GDPR Compliance

1. Introduction

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that applies to organizations processing personal data of individuals in the European Economic Area (EEA). At Viallo, we are committed to protecting your privacy and ensuring compliance with GDPR.

This page explains your rights under GDPR and how we comply with these regulations. For more information about how we collect and use your data, please see our Privacy Policy.

2. Data Controller

For the purposes of GDPR, the data controller is:

3. Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

5. International Data Transfers

Your personal data may be transferred to and processed in countries outside the EEA. When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by the European Commission (where applicable)
• Data Processing Agreements (DPAs) with all processors

Our service providers (Stripe, Google, Apple, Sentry, Meta, Cloudflare, MongoDB, Vercel, Railway, OpenStreetMap (Nominatim), CARTO) may process data outside the EEA depending on the provider and data flow. Where required, we use appropriate safeguards such as SCCs or adequacy decisions and enter into DPAs with relevant providers.

6. Data Retention

We retain your personal data for as long as necessary to:

• Provide the Service to you
• Comply with legal obligations (e.g., tax records for 7 years)
• Resolve disputes and enforce agreements
• Prevent fraud and abuse

7. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit: All data is transmitted over TLS (HTTPS)
• Password hashing: Passwords are hashed using bcrypt with a high cost factor and are never stored in plain text
• Authentication: Secure JWT tokens stored in httpOnly cookies with CSRF protection
• Access controls: Strict ownership validation ensures users can only access their own data
• Rate limiting: API rate limiting to prevent abuse
• Input validation: All user input is validated and sanitized to prevent injection attacks
• Error monitoring: Automated error tracking with PII redaction

8. Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware
• Notify affected individuals without undue delay if there is a high risk
• Provide information about the nature of the breach and remedial actions

9. Children's Data

Our Service is not intended for children under 16 years of age (the minimum age under GDPR). We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately.

10. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. Any automated processing we perform is used only to improve the Service and does not result in decisions that affect your rights.

Examples of automated processing we use:

• EXIF extraction: Automatic extraction of photo metadata (date, location, camera info) for organizing albums
• Share link analytics: Visitor counting using pseudonymized identifiers derived from IP address and user agent
• Auto-organization: GPS-based clustering of photos into places using location data from photo metadata

11. Share Link Analytics and Public Sharing

Viallo allows you to share albums using share links. Share links can be accessed by people who are not logged in to Viallo. When someone accesses a shared album link, we process limited technical data to provide the share experience, protect the Service, and provide analytics to the album owner.

When a share link is accessed, we may process:

• IP address: Used for security and abuse prevention and may be stored in share link access logs
• User agent string: Used to detect device/browser type and may be stored in share link access logs
• Referrer: If provided by the browser, used to understand how the share link was accessed
• Access timestamps: Date and time of access
• Visitor identifier: A pseudonymous identifier derived from IP address and user agent to estimate unique visitors

Share analytics are intended for the album owner (for example, view counts, unique visitor estimates, and device/browser breakdown). We do not use share link analytics for targeted advertising.

Note: IP addresses and user agent strings may be personal data under GDPR. We treat this information as personal data and process it only for the purposes described above.

12. Third-Party Processors

We work with the following third-party processors who handle your data:

SCCs = Standard Contractual Clauses approved by the European Commission for international data transfers.

All processors are bound by data processing agreements that ensure GDPR compliance.

13. How to Exercise Your Rights

To exercise any of your GDPR rights:

We may need to verify your identity before processing your request.

14. Updates to This Page

We may update this GDPR compliance page from time to time. We will notify you of significant changes by updating the "Last Updated" date and, where appropriate, sending you an email notification.