foto4.me
Legal

Privacy & terms.

Privacy PolicyTerms of ServiceCookie PolicyImprint

Privacy Policy

Effective date: 22 May 2026
Data Controller: Maksim Sapukhin (autónomo)
Address: Plaza Pedro Santos Gomez, Seville, 41010, Spain
Contact: help@foto4.me


1. Who We Are

foto4.me is a photo-delivery service operated by Maksim Sapukhin, registered as a sole trader (autónomo) in Spain. This policy explains what personal data we handle, why, and what your rights are. It applies to both Subjects (people who open a gallery link) and Photographers (registered users).

We are subject to the EU General Data Protection Regulation (GDPR) and applicable Spanish data protection law.


2. Who Is Responsible for What

Two different people make decisions about a Subject's photos, and it is fair to be clear about who is responsible for what.

The photographer decides who to photograph and why. The photographer is responsible for having a lawful basis to photograph you and to upload your photos — in practice, for obtaining your consent. foto4.me does not photograph anyone and is not present when the photo is taken.

foto4.me provides the technical platform. We are responsible for storing the photos securely, restricting them to your private gallery link, and deleting them on schedule or on request.

For data we decide the purposes of ourselves — photographer accounts, platform operation, security, and analytics — foto4.me is the data controller. For the photo content, responsibility is shared with the photographer as described above. If you have a concern about a photo, you can contact either the photographer or us; we will help regardless.


3. What Data We Collect

3.1 Subjects (no account required)

  • Gallery access data: session code, timestamps, approximate IP address, and basic device information (browser and operating system), collected automatically when you open a gallery.
  • Download and selection events: which photos you viewed, downloaded, or selected.
  • Consent record: when you open a gallery, we record that you proceeded past the consent screen, with a timestamp, so both you and the photographer have a record that delivery was wanted.
  • Email address — paid sessions only: in a Premium Mode (paid) session, you provide an email address so the photographer can be notified of your purchase and so you can be reached about your photos. We do not require an email in a free Quick Mode session.
  • Contact details: if you email us, we keep what you send.

Apart from the above, we do not collect a Subject's name or other identifying details.

3.2 Photographers (registered users)

  • Account data: name, email address, password (stored only as a secure hash).
  • Profile data: city or location, Instagram handle, website, contact details shown in your galleries (all optional).
  • Payment configuration: your Stripe links and payment settings, stored as text. We never store card numbers.
  • Session and upload data: session names, photos uploaded, QR codes generated, gallery settings.
  • Usage data: login timestamps and studio dashboard activity.
  • Subscription data: your plan, and the identifiers Stripe gives us to manage your subscription.

3.3 Photos

Photos uploaded by photographers show identifiable people and are therefore personal data. They are stored with our image-storage provider and are accessible only through the private gallery link.

foto4.me does not perform facial recognition, biometric identification, or any automated analysis of the people in photos. We do not generate biometric templates. The photos are personal data, but they are not processed as "special category" biometric data under Article 9 GDPR.


4. Why We Process Your Data (Legal Basis)

  • Contract — to provide the Platform and its paid plans to photographers, and to operate paid sessions.
  • Consent — for processing a Subject's photos, the lawful basis is the Subject's consent, which the photographer is responsible for obtaining (see Section 2). foto4.me processes the photos to carry out delivery.
  • Legitimate interests — to keep the Platform secure, prevent abuse, handle enquiries, and improve the service, balanced against your rights.
  • Legal obligation — to meet our obligations under data protection law, tax law, and to respond to lawful requests.

5. Where Data Is Stored and Processed

Most data is processed within the EU/EEA. However, some of our service providers are based in, or may process data in, the United States or other countries outside the EEA.

Where personal data is transferred outside the EEA, that transfer is covered by an appropriate safeguard — an EU adequacy decision (such as the EU–US Data Privacy Framework) and/or the European Commission's Standard Contractual Clauses. We rely on each provider's own compliance with these mechanisms.

Our providers and their roles are listed in Section 6.


6. Service Providers (Sub-processors)

We share data with the following providers only as far as needed to run the Platform. We do not sell personal data, and we do not share data with advertisers.

  • Supabase — Database and authentication — EU / US
  • Cloudinary — Photo storage and delivery — EU / US
  • Stripe — Subscription billing; tip and photo-sale payment links — EU / US
  • Resend — Transactional email (e.g. paid-session notifications) — EU / US
  • Vercel — Hosting and platform infrastructure — EU / US

For tips and paid sessions, Stripe processes the payment directly between the Subject and the photographer — foto4.me does not receive, hold, or route that money.


7. How Long We Keep Your Data

  • Photos: deleted from foto4.me and from our image-storage provider when the gallery period ends (the period shown on the gallery page, typically 72 hours), or earlier on request.
  • Gallery access and consent records: up to 90 days, then deleted.
  • Photographer account data: for the life of the account, then deleted within 12 months of account closure.
  • Subscription and payment records: retained as long as required by tax and accounting law (in Spain, generally up to 6 years).
  • Subject email from a paid session: deleted with the rest of the session data when the gallery period ends, except where a record is needed to evidence a completed transaction.
  • Contact enquiries: up to 2 years from last contact.

8. Your Rights Under GDPR

You have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — ask us to correct inaccurate data.
  • Erasure — ask us to delete your data ("right to be forgotten").
  • Restriction — ask us to limit how we use your data.
  • Portability — receive your data in a structured, machine-readable format.
  • Object — object to processing based on legitimate interests.
  • Withdraw consent — where processing relies on consent.

If you are a Subject and want your photos removed, you do not need an account. Contact us at the email below, or use the removal link on the gallery page, and we will action verified requests promptly.

To exercise any right, contact help@foto4.me. We will respond within 30 days. If you are not satisfied with our response, you may complain to the Spanish Data Protection Authority (Agencia Española de Protección de Datos, aepd.es).


9. Data Security

We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), hashed passwords, access controls, and private, unguessable gallery links.

If a personal data breach is likely to put your rights and freedoms at risk, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay.


10. Children

The Platform is not directed at children. Photographers are required, under our Terms of Service, not to photograph or upload images of a minor without the consent of that minor's parent or legal guardian. We do not knowingly collect personal data from children without that consent.

If you believe a child has been photographed and uploaded without appropriate consent, contact us immediately and we will remove the content.


11. Marketing

If you are a photographer, we will only send you marketing emails if you have separately opted in. You can withdraw that consent at any time, using the unsubscribe link in any marketing email or by contacting us. Service and account emails (for example, about your subscription or a security matter) are not marketing and are sent regardless.


12. Changes to This Policy

We may update this Privacy Policy. Material changes will be posted on the Platform. We recommend reviewing this page periodically.


13. Contact

Data Controller: Maksim Sapukhin
Address: Plaza Pedro Santos Gomez, Seville, 41010, Spain
Email: help@foto4.me

Last updated: 22 May 2026

Terms of Service

Effective date: 22 May 2026
Platform: foto4.me
Operated by: Maksim Sapukhin (autónomo)
Address: Plaza Pedro Santos Gomez, Seville, 41010, Spain
Contact: help@foto4.me


1. About This Platform

foto4.me ("the Platform", "we", "us") is a photo-delivery service operated by Maksim Sapukhin, a sole trader (autónomo) registered in Spain. The Platform lets photographers create private sessions, upload photos, and share QR-linked galleries with the people who appear in those photos ("Subjects").

The Platform supports two kinds of session:

  • Quick Mode — the Subject downloads their photos free of charge and may optionally leave a voluntary tip for the photographer.
  • Premium Mode (paid sessions) — the Subject chooses and pays the photographer for individual photos before downloading them.

By accessing foto4.me — whether as a registered photographer or as a Subject opening a gallery link — you agree to these Terms of Service. If you do not agree, please do not use the Platform.

We want these Terms to be readable. Where something matters for your rights, we have tried to say it plainly rather than bury it.


2. Who Uses the Platform

2.1 Subjects (people who scan a QR code or open a gallery link)

You are opening a private gallery created for you. No account is required. You may browse and download your own photos, leave a voluntary tip (Quick Mode), or buy photos (Premium Mode).

What you should know as a Subject:

  • The photographer who created the gallery is responsible for having your consent to be photographed. foto4.me does not photograph anyone.
  • Your photos are private to your link and are deleted when the gallery period ends (shown on the gallery page, typically 72 hours).
  • You can ask us to remove your photos at any time — see Section 5.
  • If you did not agree to be photographed, or you object to being on the Platform, contact us and we will act on it.

2.2 Photographers (registered users)

You use the Platform to create sessions, upload photos, and deliver galleries. By registering you confirm that you are at least 18 years old and that you have the legal right to photograph, upload, and deliver the photos you handle through the Platform.


3. Acceptable Use

3.1 You may

  • Browse, download, or buy your own photos (Subjects).
  • Create sessions and upload photos you are entitled to share (Photographers).
  • Share QR codes or gallery links with the relevant Subject.
  • Leave or receive a voluntary tip, or buy or sell photos in Premium Mode.

3.2 You may not

  • Upload, share, or sell photos of any person who did not consent to being photographed.
  • Upload content that is unlawful, including any sexual content involving minors, non-consensual intimate imagery, or content that infringes another person's rights.
  • Use the Platform to harass, stalk, defame, threaten, or otherwise harm any person.
  • Attempt to access sessions or galleries you were not given a link to, or enumerate, scrape, or probe gallery links.
  • Reverse engineer, copy, or resell the Platform itself.

We may remove content and suspend or terminate any account that breaches this Section — see Section 10.


4. Photographer Responsibilities and Consent

This Section is the core of your relationship with us as a photographer. Please read it carefully.

4.1 Consent warranty

By creating a session and uploading photos, you represent and warrant that, for every identifiable person appearing in those photos:

  • you obtained their consent to be photographed — and, if the person is a minor, the consent of their parent or legal guardian;
  • that consent covers both the taking of the photo and its delivery to that person through foto4.me; and
  • you have the legal right to upload and deliver the photos, consistent with applicable law, including the EU General Data Protection Regulation (GDPR) and Spanish image-rights law (Ley Orgánica 1/1982).

4.2 Use of photos beyond delivery is your separate responsibility

foto4.me delivers photos to the Subject they were taken for. Nothing in these Terms, and nothing the Platform provides, gives you the right to use a Subject's image for any other purpose — including publication on social media, a portfolio, advertising, or any other promotional or commercial use.

Any such use requires the Subject's separate, explicit, and informed consent. Obtaining that consent is your responsibility alone. We do not police what you do with photos after delivery, and we trust you to be honest with the people you photograph — but the legal responsibility, and any consequence of using a photo without consent, sits with you.

4.3 Licence to the Platform

You keep full copyright in your photos. By uploading them, you grant foto4.me a limited, non-exclusive licence to store, process, and display the photos solely for the purpose of delivering them to the intended Subject and operating the Platform. This licence ends when the photos are deleted.


5. Photos, Availability, and Deletion

5.1 Availability

Gallery links are active for a limited period — typically 72 hours — as shown on the gallery page. After that period the gallery closes and the photos are deleted from our systems. We recommend Subjects download their photos promptly.

5.2 Deletion

A Subject may request deletion of their photos at any time by contacting us at the address above or using the removal link on the gallery page. We will action verified requests promptly.

A photographer may delete sessions and photos via the studio dashboard.

Deletion removes the photos from foto4.me and from our storage provider. It cannot remove copies the photographer or anyone else holds elsewhere — see Section 4.2.

5.3 No archive

foto4.me is a delivery tool, not a backup service. We do not keep an archive of delivered photos. Photographers are responsible for keeping their own originals.


6. Payments

6.1 Tips (Quick Mode)

Tips are entirely voluntary. There is no obligation on any Subject to tip in order to download their photos. Tips are paid through a third-party payment service (such as Stripe) directly from the Subject to the photographer. foto4.me does not take any share of tips — 100% goes to the photographer, less the payment service's standard processing fee, which is charged by that service and not by us.

6.2 Paid photos (Premium Mode)

In a paid session, the Subject buys photos directly from the photographer. The photographer sets the price. The sale is a contract between the Subject and the photographer; foto4.me is not the seller and is not a party to that contract. foto4.me does not take any share of photo sales.

The photographer is responsible for delivering the purchased photos, for any applicable consumer-law obligations, and for accounting for their own income and tax. Any dispute about a paid photo (non-delivery, quality, refund) is between the Subject and the photographer.

6.3 Our role in payments

foto4.me does not process, hold, or route tip or photo-sale money, and does not take a commission on either. We accept no liability for payment transactions, payment disputes, or the acts of payment processors. Our revenue comes from photographer subscriptions (Section 7), not from your earnings.


7. Photographer Subscriptions

7.1 Plans

foto4.me offers a free plan and paid subscription plans (currently "Pro" and "Business"), as described on the Platform's pricing page. Paid plans are billed in advance through Stripe on a recurring monthly basis and renew automatically until cancelled.

7.2 Cancellation

You may cancel a paid subscription at any time through the billing portal. Cancellation stops future charges. You keep access to paid features until the end of the period you have already paid for. We do not provide pro-rated refunds for a partly used period unless required by law.

7.3 Right of withdrawal

If you are an EU consumer, you may have a statutory right to withdraw from a paid subscription within 14 days. By subscribing and starting to use the paid features immediately, you ask us to begin the service during that period and you acknowledge that, once the service has been fully provided, the right of withdrawal may no longer apply. Nothing here removes any withdrawal right that applies to you under mandatory law.

7.4 Price and plan changes

We may change subscription prices or plan features. We will give reasonable advance notice of any change that affects you, and the change will apply from your next renewal. If you do not accept a change, you may cancel before it takes effect.


8. Privacy

How we handle personal data is described in our Privacy Policy, a separate document available on the Platform. By using foto4.me you confirm you have read it. The Privacy Policy explains, among other things, who is responsible for the lawfulness of photographing a Subject and who is responsible for storing and deleting the photos.


9. Indemnification

If you are a photographer, you agree to indemnify and hold harmless foto4.me and Maksim Sapukhin against any claim, demand, loss, liability, cost, or expense (including reasonable legal fees) brought by a Subject or any other third party and arising from:

  • a photo you took, uploaded, shared, or sold through the Platform;
  • your use of a Subject's image, including any use beyond delivery (Section 4.2);
  • your failure to obtain any consent required under Section 4; or
  • your breach of these Terms or of applicable law.

This obligation does not apply to any claim caused by foto4.me's own breach of these Terms or of its own legal obligations.


10. Prohibited Content, Suspension, and Termination

We may, at our discretion and where reasonably necessary:

  • remove or disable access to any content that breaches Section 3.2 or Section 4;
  • suspend or terminate an account that breaches these Terms, that uploads unlawful content, or whose use exposes foto4.me, a Subject, or a third party to harm or legal risk;
  • report unlawful content to the relevant authorities where we are legally required or permitted to do so.

Where practical and lawful, we will tell the affected photographer why action was taken. Content involving the sexual exploitation of minors will be removed immediately and reported.

You may close your photographer account at any time from the studio dashboard.


11. Intellectual Property

The foto4.me name, branding, platform design, and underlying software are owned by Maksim Sapukhin. Photographers retain copyright in their own photos. Nothing in these Terms transfers ownership of any intellectual property between the parties.


12. Disclaimers and Limitation of Liability

The Platform is provided on an "as is" and "as available" basis. We do not warrant that it will be uninterrupted, error-free, or fit for any particular purpose.

To the maximum extent permitted by applicable law:

  • our total liability for any claim arising from your use of the Platform is limited to the amount you paid us in the 12 months before the claim; for Subjects, who pay us nothing, this limit is €50;
  • we are not liable for loss of photos after a gallery has expired, for payment disputes, for the acts or omissions of third-party services (Stripe, Cloudinary, Supabase, Resend, Vercel), or for a photographer's conduct toward a Subject.

Nothing in these Terms limits or excludes liability that cannot lawfully be limited or excluded — including liability for death or personal injury caused by negligence, for fraud, or for a consumer's mandatory statutory rights.


13. Governing Law

These Terms are governed by the laws of Spain. Disputes are subject to the exclusive jurisdiction of the courts of Seville, Spain — except that, if you are a consumer, you keep the protection of any mandatory law of your country of residence, and EU consumers may also use the European Commission's Online Dispute Resolution platform at https://ec.europa.eu/consumers/odr.


14. Changes to These Terms

We may update these Terms. If a change is material, we will post a notice on the Platform and, for registered photographers, ask you to accept the updated Terms before continuing to use paid features. Continued use after a change takes effect means you accept it.


15. Contact

Questions about these Terms: help@foto4.me

Last updated: 22 May 2026

Cookie Policy

Effective date: 26 April 2026
Platform: foto4.me
Operated by: Maksim Sapukhin (autónomo)
Contact: maks.sapukhin@gmail.com


1. What Are Cookies

Cookies are small text files placed on your device when you visit a website. They allow the site to remember information about your visit. Similar technologies include local storage, session storage, and pixel tags.

2. How foto4.me Uses Cookies

foto4.me uses a minimal set of cookies and storage technologies. We do not use advertising cookies or sell data to advertisers.

2.1 Strictly Necessary (no consent required)

These are essential for the Platform to function. You cannot opt out of these without disabling the Platform entirely.

  • Session authentication — used to keep registered Photographers logged into the admin panel. Expires when you close your browser or after 24 hours of inactivity.
  • Gallery access token — a short-lived token stored in session storage to verify you have a valid gallery link. Deleted when you close the browser tab.
  • Security tokens — CSRF protection tokens to prevent cross-site request forgery.

2.2 Functional (optional)

These improve your experience but are not required.

  • Theme preference — if you have a display preference set (e.g. dark mode), we may store this locally. No personal data is collected.

2.3 Analytics (optional, consent required)

We may use Vercel Analytics to understand aggregate usage patterns (e.g. page views, session lengths). This does not use persistent tracking cookies and does not identify individual users. If analytics are enabled, a notice will be shown.

We do not use Google Analytics, Facebook Pixel, or any third-party advertising or tracking platforms.

3. Third-Party Cookies

Some Platform functions rely on third-party services which may set their own cookies:

  • Stripe — when you click a payment link and are redirected to Stripe's checkout, Stripe may set cookies on their domain. These are governed by Stripe's privacy policy (stripe.com/privacy). foto4.me does not control or access these cookies.
  • Cloudinary — used for photo delivery. Cloudinary may set performance cookies for their CDN. These do not identify individual users.

4. What We Do NOT Use Cookies For

  • Advertising or retargeting
  • Cross-site tracking
  • Selling data to third parties
  • Profiling individual users

5. Managing Cookies

You can control and delete cookies through your browser settings. Common browsers:

  • Chrome: Settings > Privacy and Security > Cookies
  • Safari: Preferences > Privacy
  • Firefox: Settings > Privacy & Security
  • Edge: Settings > Cookies and site permissions

Disabling strictly necessary cookies will prevent the Photographer admin panel from functioning. Gallery access for Subjects uses session storage (not persistent cookies) and is not affected by most cookie settings.

6. Cookie Duration Summary

  • Session authentication — 24 hours or browser close
  • Gallery access token — Browser tab close (session storage)
  • CSRF tokens — Per request
  • Analytics (if enabled) — Aggregate only, no persistent user identifier

7. Changes to This Policy

We may update this Cookie Policy as the Platform evolves. Changes will be posted on this page with an updated effective date.

8. Contact

For questions about our use of cookies: maks.sapukhin@gmail.com

Last updated: 26 April 2026

Legal Notice

Last updated: 29 April 2026

Maksim Sapukhin
NIE: Z2173771T
Plaza Pedro Santos Gomez, 41010 Seville, Spain
Email: maks.sapukhin@gmail.com

foto4.me is operated by Maksim Sapukhin as a sole trader (autónomo) in Spain, providing a software-as-a-service platform for photographers.

This site is governed by Spanish law. Disputes shall be subject to the jurisdiction of the courts of Seville, Spain, except where mandatory consumer protection regulations provide otherwise.

EU consumers may refer disputes to the European Commission's Online Dispute Resolution platform at https://ec.europa.eu/consumers/odr.