Privacy Policy

1. Who we are

Instant Passport Photo ("we", "us", "our") operates the website at instantpassportphoto.co.uk. We are the data controller for the personal data we process. You can contact us at support@instantpassportphoto.co.uk.

2. Data we collect

When you use our service, we collect:

• Email address — provided by you at checkout, used to deliver your passport photo and any service notifications.
• Uploaded photograph — the selfie you upload for processing. This is used solely to produce your passport photo.
• Payment information — processed entirely by Stripe. We never see or store your card number, expiry date, or CVV.
• Usage data — standard server logs (IP address, browser type, pages visited). Used for security and service improvement.

3. How we use your data

• To process your selfie and produce a compliant passport photo.
• To deliver your photo and order confirmation by email.
• To manage retries and refunds where applicable.
• To comply with our legal obligations.
• To improve and maintain our service.

Our legal basis for processing is performance of a contract (to fulfil your order) and, where applicable, our legitimate interests in operating and improving our service.

4. Third parties we share data with

We use the following trusted third-party services to operate:

We do not sell your personal data to third parties. All processors are contractually bound to handle your data in accordance with applicable data protection law.

5. Data retention

• Uploaded and processed photos: Deleted within 30 days of your order date.
• Email address: Retained for up to 12 months for support and legal purposes, then deleted.
• Payment records: Retained by Stripe in accordance with their data retention policy and applicable financial regulations.

6. Cookies

We use only essential session cookies required for the checkout process (provided by Stripe). We do not use tracking, advertising, or analytics cookies.

7. Your rights (UK GDPR)

You have the right to:

• Access the personal data we hold about you.
• Rectify any inaccurate data.
• Erase your data (right to be forgotten).
• Restrict how we process your data in certain circumstances.
• Portability — receive your data in a machine-readable format.
• Object to processing based on legitimate interests.

To exercise any of these rights, email us at support@instantpassportphoto.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

8. Security

All data is transmitted over TLS (HTTPS). Stored photos are held in Cloudflare R2 with access restricted to our application. We apply industry-standard security measures to protect your data, though no system is completely immune to risk.

9. Changes to this policy

We may update this policy periodically. The effective date at the top of the page will reflect the most recent update. Continued use of the service after a change constitutes acceptance of the updated policy.

10. Contact

For any privacy-related questions or requests, contact us at support@instantpassportphoto.co.uk.