GDPR & Data Rights

Effective date: February 25, 2026

YOUR RIGHTS UNDER GDPR

If you're located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access — Request a copy of all personal data we hold about you
• Right to Rectification — Request correction of inaccurate personal data
• Right to Erasure — Request deletion of your personal data ("right to be forgotten")
• Right to Restriction — Request that we limit how we process your data
• Right to Data Portability — Receive your data in a structured, machine-readable format
• Right to Object — Object to processing of your personal data
• Right to Withdraw Consent — Withdraw consent at any time where processing is based on consent

DATA CONTROLLER

PocketShot acts as the data controller for the personal data collected through the app.

LAWFUL BASIS FOR PROCESSING

We process your data under the following legal bases:

• Contract Performance — Processing necessary to provide the PocketShot service (photo generation, account management)
• Legitimate Interest — Analytics and app improvement (with minimal data collection)
• Consent — Push notifications and optional features

DATA WE PROCESS

| Data | Purpose | Retention | Legal Basis | |------|---------|-----------|-------------| | Email address | Account management | Until account deletion | Contract | | Device info | App compatibility | Until account deletion | Legitimate interest | | Usage events | App improvement | 90 days | Legitimate interest | | Photos | AI generation | Until album is deleted by user | Contract | | Generated photos | Delivery to you | Until album is deleted by user | Contract |

THIRD-PARTY PROCESSORS

We use the following sub-processors:

• Google Gemini AI (Google LLC, USA) — Photo processing and AI generation. Data transferred under EU-US Data Privacy Framework.
• Supabase (USA) — Database and file storage. SOC 2 Type II certified.
• RevenueCat (USA) — Credit purchases and transaction management.
• PostHog (USA) — Anonymized usage analytics.
• Apple Inc. (USA) — Authentication and payment processing.

INTERNATIONAL DATA TRANSFERS

Your data may be transferred to and processed in the United States. These transfers are protected by:

• EU-US Data Privacy Framework
• Standard Contractual Clauses (SCCs) where applicable
• Adequacy decisions where available

DATA PROTECTION OFFICER

For GDPR-related inquiries, contact us at hello@photocameraapp.com.

HOW TO EXERCISE YOUR RIGHTS

To exercise any of your rights:

1. Email us at hello@photocameraapp.com
2. Delete your account directly in Settings → Delete Account (covers right to erasure)
3. Data export — Request via email and we'll provide your data within 30 days

We will respond to all GDPR requests within 30 days. If we need more time, we'll let you know within the initial 30-day period.

COMPLAINTS

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority. You can find your authority at edpb.europa.eu.