Privacy Policy

Gallorie is a client-gallery and photo-delivery platform operated by Codemondo Digital, a company incorporated in Malaysia (“Gallorie”, “we”, “us”). This policy explains how we handle personal data in accordance with the Personal Data Protection Act 2010 (“PDPA”).

We handle the account data of photographers and studios who sign up with us, and we process the gallery content and client data that photographers upload through the platform on their behalf. Photographers remain responsible for their own clients’ personal data.

We collect only what we need to provide the service:

• Account data — your email address, name, studio name, phone number, and state.
• Business details — if you choose to receive payouts, your business registration and tax details, used to verify your business and issue compliant receipts.
• Gallery and client data — the photos and metadata you upload, and the email addresses, selections, comments, and purchase records of the clients you invite.
• Payment data — a record of each transaction. Payments are handled by a third-party payment processor; we do not receive or store full card or bank details.
• Usage and technical data — basic device, browser, and activity information used to operate, secure, and improve the service.

• To create and run your account and deliver galleries to your clients.
• To process purchases and issue receipts.
• To verify your business where you choose to receive payouts.
• To send you service-related communications.
• To secure the platform, prevent abuse, and meet our legal obligations.
• To respond to your support requests.

We do not sell your personal data, and we do not use your photos to train any model.

We process personal data where you have given consent, where it is necessary to perform our contract with you, where we have a legitimate interest in operating and securing the service, or where we are required to by law. You may withdraw consent at any time, subject to the consequences described in section 8.

We do not sell your data. We share it only where necessary, with appropriate safeguards in place:

• Trusted service providers who help us operate the platform (such as hosting, payment, and communications providers), acting on our instructions.
• Authorities or third parties where required by law, a court order, or to protect our rights or the safety of users.

Some of our service providers process data outside Malaysia. Where personal data is transferred outside Malaysia, we take reasonable steps to ensure it receives a level of protection comparable to the PDPA.

We keep personal data only for as long as needed for the purposes above or as required by law. Transaction and tax records are retained for the period required by Malaysian law. After that, data is deleted or anonymised.

Photos and galleries. Gallorie is a delivery tool rather than an archive, so the full-size delivery files a photographer uploads are held for a stated period and then cleared: on the free plan, 30 days after the gallery expires; on a paid plan, 180 days after the gallery expires, or 180 days after a gallery is archived. We always email the photographer before clearing anything. The gallery record itself — its title, the client it belongs to, their selections and comments, and the smaller preview images — is kept, so a photographer’s own history stays intact. Full detail is in our terms of service.

If you are a client viewing a photographer’s gallery, the photographer decides how long their gallery stays available to you — please contact them directly.

Under the PDPA you have the right to:

• Access the personal data we hold about you.
• Correct data that is inaccurate, incomplete, or out of date.
• Withdraw your consent to our processing.
• Limit the processing of your data in certain circumstances.

To exercise any of these, contact us at support@gallorie.com. Withdrawing consent may mean we can no longer provide some or all of the service to you.

If you are a client viewing a photographer’s gallery and want your data corrected or removed, please contact the photographer first.

We use reasonable technical and organisational measures to protect personal data against loss, misuse, and unauthorised access. Files are encrypted in transit and encrypted at rest by our storage provider.

Access to production systems is limited to the people who need it to keep the service running. Gallorie staff do not browse customer photographs in the course of normal operations — we do not build internal tools for doing so, and support does not need to open a gallery to help you. We do not use your content for advertising or to train any model.

No system is perfectly secure, but we work to protect your data and will notify you and the relevant authorities of a material breach as required by law.

We use a small number of strictly necessary cookies and similar technologies to keep you signed in and operate the service. We do not use advertising or cross-site tracking cookies.

Gallorie is a tool for professional photographers and is not directed at children. We do not knowingly collect personal data from anyone under 18. Where photographs of minors appear in a gallery, the photographer is responsible for obtaining any consent required from a parent or guardian.

We may update this policy from time to time. When we make a material change, we will update the date below and, where appropriate, notify you. Continuing to use Gallorie after a change means you accept the updated policy.

Questions about this policy or your personal data? Email us at support@gallorie.com and we’ll get back to you.