Privacy Policy
Last updated: October 22, 2026
The short version
- Exifed is a product of Zyref, LLC. Zyref is responsible for the personal data described here.
- We collect what we need to run your account and your website. We don't sell personal data, show ads, or use your photos to train AI models.
- Location and camera serial numbers in your photos' metadata are hidden on your public site by default.
- Payments go through Stripe. Exifed never sees full card numbers.
- You can export or delete your data at any time. Write to privacy@exifed.com.
- Who we are
- Photographers and their visitors
- Information we collect
- Photo metadata (EXIF)
- How we use information
- Legal bases
- Service providers
- Cookies and local storage
- Retention
- Security
- International transfers
- Your rights
- Children
- Changes
- Contact
1. Who we are
Exifed ("Exifed", "we", "us") is a website builder for photographers, available at exifed.com, on exifed.photo subdomains and on custom domains that our customers connect. Exifed is a product of Zyref, LLC ("Zyref"). Zyref provides the Exifed service and is the data controller for the personal data described in this policy, except where section 2 says otherwise.
2. Photographers and their website visitors
Exifed has two kinds of users:
- Customers: photographers and their teams who sign up for an Exifed account. For customer account data, Zyref is the controller.
- Visitors: people who view a photographer's website, receive a private gallery link, send a message through a contact form, or buy a photo. The photographer decides what their website collects and what they do with it, so the photographer is the controller of visitor data. Zyref processes it on the photographer's behalf to provide the service. Questions about how a photographer uses your data should go to that photographer first. We will help them respond.
3. Information we collect
From customers
| Category | Examples | Source |
|---|---|---|
| Account | Name, email address, profile picture, sign-in identifiers, team memberships and roles | You, through our sign-in service |
| Content | Photos and other files you upload, captions, galleries, pages, gear lists, site settings and design choices | You |
| Photo metadata | EXIF, IPTC and XMP data embedded in your files (see section 4) | Your files |
| Billing | Plan, subscription status, invoices, Stripe customer ID. Card details are held by Stripe, not Exifed. | You and Stripe |
| Selling | Your connected Stripe account ID and status, price lists, orders and payouts summaries | You and Stripe |
| Communications | Support requests and emails we send you (for example, receipts and security notices) | You and us |
| Technical | IP address, browser user agent, session and security logs, request timestamps | Your device |
From visitors to Exifed-powered websites
| Category | Examples |
|---|---|
| Contact form messages | The name, email address and message you submit, delivered to the photographer |
| Private gallery access | Your email address, if a photographer sends you a personal link, and when links are opened |
| Purchases | Your email address, name, purchased items and order status. Payment is processed by Stripe on the photographer's own Stripe account. |
| Technical | IP address and user agent, used for security, rate limiting and abuse prevention |
Exifed itself does not run advertising or cross-site tracking on photographer websites. A photographer may choose to add an analytics service (such as Google Analytics or Plausible) to their own site. That provider's privacy policy applies to that data.
4. Photo metadata (EXIF)
Exifed reads the metadata in your photos (camera, lens, exposure settings, capture time and similar details) so it can show them on your website. Some metadata can be sensitive, so we treat it carefully:
- GPS location, camera and lens serial numbers, owner names and edit history are never shown publicly by default. You decide, per site and per photo, whether to show a location, and whether to show it exactly or approximately.
- The resized images we publish on your website have all embedded metadata removed. The metadata shown on a page is only what your settings allow.
- Your original files keep their metadata. Originals are delivered only to you, and to people you authorize, such as buyers or clients you allow to download.
5. How we use information
- To provide Exifed: hosting your website, processing and resizing photos, reading metadata, delivering shared galleries and digital downloads.
- To run accounts and billing: sign-in, subscriptions, invoices and plan limits such as storage.
- To send service emails: welcome and security messages, receipts, sale and contact-form notifications, and gallery invitations a photographer asks us to send. We don't send marketing email without your consent, and you can opt out at any time.
- To keep the service secure: detecting abuse, spam, fraud and attacks, and enforcing our Terms of Service.
- To support you and improve Exifed, using aggregated or de-identified information where we can.
- To meet legal obligations, such as tax and accounting rules or valid legal requests.
We do not sell or rent personal data. We do not "share" it for cross-context behavioural advertising. We do not use your photos or their metadata to train artificial-intelligence models.
6. Legal bases (EEA, UK and similar laws)
- Contract: to provide the service you signed up for.
- Legitimate interests: security, abuse prevention, service improvement and essential service communications. We balance these against your rights.
- Consent: where the law requires it, for example for optional marketing emails. You can withdraw consent at any time.
- Legal obligation: for example, keeping invoices.
7. Service providers
We share personal data only with providers that help us run Exifed. They are bound by contracts to protect it and to use it only on our instructions:
| Provider | Purpose |
|---|---|
| Cloudflare, Inc. | File storage (R2), content delivery, DNS and network security |
| Stripe, Inc. and affiliates | Subscription payments for Exifed, and photo sales through photographers' own Stripe accounts |
| MicroAuth (operated by Zyref, LLC) | Account sign-in and authentication |
| Mailraft (operated by Zyref, LLC) | Sending transactional email |
| Our hosting provider | Server infrastructure that runs the Exifed application and database |
We may also disclose information when required by law, to protect the rights, safety or property of our users, Zyref or the public, or as part of a merger, acquisition or sale of assets. In a business transfer, we would tell you before your data becomes subject to a different privacy policy.
8. Cookies and local storage
Exifed uses only cookies that are strictly necessary to provide the service:
- a session cookie on exifed.com that keeps you signed in to your dashboard;
- a short-lived sign-in cookie that protects the sign-in process;
- an access cookie on a photographer's website that remembers you opened a private gallery link or entered its password.
On photographer websites, your shopping cart is kept in your browser's local storage until you check out. We do not use advertising or analytics cookies. If a photographer adds an analytics provider, that provider may set its own cookies on their site.
9. Retention
- Account data: kept while your account is active. After you delete your account, it is erased within 30 days, apart from what we must keep.
- Photos and files: items you delete go to Trash and are permanently removed after 30 days, or sooner if you empty Trash. Database backups are kept for up to 14 days.
- Contact messages and order records: kept until the photographer deletes them, or their account is deleted.
- Security logs: kept for up to 90 days.
- Billing records: kept as long as tax and accounting laws require, typically up to 7 years.
10. Security
We protect personal data with encryption in transit (HTTPS everywhere), encryption of sensitive tokens at rest, access controls, isolated infrastructure, hashed access tokens and regular backups. Private photos are stored privately and served only to people with access. No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.
11. International transfers
Zyref and our providers may process data in the United States, the European Union and other countries. Where data leaves the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
12. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. Residents of California and other US states also have the right to know what we collect and not to be discriminated against for exercising their rights. We do not sell or share personal information as those laws define it.
To exercise these rights, email privacy@exifed.com. We may need to verify your identity before acting. If you are a visitor to a photographer's website, we may forward your request to that photographer. You may also complain to your local data protection authority.
13. Children
Exifed is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
14. Changes
We may update this policy as Exifed evolves. We will post the new version here and update the date at the top. If the changes are material, we will notify account holders by email or in the dashboard before they take effect.
15. Contact
Zyref, LLC: Exifed privacy
Email: privacy@exifed.com
General support: support@exifed.com