Privacy Policy

1. General Information

1.1 Who We Are & Contact. The data controller responsible for your personal information is Camora LLC (operating as Camora).

• Contact Email: [email protected]

1.2 Who This Policy Applies To. This Privacy Policy applies to all registered users of the Camora Android and iOS applications, including both Buyers and Creators.

Age Restriction: You must be at least 18 years old (or the legal age of majority in your jurisdiction) to create an account, purchase credits, or earn payouts on Camora. We do not knowingly collect personal information from individuals under 18. If we learn that a user under 18 has registered, we will promptly delete their account and associated data.

1.3 Scope & Third-Party Services. This Privacy Policy applies solely to Camora. Our platform may contain links or integrations with third-party services (such as payment gateways or external social media platforms). These third parties have their own privacy policies, which we encourage you to review.

2. What Personal Information We Collect

We collect personal information to provide our services, maintain security, and handle marketplace transactions. The categories of data we collect include:

• Identity Data: First name, last name, username, profile photo, date of birth, and user account ID.
• Contact Data: Email address and phone number.
• Location Data: Approximate or precise geographical location data (GPS/device location) gathered when creating or searching event media galleries.
• Platform & Media Data: Photos, videos, metadata (EXIF/timestamp), generated preview thumbnails, watermarks, event tags, and communications sent through the platform.
• Transaction & Credit Data: Details regarding purchased credit packs, monthly subscriptions, promotional credits, FIFO credit balances, credit redemption histories, and itemized media unlocked.
• Financial & Payout Data: For Creators receiving payouts: Bank account numbers, routing numbers, payout ledger records, tax identification numbers (e.g., SSN/EIN), and verification status.
• Device & Technical Data: IP address, hardware model, operating system version, unique device identifiers, time zone, and app crash diagnostics (e.g., Firebase Crashlytics/Sentry).
• Usage Data: Interactions with the app, gallery views, download counts, search queries, and performance telemetry.

3. How We Use Your Personal Information

We process your data strictly under valid lawful bases, including Contractual Necessity, Legitimate Interest, and Compliance with Law.

3.1 Detail of Purposes and Lawful Bases

• Account Registration & Delivery: Using Identity and Contact Data to set up your account, verify ownership, and provide core application services. (Lawful Basis: Contractual Necessity)
• Event & Location Gallery Matching: Utilizing Location Data and photo EXIF timestamps to organize media into event galleries and connect local Buyers with event Creators. (Lawful Basis: Contractual Necessity)
• Payment & Credit Accounting: Processing subscription billing and credit pack purchases (via Google Play Billing / Stripe), tracking balance types (subscription credits, pack credits, promotional credits), and enforcing First-In, First-Out (FIFO) consumption rules. (Lawful Basis: Contractual Necessity)
• Creator Payouts & Escrow: Snapshotting revenue shares (50% net credit value), managing the 7-day maturation escrow hold, enforcing the $50 minimum payout threshold, and transferring funds to bank accounts. (Lawful Basis: Contractual Necessity / Compliance with Law)
• Automated Processing & Watermarking: Watermarking preview images automatically and using automated tools to tag, organize, and inspect media for platform safety. (Lawful Basis: Legitimate Interest)
• Fraud Detection & Abuse Prevention: Analyzing IP logs, device IDs, and transaction patterns to prevent duplicate credit minting, chargeback fraud, self-buying loops, and copyright infringement. (Lawful Basis: Legitimate Interest)
• Legal Compliance & Tax: Retaining payout and transaction records for tax compliance (e.g., 1099 reporting) and anti-money laundering (AML) laws. (Lawful Basis: Compliance with Law)

4. Media Visibility & Retention

4.1 Gallery Visibility

• Preview Thumbnails: Photos and videos uploaded to an event gallery generate watermarked preview thumbnails visible to users browsing that event.
• High-Resolution Assets: Full-resolution, un-watermarked media is encrypted and delivered via secure signed URLs only after a Buyer redeems the required credit amount.

4.2 Data Retention. We store your personal data only as long as necessary to fulfill the purposes outlined in Section 3:

• Account & Media Data: Retained for as long as your account remains active. Upon account deletion, uploaded media and personal identifiers are purged within 30 days.
• Financial & Payout Ledger Logs: Transaction histories, credit ledgers, and payout logs are retained for 7 years to fulfill accounting, tax, and legal obligations.

5. Who We Share Your Data With

We do not sell your personal data to third parties. We share data only with trusted service providers required to operate the platform:

• Infrastructure & Storage: DigitalOcean and Google Cloud Platform (for secure hosting, storage of high-res assets, CDN delivery, and database administration).
• Payment & In-App Billing Processors: Google Play Billing and Stripe (to process credit purchases, handle subscriptions, manage creator bank payouts, and verify tax identities).
• Crash & Performance Analytics: Sentry and Firebase Crashlytics (for real-time crash reporting and performance monitoring).
• Professional & Legal Advisors: External legal counsel, accountants, and auditors when necessary for business operations and compliance.
• Corporate Transfers: In the event of a merger, acquisition, or asset sale, user data will be transferred to the acquiring entity under strict confidentiality protections.

6. Data Security

We enforce robust technical and organizational security measures to protect your personal data:

• Encryption: Data in transit is protected using TLS/SSL encryption, and raw media storage uses server-side AES-256 encryption.
• Access Control: Storage bucket policies restrict access to un-watermarked high-res media using short-lived signed URLs generated only after payment verification.
• Escrow Safeguards: Payout processing requires dual-authentication checks and automated flag verification for high-risk payouts.

In the event of a security breach affecting your personal information, we will notify you and relevant regulatory bodies in accordance with applicable laws.

7. Your Rights & Choices

Depending on your jurisdiction, you possess the following privacy rights:

• Access & Portability: Request a copy of the personal data we hold about you, including transaction and media logs.
• Correction: Request updates to inaccurate or incomplete personal information.
• Erasure (“Right to be Forgotten”): Request deletion of your account and associated media, provided there are no active escrow holds, pending chargebacks, or legal retention requirements.
• Restriction & Objection: Object to or restrict certain processing activities, such as direct marketing or analytics.

To exercise any of these rights, contact us at [email protected]. We respond to all legitimate requests within 30 days.

8. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect platform enhancements or regulatory changes. We will notify you of material changes via in-app notifications or email prior to the changes taking effect.