Privacy Policy
Last updated: 10 November 2026
1. Who we are
Photoa is run by PHOTOA Digital Services in Tanzania. Postal address: P.O. Box 2857, Dodoma, Tanzania. You can contact our Data Protection Officer at privacy@photoadigital.com.
2. What we collect and why
| Data | What it includes | Why we use it | How long we keep it |
|---|---|---|---|
| Account | Email, display name, password (stored as a hash by Supabase Auth), sign-in times | To run your account and send service emails | Until you delete your account |
| Your content | Ideas, answers, niche reports, outlines, generated sections, versions, exported files | To create, edit and store your products | Until you delete the product or your account; download links expire after 1 hour |
| Credits and plans | Credit history, plan, renewal date, Paddle customer and subscription IDs | To charge and refund you correctly | Until you delete your account, unless tax law requires longer |
| Mobile money | Phone number, order reference, amount, status | To confirm your payment | Phone number removed automatically after 90 days; payment record kept for tax |
| Usage and AI logs | Step, model, token counts, cost, errors | To keep the service working, control costs and prevent abuse | 12 months |
| Support messages | Messages you send us | To help you | 24 months |
| Browser storage | Sign-in session, Paddle checkout cookies | To keep you signed in and complete checkout | No analytics or advertising cookies |
Card numbers never reach Photoa; Paddle collects them. We never sell your personal data or use it for advertising.
3. How the AI uses your content
Your content is sent to Anthropic only to produce your product. It is not used to train AI models.
4. Who we share it with
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | EU (Frankfurt) |
| Anthropic | AI models | United States |
| Paddle | Card checkout, tax, receipts, subscriptions (merchant of record) | — |
| ClickPesa | Mobile money payments | Tanzania |
| Resend | Email delivery | — |
| Render | Builds PDF and DOCX files; keeps nothing after the request | — |
| Lovable | Hosts the web app | — |
5. Transfers outside Tanzania
Your data is processed abroad by the providers above, under their data processing agreements and the safeguards required by the Tanzania Personal Data Protection Act 2022 and, for EU and UK users, the GDPR.
6. How long we keep it
As shown in the table in section 2.
7. Your rights
You can ask to access, correct or delete your data, object to or restrict how we use it, and get a copy of it. Email privacy@photoadigital.com and we will answer within 30 days. You can also complain to Tanzania's Personal Data Protection Commission or your local regulator.
8. Security
We use per-user access rules on every table, private file storage, encryption in transit, and keep secret keys on the server only.
9. Children
Photoa is not for anyone under 18.
10. Changes and contact
If we change this policy we will update the date above and tell you about important changes by email. Questions: privacy@photoadigital.com or support@photoadigital.com.