PhotoFlow privacy policy

Last updated: 12 September 2026

Who to contact

PhotoFlow is the photograph preparation and publishing service provided by Creyolve at photo.creyolve.com. For questions about personal information, access, correction or deletion, contact hello@fivefields.gallery.

This policy covers PhotoFlow accounts and the service we operate. Photographers using PhotoFlow to run their own galleries are responsible for the photographs and customer information they choose to collect and publish. For an enquiry about a particular photographer’s gallery or order, contact that gallery as well as us where appropriate.

Information the service handles

• Accounts and workspaces: your email address, profile information, sign-in identity, workspace membership and permissions.
• Photographs: uploaded or connected-library photographs, previews, edits, titles, descriptions, tags and embedded metadata. Metadata may include capture dates, camera information and location coordinates. Photographs may contain identifiable people.
• Preparation and publishing: generated descriptions, your selections and approvals, destination settings, scheduled dates, publication identifiers and delivery or error records.
• Connected services: the account identifiers, profile names, boards or destinations and authorization credentials needed for the features you connect.
• Orders and enquiries: contact and delivery details, ordered products, payment references and fulfilment information when you use shopping or contact features.
• Service use: page and product events, referring channels, device/browser information and technical request logs used to operate and troubleshoot the service.

How and why information is used

We use account information to provide the service you request; photograph content to organise, prepare and publish your work; and order information to process purchases and fulfilment. These activities support our contract with you or steps you ask us to take before entering one. We use operational records for our legitimate interests in protecting accounts, preventing duplicate publication, maintaining reliability and resolving support issues. We may retain information to meet legal obligations. Where processing requires consent, you can withdraw that consent by contacting us or using the relevant controls; withdrawal does not undo earlier lawful processing.

Some preparation features send photograph previews, metadata or text to configured AI providers to suggest descriptions or classifications. Review generated content before publication. Connecting a social account does not itself authorize every photograph to be published. Available publishing features follow the selections, approvals and rules you set.

Connected social accounts, including Pinterest

When you connect an account, the provider asks you to authorize access. PhotoFlow receives authorization credentials and the account information needed to identify your connection. Credentials are stored on the server; Pinterest credentials are encrypted before storage. We use connected-account access to carry out the features you request, rather than requesting your social-account password.

When Pinterest is available and you connect it, PhotoFlow reads your authenticated account’s profile, boards and Pins to let you choose a board and reconcile publication. It sends the selected photograph rendition, approved title and description, alternative text, board and exact public photograph link when a selected Pin is due. Pinterest selections require explicit approval, including any batch you choose through Select All. General photograph preparation alone is not Pinterest publishing approval.

You can disconnect in Settings and revoke access through the provider. Disconnecting stops future use of that connection and removes its stored local credentials. Publication history and remote identifiers are retained to show what was published and prevent accidental duplicates. Disconnecting does not delete content already published on the provider; manage that content there.

Who receives information

Information is shared with service providers as needed to operate the selected features. These include Cloudflare for hosting, storage and delivery, Supabase for account and database services, configured AI services for requested preparation, connected social providers for publishing, and payment and print-fulfilment providers for purchases. Only connect accounts and publish photographs you have authority to use. Workspace members with the relevant permissions may access shared workspace content.

Photographs and text published to a public gallery or social account are visible to that audience and may be copied or indexed. External services, including Pinterest, handle information under their own privacy policies. Provider infrastructure may process information outside the UK. Contact us for details of the providers and transfer arrangements relevant to your use of PhotoFlow.

Cookies, browser storage and attribution

PhotoFlow uses cookies or browser storage for sign-in, security, preferences and shopping continuity. Public links may contain campaign parameters identifying a referring channel and photograph. Where channel attribution is enabled, it can connect a visit with product views and an order. Attribution stored in a browser tab expires after 30 minutes; associated event or order records may be kept for longer under the retention criteria below. Browser controls can restrict storage, although some account or shopping functions may then be unavailable.

How long information is kept

Account and photograph information is kept while needed to provide your workspace and the features you use. Scheduling and publication records are kept while needed to carry out your instructions, maintain history and prevent duplicates. Order and payment references may be retained for accounting, disputes and legal obligations. Technical records are kept for operational and security needs. Retention depends on the type of record and its purpose; disconnecting one integration does not delete the whole workspace. Contact us to request deletion or details of the retention applicable to your records. Removal from active systems may not immediately remove copies in backups or records that must be retained for legal reasons.

Your choices and rights

You can ask for access to your personal information, correction, deletion, restriction, or a portable copy where applicable, and object to processing based on legitimate interests. Email hello@fivefields.gallery with enough information to identify the relevant account or gallery. We may need to verify your identity before acting. You can also complain to the UK Information Commissioner’s Office. Providing account information is necessary for sign-in; optional integrations can be left disconnected.

Changes

We will update this page when the service’s information handling changes. The date above identifies this version. Please check it when enabling new features or integrations.