Privacy notice

The business responsible for your information, and the one you can complain to, is:

Mimfoto.

Write to us at support@mimfoto.com. That address is monitored and is where a cancellation, a complaint or a legal notice should be sent.

We update this notice when what we do changes, and the date at the top moves when we do. If a change affects what you agreed to, such as who your details can be shared with, we ask again rather than assuming.

Contact details. Your name, email address, phone number and delivery address, when you order, make an account or write to us.

Order information. What you ordered, the billing and delivery addresses, and confirmation that you paid. Card numbers go straight to the payment provider and never reach our servers.

Account details. Your email and a password. The password is held by Supabase, the service that runs our logins, and is stored scrambled, so not even we can read it. If you save addresses to your address book, or press Save in the editor while logged in, we keep those addresses and that book (its layout, captions and the editor-sized copies of its photographs) until you delete them from your account.

Your photographs and your book. A small, editor-sized copy of each photograph you add is uploaded, so your book can be saved and reopened; the full-size original is uploaded only once you place it in a book. They are kept in private storage that only you (through your account) and we (to make your book) can reach. We also keep the layout, captions and choices you made, so the book can be printed exactly as you designed it.

Technical information. Your IP address and browser, which our servers record in short-lived logs (see clause 12), and your messages if you email us.

To make and post your book, take payment, keep you updated on your order, let you log in and see your orders, answer you, keep the shop secure, and meet our legal duties. The lawful basis for these is our contract with you, and our legitimate interest in running a safe shop.

Marketing, only if you agree. If you tick the marketing box we may email, message or write to you about new covers and offers. The box is unticked and stays unticked unless you tick it. You can withdraw at any time from any email we send.

Creator applications. If you apply to be a Mimfoto creator, we keep your name, email, the social profiles you give us and your answers, to decide on your application and to write to you about it. We keep them for a year if we do not work together, then delete them.

Our mailing list. If you give us your email at the foot of a page or for early access, we keep the address, where you signed up, when, and the sentence you agreed to, and send you new covers, travel tips and the occasional offer. Unsubscribe from any email or write to us and you are off the list.

The welcome gift. If you claim it, we keep your email, the gift, when it was given and when it runs out, and the order it was used on, so it comes off at checkout once and only once. Claiming it from the pop-up also puts you on the mailing list above, as the pop-up says; claiming it by making an account does not. Your browser remembers that it has seen the pop-up, so it does not keep asking.

To do the job. Our printer in Karachi, Pakistan receives the book and the delivery address, because they make and post it. The courier receives your name, address and phone number. Our payment provider (Safepay), our email and messaging services, our hosting and IT suppliers and anyone who helps with customer support receive what they need to do their part, under contract. None of them is allowed to use your information for their own purposes.

Social marketing terms (only if you agree). At sign-up there is a separate, unticked box: “Share my contact details with marketing partners”. If you tick it, we may share, rent or sell your name, email address, phone number and city to businesses we choose: marketing partners, our affiliates and advertising partners, such as other shops and services that sell products to people who print photographs, travel or buy gifts. They may contact you about their own products and may use your details to show you advertising.

Never. We do not share, sell or give anyone your photographs, your book designs, your password or any payment details, whatever you tick.

You can change your mind at any time by writing to support@mimfoto.com. We stop sharing from then on and ask the partners who already hold your details to stop using them, but we cannot take back what a partner has already lawfully received.

We may also disclose information when the law requires it, to protect our rights or someone’s safety, or if the business is sold, in which case the buyer is bound by this notice.

One cookie, if you log in. It keeps you logged in and holds nothing but a signed session code. It is set by Supabase, the service that runs our logins, and page scripts cannot read it. Without it you cannot stay logged in, so it needs no consent. It expires after 30 days or when you log out.

We do not set advertising or tracking cookies. If that ever changes we will say so here first and ask before setting them.

Your basket is kept in your browser’s local storage so it survives closing the tab. It never leaves your device until you place an order. A few other small things (where your book is going, the welcome gift) are kept the same way; the cookies page lists them all.

They are yours. We use them only to make your book and, if it is lost or damaged, to make it again. We do not use them in our own marketing without asking you first, and we never pass them to partners.

Links to other sites, a courier’s tracking page for example, are outside this notice. Read their policy before you give them anything.

The shop is for adults. We do not knowingly collect information from anyone under 16, and we never share or sell the details of anyone we believe is under 16. If you think a child has given us theirs, write to us and we delete it.

Photographs: 10 days after your order is delivered (or 40 days after it ships, if delivery is never confirmed). Long enough to replace a lost or damaged book without asking you to find the files again, and then gone. For a book you have started but not ordered: 7 days after you last open it. We email you before that happens, and opening the book keeps it. The book’s layout stays in your account either way; only the photographs go.

Order and invoice records: 6 years, as Pakistani tax law requires for business records. We cannot delete these on request, because keeping them is a legal obligation. That covers the invoice only, not your photographs.

Account: until you ask us to delete it. Marketing and sharing list: until you unsubscribe, and no longer.

Your photographs are stored privately and are not publicly addressable. Access to order data is restricted and authenticated, passwords are stored scrambled, and traffic is encrypted in transit. No system is perfect. If we ever suffer a breach that risks your rights, we will tell the regulator within 72 hours and tell you without undue delay.

Our servers keep technical logs for 30 days: which pages were requested, and whether anything failed. Personal details are removed from them automatically as they are written. They exist to find faults and to notice abuse, and nothing else.

You can ask for a copy of what we hold, ask us to correct it, delete it, stop using it for something, stop sharing it, or hand it to you in a portable form. Email support@mimfoto.com and we will respond within one month. Deleting your photographs is a button on our side, not a project. Ask, and they go.

If you think we have handled your data badly, you can complain to the Sindh Consumer Protection Council. We would rather you told us first.

Printing happens in Karachi, Pakistan. If you are ordering from the UK, the EU or elsewhere, your address and photographs travel outside your own country so the book can be made and posted. They go only to our printer and our courier, and only what each needs. Partners you agreed to share with may be in other countries too.

Questions about any of this: support@mimfoto.com.