person's personal data without a lawful basis, and avoid sensitive information that is unnecessary for creating the calendar event.

9. Changes

The date above changes when this policy is updated. Material changes will be announced in the service or by email when appropriate.