Privacy Policy
Last updated: 28 October 2026
This notice explains how personal data is used on Bokeh Gallery. It covers the UK GDPR, the EU GDPR and the Privacy and Electronic Communications Regulations (PECR). It is a description of our practices, not legal advice.
Who we are
This site is operated for Bokeh Gallery using the Bokeh Gallery platform.
Bokeh Gallery is the data controller of personal data about people invited to view galleries (for example friends and clients). They decide who is invited and whether to send gallery-update emails.
Bokeh Gallery is the data processor for that visitor data: we store it securely so the gallery service can run. We are the controller of photographer (site admin) accounts on the platform. Contact the platform at admin@bokeh.gallery.
What we collect and why
We keep data collection to a minimum.
- Name and email — to create your login, verify your account, reset your password, and (for invited visitors) grant access to specific galleries.
- Password — stored only as a one-way hash. We cannot read it.
- Optional profile image — only if you upload one.
- Gallery invitations — an email address the gallery owner enters so they can invite you before you register.
We do not ask for phone numbers, postal addresses or dates of birth for a gallery login.
Lawful bases
- Contract / steps to enter a contract — creating and using an account, logging in, and accessing galleries you have been invited to.
- Legitimate interests — protecting copyrighted photographs by restricting access, keeping the site secure, and sending strictly necessary emails (verification and password reset).
- Consent — emails about new galleries or other updates that are not required to provide the login. This is optional, the box is never pre-ticked, and you can withdraw it at any time from your profile.
Who we share data with
We do not sell personal data. We use these processors only to run the service:
- Vercel — website hosting and delivery.
- Resend — transactional email (account verification and password reset).
- EdgeStore — image file storage.
Photographers (site admins) can see the name, email and marketing-email preference of users registered on their own site, so they can manage gallery access. They cannot see users on other sites.
How long we keep it
for as long as your account remains open. We delete your personal data when you (or the gallery owner) delete the account. Pending gallery invitations are removed when the invitation is withdrawn or the gallery is deleted.
Security
The site is served over HTTPS. Passwords are hashed. Access to the database is restricted. Each photography site is isolated from the others (data is scoped to that site).
Your rights
You can:
- access a copy of the personal data we hold about you
- ask us to correct inaccurate data
- ask us to delete your data (the right to be forgotten) — use Delete my account on your profile, or ask the gallery owner / admin@bokeh.gallery
- object to processing based on legitimate interests
- withdraw marketing consent at any time from your profile
- ask for your data to be provided in a portable format
To use these rights, email admin@bokeh.gallery. You can also complain to the Information Commissioner's Office (ICO).
Cookies
We use a session cookie so you stay logged in. It is strictly necessary for the service. We do not use advertising or analytics cookies that require a consent banner.
See also our Terms of Service, which include the data processing terms between Bokeh Gallery and photographers who use the platform.