Privacy Policy

Last updated: 12 June 2026

1. Introduction

LivPix CRMis a web and mobile application for managing a photography and creative business. LivPix Photography and Creations, trading as Livia Pietragalla ("we", "us", "our"), operates LivPix CRM and is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal data when you use LivPix CRM and its related services (the "Service").

2. Data We Collect

We may collect the following types of information:

• Account information: Name, email address, phone number, and postal address provided during registration or form submissions.
• Project data: Photos, videos, documents, and other files you upload to the Service.
• Social media data: When you connect social media accounts (Instagram, Facebook, TikTok, LinkedIn, YouTube), we store access tokens and basic profile information necessary to post content on your behalf.
• Usage data: Browser type, pages visited, and timestamps for the purpose of improving the Service.

3. How We Use Your Data

We use your data to:

• Provide and maintain the Service
• Manage your projects, invoices, quotes, and galleries
• Publish social media content to connected platforms on your behalf
• Send transactional emails (e.g., project updates, approvals)
• Improve the Service and fix issues

4. Third-Party Services and Sub-Processors

We use the following third-party services to operate the Service. Each one is listed with its registered legal name, the country where it processes data, and the categories of personal data it receives. We do not sell personal data to any of these providers; they act only as data processors on our instructions.

• Clerk Inc. (United States) — authentication and user-account management. Processes account email addresses, names, and authentication identifiers for users of the Service.
• Resend, Inc. (United States) — transactional email delivery. Processes recipient email addresses and the contents of emails we send (e.g. project notifications, invoice deliveries, social-post failure alerts).
• Anthropic, PBC (United States) — AI-assisted content generation (Claude API). Processes the text prompts and captions you submit to the AI assistant. Your media files (photos, videos) are not sent to Anthropic.
• Meta Platforms, Inc. (United States), TikTok Ltd. (United Kingdom / Singapore), LinkedIn Corporation (United States), and Google LLC (United States, for YouTube) — social-media posting via their respective APIs. When you authorise a connection, the platform issues us an access token which we store securely and use only to publish, schedule, retrieve analytics for, or remove content you have authored inside LivPix CRM. Your use of those platforms is also subject to their own privacy policies.
• Cloudflare, Inc. (United States / global edge network) — object storage (Cloudflare R2) and content delivery. Stores the photos, videos, and documents you upload, together with generated thumbnails and previews.
• Stripe, Inc. (United States; Stripe Payments Europe, Ltd. for UK/EU) — payment processing. When you or your clients pay an invoice by card through the Service, Stripe processes the payment and the associated billing details. We never see or store full card numbers; Stripe handles card data directly under PCI-DSS.
• Intuit Inc.(United States) — QuickBooks Online accounting integration. When you connect QuickBooks, we exchange accounting data with Intuit at your instruction (see "QuickBooks (Intuit) Data" below).

Meta Platform Data

When you connect a Facebook Page or Instagram Business account, we receive and store the following Platform Data from Meta in order to provide the connected publishing and analytics features:

• The connecting Facebook user's id, name, and profile picture URL.
• The Facebook Page id, name, and Page access token.
• The linked Instagram Business account id and username.
• Post identifiers and Page-level engagement metrics (impressions, reach, engaged users) for content you have published through the Service.

This Platform Data is stored on infrastructure under our direct control (self-hosted) and is shared only with the sub-processors listed above to the extent strictly necessary to operate the Service. We do not transfer Meta Platform Data to advertising networks, analytics vendors, or any party not named in this policy.

QuickBooks (Intuit) Data

When you connect QuickBooks Online, we store an OAuth access/refresh token and your QuickBooks company (realm) id. At your instruction, we send the invoices, payments, and customer details (name, email, billing address, line items, and amounts) you create in LivPix to your connected QuickBooks company so your books stay in sync, and we read back invoice and payment status to reflect it in LivPix. We request only the accounting scope needed for this and use the data solely to operate the sync — we never sell it or use it for advertising. You can disconnect at any time from Settings or from within QuickBooks, which revokes the token.

Google / YouTube Data

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect a YouTube channel, the Service uses YouTube API Services. We request only the access needed to let you publish to and manage your own channel from inside LivPix: read-only access to your channel and video details (youtube.readonly) and permission to upload videos (youtube.upload). With your authorisation we store a Google OAuth access and refresh token and your channel id, name, and thumbnail. We use this data solely to upload, schedule, retrieve basic details for, or remove videos you have authored inside LivPix CRM. We do not use YouTube data for advertising, we do not sell it, and we do not share it with any party not named in this policy.

By using these features you also agree to the YouTube Terms of Service, and your information is handled by Google under the Google Privacy Policy. You can review or revoke LivPix CRM's access to your Google account at any time from your Google security settings, or by disconnecting the account in Settings, which revokes the token.

5. Data Storage and Security

The application is hosted on infrastructure under our direct control, and the database is self-hosted with backups retained on our own infrastructure. Uploaded files (photos, videos, and documents) are stored in Cloudflare R2 object storage (see sub-processors above). Access tokens for connected platforms — social media and QuickBooks — are stored securely and are used only to perform actions you have explicitly authorised.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. You may request deletion of your account and associated data at any time by contacting us.

7. Your Rights

Under UK data protection law (UK GDPR), you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Data portability
• Withdraw consent at any time

8. Law Enforcement & Public Authority Requests

We take the privacy of our users seriously and apply the following principles when responding to requests from public authorities (including law enforcement and government agencies) for personal data:

• We require a valid legal process (such as a court order, warrant, or equivalent under UK law) before disclosing any personal data, except in genuine emergencies involving imminent risk of serious harm.
• We push back on overly broad or vague requests and will challenge any request that we believe lacks proper legal basis or is disproportionate.
• We notify affected users about requests for their data unless we are legally prohibited from doing so (e.g., by a court-issued non-disclosure order).
• We only disclose the minimum data necessary to comply with the specific legal obligation.
• We keep records of all public authority requests received and our responses for accountability purposes.

9. Cookies

The Service uses essential cookies for authentication and session management. We do not use tracking or advertising cookies.

10. Children

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page.

12. Contact

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at [email protected].