Privacy Policy

Last updated: May 2026

ComoSelect is a photo selection platform for photographers and their clients, with a free plan and simple paid upgrades — no advertising on any plan. We take your privacy seriously and collect only the minimum data necessary to provide the service.

1. Who we are

ComoSelect ("we", "us", "our") is operated as an independent service available at comoselect.com. For any privacy-related questions, contact us at: privacy@comoselect.com

2. What data we collect

We collect the following types of data:

Account data — when you sign in with Google, we receive your email address and name from Google. We store your email address to identify your account.
Project data — project names, photo metadata (file names, URLs), and selection flags you create while using the service.
Photos — images you upload are stored on Cloudflare R2 object storage. We do not process or analyze photo content.
Client email — if you optionally provide a client's email address, we use it solely to send notifications about your gallery.
Usage data — basic usage information collected automatically through our infrastructure (Supabase, Cloudflare) for service operation and security.

3. How we use your data

To provide and operate the ComoSelect service
To send transactional emails (gallery notifications, selection confirmations)
To process payment for paid plans
To improve and debug the platform

We do not sell your personal data to third parties. We do not display advertising on any plan.

4. Cookies

We use the following types of cookies and local storage:

Authentication — session tokens to keep you logged in (Supabase Auth)
Preferences — UI preferences such as dark mode and column count (stored in localStorage)

You can disable cookies in your browser settings. Note that disabling cookies may affect your ability to use the service.

5. Third-party services

We use the following third-party services to operate ComoSelect:

Supabase — database and authentication (Privacy Policy)
Cloudflare — hosting, CDN, and photo storage (Privacy Policy)
Google OAuth — sign-in (Privacy Policy)
Stripe — payment processing for paid plans (Privacy Policy)
Resend — transactional email (Privacy Policy)

6. Data retention

We retain your data for as long as your account is active. You can delete your projects and photos at any time from within the app. To permanently delete your account and all associated data, contact us at privacy@comoselect.com.

7. Your rights

Depending on your location, you may have the following rights regarding your personal data:

Right to access the data we hold about you
Right to correct inaccurate data
Right to delete your data
Right to data portability
Right to object to processing

To exercise any of these rights, contact us at privacy@comoselect.com.

8. Roles under GDPR — photographer and ComoSelect

If you are a photographer using ComoSelect to manage client galleries, the following data processing roles apply under the EU General Data Protection Regulation (GDPR):

You (the photographer) are the data controller for any personal data belonging to your clients — including their email address, photo selections, notes, and any photos in which they appear as subjects. You are responsible for having a lawful basis to process your clients' personal data (typically a contract or legitimate interest) and for informing them that their data is being processed.
ComoSelect acts as a data processor on your behalf. We store and process client data solely to provide you with the service. We do not use client data for our own purposes, and we do not share it with third parties beyond the sub-processors listed in Section 5.

As data controller, you are responsible for ensuring that your use of ComoSelect complies with applicable privacy laws in your jurisdiction, including obtaining any necessary consents from your clients before sharing their personal data (such as their email address) with us.

9. Legal basis for processing (GDPR)

For users in the European Economic Area, we process personal data on the following legal bases:

Contract performance — processing your account data and uploaded content is necessary to provide the service you have requested, including billing for paid plans.
Legitimate interests — basic usage analytics and security monitoring, where our interest in maintaining a secure and functional service outweighs any privacy impact.

10. International data transfers

ComoSelect uses third-party infrastructure that may process data outside the European Economic Area. Specifically:

Supabase — database hosted on AWS (EU region where available). Supabase complies with GDPR and provides appropriate safeguards for international transfers.
Cloudflare — global CDN and R2 storage. Cloudflare maintains Standard Contractual Clauses and other transfer mechanisms compliant with GDPR.
Resend — transactional email service. Email delivery data is processed in accordance with their privacy policy and GDPR obligations.

By using ComoSelect, you acknowledge that your data may be transferred to and processed in countries outside the EEA, subject to the safeguards described above.

11. Children's privacy

ComoSelect's account holders (photographers) must be adults. We do not knowingly collect account registration data from children under 13.

Separately, photos uploaded to ComoSelect by a photographer may depict minors as subjects (for example, children at a wedding, family portrait, or event). In this case, the photographer — as the data controller under Section 8 — is responsible for having a lawful basis to photograph and process images of minors, including any consent required from a parent or legal guardian under applicable law. ComoSelect, as data processor, does not analyze, profile, or use uploaded photos for any purpose beyond storing and displaying them as instructed by the photographer, and does not perform facial recognition or biometric identification on any photo.

12. Data security and breach notification

Photos and data are encrypted in transit (HTTPS/TLS on all connections) and at rest (server-side encryption provided by our infrastructure providers, Supabase and Cloudflare). Access to production systems is restricted to the service operator.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, in accordance with Article 33 GDPR, and will notify affected users without undue delay where the breach is likely to result in a high risk to them, in accordance with Article 34 GDPR.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will notify users of significant changes by updating the date at the top of this page. Continued use of ComoSelect after changes constitutes acceptance of the updated policy.

For any questions about this Privacy Policy, contact us at privacy@comoselect.com