Privacy Policy

Two roles

• For vendors’ own accounts and for visitors to iwopo.com, iwopo decides how information is used (we are the "controller").
• For information vendors keep about their clients and guests — inquiries, contracts, galleries, files — the vendor decides, and iwopo processes it for them (we are the "processor"). Clients should contact the vendor first about their information; we will help the vendor respond.

What we collect

• Account details: name, business name, email, phone, password (stored only as a secure hash), country, time zone, settings.
• Billing: plan, billing history and the last digits and type of your card — handled by Stripe; we never see or store full card numbers.
• Content vendors add: client names and contact details, event details, contracts and signatures (with the time, IP address and device recorded for the signature), invoices, photos, videos and files.
• Gallery face grouping: when a vendor uses it, face measurements are created from gallery photos (and from a selfie a guest chooses to upload) to group photos of the same person. This runs on iwopo’s own servers; when they are busy, a gallery may be processed by Amazon Rekognition instead. The measurements are used only for that gallery, never sold or used to identify people elsewhere, and are deleted — including Amazon’s copy — when the gallery is deleted.
• Security and usage: sign-in events, trusted devices, IP addresses, browser type, when an account was last used, and basic logs that keep iwopo secure and working.
• Your approximate country, worked out from your IP address on our own servers, to show prices in your currency.
• Messages you send us.

How we use it

• To provide iwopo: accounts, sign-in, the vendor’s tools and the pages their clients use.
• To bill subscriptions, prevent fraud and keep accounts secure (for example two-step sign-in).
• To send service emails: sign-in codes, receipts and notices about your account. We do not send marketing emails without your consent, and you can opt out at any time.
• To fix problems and improve iwopo.
• To meet legal obligations.
• We do not sell personal information, and we do not use it for third-party advertising.

Service providers we use

• Hostinger — servers and database (United States).
• Cloudflare (R2) and Amazon Web Services — storage of photos, videos and files.
• Google Workspace — sending email.
• Stripe — subscription payments, and card payments vendors take on their own connected Stripe accounts.
• ExchangeRate-API — daily currency exchange rates (no personal information is sent).
• Amazon Web Services (Rekognition) — backup face grouping for galleries when our own servers are busy.
• Anthropic and Google (Gemini) — AI features such as the chat assistant. Content is sent only when an AI feature is used, and only what that feature needs.
• Each provider only receives what it needs to do its job and is bound to protect it.

International transfers

iwopo is run from the United States and our providers may process information in other countries. Where the law requires it (for example for the EU, UK or Canada), we rely on appropriate safeguards such as standard contractual clauses.

How long we keep it

• Account and content: for as long as the account exists. On the Free plan, the content of an account no one has signed in to for 7 months is removed (after an email at 6 months); the account itself is kept.
• Billing records: as long as tax and accounting law requires.
• Security logs: for a limited period, then deleted.
• Vendors can delete their clients’ information, galleries and files at any time; deleted items are removed from our systems within a reasonable time, including backups.

Security

Connections are encrypted (https), passwords are hashed, sign-in can require a code sent by email, each vendor’s data is kept separate and tested for it, and access is limited to people and services that need it. No system is perfectly secure; if a breach affects your information we will tell you and the relevant authorities as the law requires.

Your rights

Depending on where you live (for example under the GDPR in Europe, UK GDPR, Canada’s PIPEDA or California’s CCPA), you may have the right to access, correct, delete or download your information, to object to or restrict some uses, and to complain to a data-protection authority. Write to sales@iwopo.com; we answer within the time the law requires. If your information is held by a vendor (for example in a gallery or contract), we will pass your request to that vendor and help them.

Children

iwopo accounts are for adults. Photos in a vendor’s galleries may include children; the vendor is responsible for having the right to share them.

Cookies

iwopo does not use advertising or third-party tracking cookies. See our Cookie Policy.

Changes

We will post updates here and tell account holders about significant changes. Contact: sales@iwopo.com · IWOPO, LLC, 3 Germay Dr, Unit 4 #3327, Wilmington, DE 19804, USA.