Skip to content
FotoPal

Privacy Policy

FotoPal (fotopal.ai) is operated by JR Photo and Video Pty Ltd (“we”, “us”). FotoPal is a registered business name of JR Photo and Video Pty Ltd (ABN 15 677 761 787), Adelaide, South Australia. We serve studios and agents in Australia, New Zealand and the United States. This policy explains what we collect, why, and how we handle it. It covers fotopal.ai, app.fotopal.ai and the FotoPal Studio and FotoPal Agent iPhone apps. Last updated 17 October 2026.

What we collect

  • Account details — name, email address, phone number and the role you hold in a studio or agency.
  • Property and job information — addresses, access notes, bookings, delivery galleries, invoices and the activity history of each job.
  • Photographs, floor plans and video uploaded for processing and delivery, including the information the camera writes into each file — the time it was taken, the camera or phone used, and GPS coordinates where the device recorded them.
  • Device tokens for the phones you choose to receive push notifications on.
  • Approximate location, in the FotoPal Studio app only, and only while you have granted it: to suggest when you have arrived at or left a shoot, to estimate your next drive, and to stamp reference photos you take in the field. It is used for your studio's scheduling and is never used for advertising or sold. You can refuse it and use the app without it.

We collect only what the service needs to run. The FotoPal Agent app collects no location.

Who the photographs belong to

Photographs, plans and video produced through FotoPal belong to the studio that created them and, under that studio's own agreement, to the agency that commissioned them. We host and process them to provide the service and claim no ownership. If you are an agent or a member of a studio team, deleting your personal account does not delete the studio's work — see Retention & deletion below.

Google user data (Calendar)

Photographers can connect a Google Calendar so their studio sees when they are unavailable. When you connect a calendar we request the minimum access needed:

  • Free/busy access — the times you are busy. We never receive event titles, descriptions, attendees or any other content.
  • Optional location sharing — if you explicitly opt in, we additionally read only each event's start/end time and its location field, solely to calculate drive times between appointments. Event titles, descriptions and attendees are never requested; busy events are shown to your studio simply as “Busy”.

OAuth tokens are stored encrypted and used only to perform the checks above. Calendar data is read transiently to display availability and compute travel times; it is not sold, not used for advertising, not used to train AI models, and not shared with any third party. You can disconnect a calendar at any time on your Availability page in FotoPal, or revoke access at myaccount.google.com/permissions — we then delete the stored tokens.

FotoPal's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

AI photo processing

Images you upload are sent to our processing partners (such as Autoenhance.ai, Google Gemini and Shotstack) only to produce the edits, floor plans and videos you request. Outputs are delivered back to your gallery; we do not permit partners to use your images for their own purposes beyond providing the service.

Registering interest and product updates

When you register interest in a FotoPal product on fotopal.ai, we collect your name, email address, studio or business name, and, if you give them, your phone number and the platform you use now. We keep them in our customer relationship system (HighLevel), with the products you chose and the time you agreed to receive updates, to confirm your registration, send you news about those products and invite you to beta tests. You can unsubscribe from any update email, or ask us at support@fotopal.ai to remove your details.

Sharing, and who processes your data for us

We never sell personal information. Data is shared with your studio or agency as part of normal use, where the law requires it, and with the service providers that run FotoPal:

  • Supabase — the application database and sign-in.
  • Cloudflare — hosting, and R2 storage for photographs, plans and video.
  • Autoenhance.ai — photo enhancement and bracket merging.
  • Google — Gemini for AI edits and written copy, Maps for addresses and drive times, and Calendar where a photographer has connected one.
  • CubiCasa — floor plan scanning and drafting.
  • Xero — invoicing, where your studio has connected it.
  • Resend — transactional email such as sign-in links and delivery notices.
  • Twilio and HighLevel — SMS and the studio's own messaging, where enabled; HighLevel also holds FotoPal's own contact list of people who register interest or sign up.
  • Apple — push notification delivery to your devices.
  • Meta and Google (Google Analytics) — measuring how well our own advertising works, as described under Advertising measurement below.

Each is bound to use the data only to provide their part of the service. Some are located outside Australia; we use them on terms that require protection equivalent to Australian privacy law.

Retention & deletion

Media and records are kept while the studio's account is active so galleries keep working. You can delete listings and media at any time.

Deleting your own account. Open Delete your account while signed in — the same page the Delete option in both iPhone apps opens. It removes your sign-in, your name, email and phone number, your place on a studio or agency team, your working hours, time off and connected calendar, your registered phones and any saved location traces. It does not remove the bookings, invoices, galleries and photographs of jobs that were done, because those belong to the studio and the agency who paid for them; your name is removed from them instead. If you are the last owner of a studio you must hand ownership to someone else first, so the business is not left without an administrator.

You can also ask us to delete or give you a copy of your information by emailing support@fotopal.ai. We action requests within 30 days.

Security

Data is encrypted in transit and at rest, access is role-based within each studio, and API keys and tokens are stored as encrypted secrets.

Advertising measurement

We advertise FotoPal to photography studios, and we measure whether that advertising works. Our public website (fotopal.ai) uses Google Analytics and the Meta pixel, which set cookies on fotopal.ai to record visits and actions such as starting a free trial. When a studio signs up, first publishes a gallery or starts a paid subscription, our servers also tell Meta and Google that it happened. With that we share an encrypted (hashed) form of the account's email address, a hashed identifier for the studio, the advertising cookie identifiers set by our website, the IP address and browser details used at sign-up, and for a subscription its value and currency. We keep the identifiers needed for this with the studio's account. We do not share photographs, listings, client details or anything about your studio's customers, and this is about FotoPal's own advertising only — never your clients'. You can limit this by blocking cookies in your browser, through your ad settings at Meta and Google, or by asking us at support@fotopal.ai to stop.

Cookies

The app (app.fotopal.ai) and galleries use only the cookies needed to keep you signed in and remember preferences like dark mode. Our public website also uses Google Analytics and Meta advertising cookies to measure our own advertising, as described above.

Contact

Privacy questions or requests: support@fotopal.ai. You may also complain to the Office of the Australian Information Commissioner (oaic.gov.au).