Privacy policy

Vaultpx stores other people's private photos, so we take care with them. This page explains what we collect, why, who helps us run the service, how long we keep things, and what you can ask us to do. We try to say it plainly.

1. Who is responsible

Vaultpx is run from Nairobi, Kenya, by Saiyanka Media. We follow Kenya's Data Protection Act, 2019. To confirm: the full legal name and address of the business, and whether it is registered with the Office of the Data Protection Commissioner.

Contact us at To confirm: a contact email address.

There are two kinds of people in Vaultpx. Photographers have an account. Their clients open galleries they are sent. For the photos in a gallery, the photographer decides what is uploaded and who sees it, and Vaultpx stores and shows the photos for them. To confirm: a lawyer to confirm how the roles of "controller" and "processor" apply to each kind of data.

2. What we collect

From photographers

• Your email address and password, or your Google account details if you sign in with Google.
• Your studio name, gallery address, logo and button colour.
• The photos you upload, and the gallery details you set, such as titles, dates, sets, PINs and download settings.
• Payment records: the plan, amount, date, and the M-Pesa receipt or card reference. For M-Pesa we also keep the phone number you paid from. We show only its last four digits in your account. We never see or store card numbers, because our card provider handles those.

From clients

• An email address, only when you mark a favourite or send a selection. The photographer sees it.
• The photos you marked as favourites and any selection you sent.
• What you do in a gallery: that you opened it, and which photos or ZIP files you downloaded. The photographer sees totals for their galleries.
• Wrong PIN attempts. To stop people guessing a PIN, we keep a count of failed tries against a scrambled, one-way code made from your internet address. We can't turn that code back into your address.

From people who join the waitlist

• Your email address and country, used only to tell you when Vaultpx is ready.

Like most websites, our hosting providers also see technical details such as your internet address and browser when you visit, and keep them in security and error logs. To confirm: how long those logs are kept by each provider.

3. What happens to photos

• We keep your original files exactly as you uploaded them.
• We make smaller copies and thumbnails for viewing. These have location (GPS) and camera details removed.
• We read the date a photo was taken, to put photos in order.
• Clients can download original-size photos only if the photographer allows it.
• Photos are stored in private storage. They can only be opened through short-lived links: about an hour for viewing and ten minutes for downloads.

4. Why we use your information

• To run Vaultpx: sign you in, store and show photos, let clients favourite and download.
• To take payment and keep records, and to remind you before a plan is due.
• To keep Vaultpx safe: limit PIN guessing, stop abuse, find and fix faults.
• To email you things you need, such as a selection a client sent you, receipts, and reminders.
• To follow the law.

We do not sell your information. We do not show adverts. We do not use your photos for advertising or to train AI. We do not use tracking tools or analytics cookies.

5. Cookies and similar storage

We use only what is needed to make Vaultpx work:

• A sign-in cookie that keeps photographers signed in.
• A gallery cookie that remembers a client has entered a gallery. It lasts 30 days and can't be read by scripts on the page.
• A setting in your browser that remembers whether you chose the light or dark look.

Because these are needed for the service and not for tracking, we don't show a cookie banner.

6. Who helps us run Vaultpx

We use these companies to provide the service. They handle your information only to do that job for us.

• Supabase: our database and sign-in.
• Cloudflare: private photo storage, fast ZIP downloads, and our domain.
• Vercel: hosting for the website.
• Resend: sending our emails.
• Safaricom (M-Pesa): taking shilling payments.
• Paystack: taking card payments.
• Google: only if you choose to sign in with Google.

Photographers also see what their own clients do in their galleries, as described above. We may share information if the law or a court requires it.

To confirm: where each provider stores data (countries and regions), and the wording needed for sending personal data outside Kenya under the Data Protection Act.

7. How long we keep things

• Photos and gallery details: until you delete them or your account.
• Deleting a gallery removes its photos from storage, along with its favourites, selections and activity records.
• If a paid plan lapses: your galleries close and your photos are kept for 90 days. We email you reminders, then delete them for good.
• Payment records (plan, amount, date and receipt reference): To confirm: how long we must keep them for tax and accounting. When you delete your account, we remove your name, email and phone number from them, so they no longer show who you are.
• Deleting your account removes your studio, galleries, photos, clients' favourites and selections, and your sign-in, straight away.
• Waitlist emails: until Vaultpx launches or you ask us to remove yours.

8. Your choices and rights

Under Kenyan law you can ask us to:

• tell you what personal information we hold about you, and give you a copy;
• correct information that is wrong;
• delete your information;
• stop using your information in some ways.

Photographers can delete galleries and photos at any time, and can delete their whole account from the Account page in their dashboard. To use any other right above, write to us at the address in section 1. We will reply, and where we agree, act within To confirm: the number of days we promise.

If you are a client and want your photos or favourites removed, ask the photographer first, or write to us. If you are unhappy with how we handled your information, you can complain to the Office of the Data Protection Commissioner of Kenya.

9. Keeping information safe

• Photo storage is private and links are short-lived.
• Gallery PINs are stored scrambled so we can check them, and encrypted so the photographer can see them again. Too many wrong tries locks the gallery for a while.
• Each photographer can only see their own studio, galleries and clients.
• Connections to Vaultpx are encrypted.

No service is perfectly safe. If something goes wrong that affects your information, we will tell you and the authorities as the law requires.

10. Children

Vaultpx accounts are for adults. Photographers may share photos that include children. The photographer is responsible for having permission to do so.

11. Changes

If we change this policy in a way that matters, we will email photographers. The date at the top shows when it was last updated. See also our terms of service.