Privacy notice

1. Data controller

Galumi México (hereinafter, “Galumi”), with its address at Monterrey, Nuevo León, México, is the controller of the personal data collected through galumi.app and its subdomains (the “Platform”), under the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) (the “Law”) and other applicable regulations.

Galumi is a platform that lets photography studios (the “Studios”) deliver sessions to their clients. For that reason we process data in two different roles:

As controller, the data of people who manage or work at a Studio (owners and photographers), of people who contact us, and of visitors to the site.
As processor, on behalf of each Studio, the data of its clients and the photographs the Studio uploads. In that case the controller is the Studio, which decides what the data is used for; Galumi processes it only to provide the service to the Studio and in line with its instructions. If you are a client of a Studio, send your requests to the Studio first; if they reach us, we will forward them to the Studio.

2. Data we process

Identification and contact: name and email address.
Account: password (stored only as an encrypted hash, never in plain text), role within the Studio, and sign-in records.
Studio data: business name, subdomain, logo and brand colors, the plan purchased and its validity period.
Content: photographs and files uploaded by the Studio, session titles and dates, and the selections, favorites and retouching notes that clients leave.
Technical data: IP address, browser and device, date and time of requests, and security and audit logs.

We do not request sensitive personal data. Photographs may show people; Galumi does not analyze them to identify anyone and does not extract biometric data from them. The Studio decides which images to upload and must have the consent of the people photographed where the law requires it.

We do not knowingly process data of minors, except what appears in photographs that the Studio uploads on its own responsibility and with the authorization of the person holding parental authority or guardianship.

3. Purposes

Necessary purposes (without them we cannot provide the service):

Create and manage accounts and invitation-based access.
Host, process (thumbnails and web versions) and deliver the photographs to the clients the Studio invites.
Send the service’s own emails: invitations, password resets, gallery expiration notices and plan renewal notices.
Protect the Platform: authentication, attempt limits, abuse and fraud prevention, and audit logs.
Manage the plan purchased and the business relationship with the Studio.
Handle requests, questions and the exercise of rights, and comply with legal obligations.

Secondary purposes: today we do not use your data for marketing, advertising or commercial profiling. If we ever do, we will tell you beforehand and you will be able to refuse without affecting the service.

We do not sell or rent personal data. To operate the Platform we use providers that act as processors and process data only on our behalf:

Cloudflare, Inc. (United States and its global network): application hosting, database, photograph storage, email delivery and aggregated visit measurement.

These disclosures do not require your consent. We will transfer data to third parties without it only in the cases the Law allows (for example, upon a request from a competent authority).

You may access your data, rectify it, cancel it or oppose its processing, as well as withdraw your consent or limit its use, by writing to hola@galumi.app with:

your name and the email address you use on the Platform, and a document proving your identity (or that of your representative and their power of attorney);
a clear description of what you are requesting and the data involved.

We will reply within a maximum of 20 business days from receiving the complete request and, if it is granted, we will carry it out within the following 15 business days. Some data cannot be cancelled while it is still needed to comply with a legal obligation or the contract with the Studio.

If you are a client of a Studio and want your photographs deleted, the request must go to the Studio (see section 1).

6. Retention

Account data is kept while the account or the Studio is active and, afterwards, only for as long as needed to comply with legal obligations or handle claims.
Photographs follow the validity period the Studio sets for each gallery: once it expires, they are deleted after a grace period of 30 days, unless the Studio reactivates it earlier.
Technical and security logs are kept for a reasonable time to protect the Platform.

7. Security

We apply administrative, technical and physical measures to protect data: encrypted connections (HTTPS), passwords stored as an encrypted hash, private photograph storage with temporary access links, and strict separation between Studios. No system is infallible; if a breach occurs that significantly affects your rights, we will let you know.

8. Cookies and local storage

We use only essential cookies and local storage: they keep you signed in and remember preferences such as the light or dark theme. We do not use advertising cookies or third-party tracking cookies. Visits are measured with Cloudflare Web Analytics, without cookies and in aggregate. The details are in the cookie policy.

9. Changes to this notice

We may update this notice because of legal or service changes. We will publish the current version on this page with its update date and, if the change is significant, we will notify account holders by email.

10. Authority

If you believe your right to data protection has been infringed, you may go to the competent personal data protection authority in Mexico.