Legal

Privacy Policy

Last updated: October 2026

The PICMIZ system is operated by Yosef Mizrahi, registration no. 319141180 ("we", "the System" or "the Company"). We respect the privacy of the users of our services ("user" or "you"). This Privacy Policy sets out the types of information we collect, how we use it, which information we do not share, and how we protect your information when you use the System, on the website and in the picmiz Android app, to upload photos, videos and websites, to back up, and to send media.

1. Consent
By using the System, registering for it or uploading content, you express your consent to this Privacy Policy. If you do not agree to the terms of this policy, in whole or in part, you must refrain from using the Service.

2. The Information We Collect
We collect two main types of information:

A. Information you actively provide
Registration and account details: the name and email address you provide when opening the account.
Content and media: photo files, videos, website files and media that you upload to the System for display, backup or sending.
Information about your clients: details you enter in the calendar and in client management, such as name, phone number, email address, event details, quotes and notes. You are the controller of this information, and picmiz processes it on your behalf and only in order to provide you with the Service.

B. Technical and statistical information (automatic)
In order to operate the System, improve it and provide the best user experience, we automatically collect technical information about your use of the System, such as:
Device and browser data: IP address, browser type, operating system, language settings and device type.
Usage and performance data: system errors (Error Logs), load times, storage volume in use, traffic data (Bandwidth), and the pages/features of the System you visited or used.
Cookies and monitoring technologies: we use cookies and standard tracking technologies to maintain your session, for security, and to collect analytical information.
In the picmiz Android app, the rules set out in Section 5 apply.

3. Purposes of Use of the Information
The information collected is used solely for the following purposes:

Providing and operating the Service: enabling the upload, storage, display, backup and sending of your media and files.
Improving and developing the System: analyzing technical and usage information in order to identify faults, improve performance, develop new features and continually improve the interface.
Personalizing the experience and content: adapting the user interface, settings and content in the System to your preferences and needs.
Security and fraud prevention: protecting the System and other users against misuse, breaches or unlawful activity.

Emails from the Service: we send the email messages required to operate the Service, including: account and security messages (verification, password reset, sign-in alerts); gallery and delivery messages (gallery sharing, a file ready for download, client selections); replies to enquiries sent to our support addresses; messages within the partner program; and operational messages relating to orders and to the work between photographers and their clients. These messages are an integral part of the Service, and preferences can be changed in the personal area. PicMiz does not send any marketing email. If we ever decide to, we will ask you explicitly first.

Email enquiries to the Service
Messages sent to our email addresses (for example [email protected]) are stored in our systems, including attachments, for the purpose of handling the enquiry, tracking the conversation history and improving the Service. These messages are kept for up to 24 months from the date the enquiry is closed, and are deleted thereafter. Earlier deletion can be requested through our privacy address.

Retention of information
We keep the information for as long as the account is active, and after a deletion request as set out in Section 7.

4. Commitment Not to Sell Information, and Sharing Information with Third Parties:
Explicit commitment: we do not sell, will not sell and will not rent personal information or user data to any third party for any marketing, advertising or commercial purpose whatsoever.
Sharing only where required: we will share information with third parties only in the cases defined below:
External service providers (Processors): companies that provide us with cloud computing infrastructure, storage services, payment processing/subscription management, or technical analytics tools, only to the extent required to operate the Service, and under a commitment to maintain confidentiality and information security in accordance with the strict European GDPR standard.
Legal requirement: where we are obligated to do so under a court order, a provision of law, or a demand of a competent authority under law.
Protection of rights: in the event of a legal dispute, a claim, or a substantial suspicion of an offense or of a breach of the System's Terms of Use.
Structural change: in the event of a merger, sale or transfer of the Company's business (provided that the acquiring party assumes the obligations of this Privacy Policy).

5. picmiz Android app
The picmiz Android app is intended for studio account owners and their team members, and lets them manage from their phone the same account they manage on the website. Everything in this Privacy Policy applies to the app as well, and this section sets out what is specific to it.

Sign-in and account
Sign-in: with an email address and password, or with a Google account through the Android Credential Manager. When you sign in with Google, we receive from Google your name, your email address and your Google account ID. Google is involved only if you choose to sign in with it.
Opening an account: done on the website (the app sends you there), or on your first sign-in with a Google account.
Two-step verification: if you have turned on two-step verification for the account, you will also be asked at sign-in for a code from your authenticator app.
Connected devices: at sign-in the app sends our server the device model (manufacturer and model, for example Samsung SM-S918B) and the app version. We keep them in the account's list of connected devices, together with the time of last use and a truncated IP address. You can view this list and disconnect devices from it at any time.
Sign-in tokens are stored on the device encrypted, with a key held in the secure Android key store (Android Keystore).

Photos, videos and files
Access to files: the app has no permission to access the device's gallery or storage. It receives only the photos and videos you selected yourself in the system photo picker (Photo Picker), or shared to it from another app.
Upload and use: the files are uploaded to the account's storage and are used for galleries, file transfers, collections and comments, exactly as on the website.
Background operations: uploads and downloads run in the background as a foreground service, with a visible notification throughout, so that they are not interrupted.
Sending a transfer by email: when you send a transfer to a recipient, you enter the recipient's email address, and our server sends the transfer link to it.
Download to the device: files are downloaded to the device only when you explicitly ask for it, and are saved in your gallery or Downloads folder.

Calendar and client management
In the app, as on the website, you can manage information about your clients: name, phone number, email address and notes, as well as events (date, location, price, amount paid and notes), quotes, tasks and the email addresses of team members. This is information you enter about other people. For this information you are the controller, and picmiz processes it on your behalf and solely in order to provide you with the Service, like any other content you upload to the System. We do not use it for any other purpose and we do not send marketing mailings to your clients.

What is stored on the device
Local cache: so that the app loads quickly and works on a weak connection too, it keeps a local copy of the account's data on the device (a database and settings).
When you sign out: the local cache (galleries, notifications, transfers and home screen data), local collections, notification preferences, temporary file access links and the image cache are deleted immediately. Uploads and downloads that have not finished stay in the queue, so that no work is lost.
When a different account signs in on the same device: everything left over from the previous account is deleted as well, including the upload and download queues.
When a sign-in expires and the app signs itself out, the data on the device is not deleted.
The app's data is not included in the device's cloud backup and is not transferred to a new device.

Notifications
The app's notifications are created on the device itself: transfer progress, and updates from the notification feed that the app fetches from our server. We do not use a third-party push notification service. To show notifications, the app asks for the Android notifications permission, which you can turn off at any time in the device settings.

Analytics consent
On first launch a "Privacy and analytics" window is shown, with a choice between "Full measurement" and "Essential only". You can change the choice at any time in the app's settings. The choice is stored on the device, and is also sent to our server as a record of the consent, together with the user ID, the device model, the app version and the IP address. At present the app runs no measurement or analysis of its use whatsoever, regardless of the choice.

Support
The "Write to support" action opens your email app with a draft message that includes the app version, the Android version, the device model, the language, the account name and the plan. The draft is shown to you before sending, and nothing is sent until you send it yourself. A message you sent is kept like any email enquiry to the Service (Section 3).

What the app does not do

The app contains no third-party components for analytics, advertising, crash reporting or tracking.
The app has no purchases: the subscription and payment are managed on the website only.
The app does not access location, contacts, the camera, the microphone or the device's full gallery.
All of the app's communication is encrypted (HTTPS only), and unencrypted traffic is blocked in it.

Service providers
The app communicates only with the picmiz servers and with the storage and content delivery (CDN) providers the server directs it to for uploading files, displaying them and playing videos. These are the service providers described in Section 4. Google is involved only when you sign in with a Google account.

6. Information Security
We employ customary technological and organizational information-security measures (including encryption of data in transit), and regularly and systematically scan for threats and risks in order to protect your personal information and media against unauthorized access, to identify weaknesses in advance, and to prevent loss or misuse. However, no system is completely secure, and we cannot guarantee 100% absolute security.

7. User Rights (Right of Access and Correction)
In accordance with the Protection of Privacy Law, 5741-1981, every user is entitled to review the information collected about them and held in our database, and to request its correction or deletion if they find that the information is inaccurate, incomplete or out of date.
To exercise this right, you can contact us at: [email protected]

Account deletion
The account owner can request deletion of the account and of the data in it: in the picmiz Android app, from the "More" menu, or by emailing [email protected] from the account's email address. The request goes to our support team, which completes the deletion within 30 days of receiving the request and lets you know when it is complete.
What is deleted: the account and its users, the galleries, the uploaded photos and videos, the projects, the calendar and client-management data, and your backups in the System.
What is kept: records the law requires us to keep, such as billing records and invoices, for the period the law sets; the record of the choices made in the cookie and analytics consent window, as evidence of the choice, for up to 3 years from the date of the choice; and the correspondence with support, including the request itself, for up to 24 months from the date the enquiry is closed (Section 3).
More details on the account deletion page.

8. Changes to the Privacy Policy
We reserve the right to update this Privacy Policy from time to time. In the event of material changes, an appropriate notice will be published in the System's interface, or an email will be sent to registered users. Continued use of the System after the policy has been updated constitutes agreement to the updated terms.

9. Contact
For any question, request or enquiry regarding privacy and information security in the System, you can contact us at:

Operator of the Service: Yosef Mizrahi, registration no. 319141180
Email: [email protected]