Legal

Privacy Policy

Last updated: 13 July 2026

This policy explains how quolby handles personal data. We keep it lean and collect only what the service needs.

quolby is operated by a sole trader based in Ventimiglia, Italy (regime forfettario). Operator / data controller: Daniele Luigi Barbieri, Via Camillo Cavour 43, 18039 Ventimiglia (IM), Italy — VAT / P.IVA 01827880087. Data protection contact: privacy@quolby.com.

1. Two roles

For your photographer account (your email, studio, catalogue, subscription), quolby is the data controller.

For the couple/client information a photographer enters (couple names, email, wedding date, venue), the photographer is the controller and quolby acts as a processor on their behalf — we only process it to provide the service. The processor terms (Art. 28 GDPR) are set out in section 10 of our Terms of Service.

2. What we collect

Account: email, name and studio details, authentication data (via Google sign-in or a magic link).
Product content: your catalogue, quotes, and the client details you enter.
Payments: subscription and deposit metadata via Stripe. We do not store card numbers — Stripe handles card data directly.
Technical: basic logs and, for accepted quotes, the IP/user-agent recorded with an acceptance as proof of agreement.

3. Why (legal bases)

To provide the service you signed up for (contract).
To keep quolby secure and working, and to improve it (legitimate interest).
To send you essential service emails; marketing emails only where permitted, and you can opt out.

4. Who processes data for us (sub-processors)

Provider	Purpose	Where
Supabase	Database, authentication & hosting of app data (your account, catalogue, quotes and the client details you enter)	EU / US
Stripe	Subscription billing & deposit payments — the photographer's own Stripe account collects funds; quolby never holds money	EU / global
Resend	Transactional email delivery	Global
Vercel	Static site hosting / CDN	Global edge
DeepSeek	AI drafting of catalogue text and message drafts	China
Google	Google sign-in (authentication when you log in with Google), Google Fonts (loading the site's typefaces), and — only if you consent to analytics cookies — Google Analytics 4 & Google Ads for usage analytics and advertising measurement	EU / US

Each is bound to protect the data. Where data is transferred outside the EU, it is covered by appropriate safeguards (such as Standard Contractual Clauses).

About DeepSeek (AI drafting). When you use quolby's AI helpers to draft catalogue descriptions, translations or message text, only the minimum text needed for that task is sent to DeepSeek, a provider based in China. No payment data, and no more personal data than necessary, is included. If you prefer not to use AI drafting, you can simply write the text yourself.

5. How long we keep it

While your account is active, and for as long as needed for legal, tax and accounting obligations after that. You can ask us to delete your account and data at any time — or do it yourself, straight away, from your settings, where you can also export a full copy of your data first.

6. Your rights

Under the GDPR you can request access, correction, deletion, portability, or object to certain processing. For your photographer account you can act on two of these yourself, right now, from your settings: export a full copy of your data (portability) and permanently delete your account and its data (erasure) — deleting also cancels any Pro subscription so you're no longer charged. For anything else, or if you'd rather we handle it, email privacy@quolby.com. You can also complain to the Italian Data Protection Authority (Garante per la protezione dei dati personali) or your local authority.

7. Cookies

By default quolby sets only what it needs to sign you in and keep your session. Analytics and advertising cookies (Google Analytics 4 and Google Ads — see section 8) are set only if you accept them in our cookie banner; if you decline, none of those cookies are set and no analytics or advertising data is collected.

8. Analytics & advertising

To understand how our site is used and to measure the effectiveness of our ads, we use Google Analytics 4 and Google Ads conversion tracking. These run only after you give consent via the cookie banner — nothing loads and no cookies are set until you accept. If you decline, no analytics or advertising cookies are set and none of this data is collected.

When enabled, they collect basic usage data (pages viewed, approximate location, device/browser, and interactions such as signing up or upgrading) and, for visitors arriving from a Google ad, the ad-click identifier (gclid) so we can attribute a signup or purchase to the ad that brought you. This data is processed by Google (Google Ireland / Google LLC, US) and is not used to build advertising profiles of you by us.

Analytics data is retained by Google for up to 14 months. You can withdraw consent at any time — reopen the cookie banner and decline, or clear the cookies in your browser; declining stops any further collection. This is our lawful basis for these cookies: your consent (Art. 6(1)(a) GDPR).

9. Security

Access to your data is protected by database-level security rules, encrypted connections, and least-privilege access. No system is perfectly secure, but we take reasonable measures to protect your information.

10. Changes

We’ll update this page when our practices change and revise the date above.