Privacy Policy

TSousaFoto is a sole-trader event photography business based in Portugal. I'm the sole person who operates this site and I'm the one responsible for the data it processes.

Account details: your name and email address, and a password (handled entirely by the login system — I never see or store it in plain text). If you sign in with Google, I receive the name and email your Google account shares.

Order details: the photos you select, the pack and price, a payment reference, which payment method you say you'll use, any proof-of-payment file you upload, and the order's status history.

Messages: any notes you exchange with me through an order's notes thread.

Event photos: the photos from the event itself, which I upload and may tag with a rider number or name so you can find yours. These may show you (or, for younger riders, your child) taking part in the event.

A couple of small preferences: your chosen language and light/dark theme, stored in a cookie and your browser respectively — never sent anywhere else.

To run your order: confirm your payment, edit and deliver your photos, and let you download them.

To communicate with you about that order.

To keep basic financial records I'm legally required to keep.

I don't use your data for advertising, I don't sell it, and I don't run any tracking or analytics on this site.

Supabase hosts the database and handles login — your account and order data lives on their infrastructure.

Resend delivers the transactional emails this site sends (order confirmations, password resets). It only sees what's needed to send that specific email.

The server that stores the photo files themselves is one I manage directly.

Nobody else. I don't share your data with advertisers, data brokers, or anyone outside of what's needed to run the site.

Order and payment records are kept as long as needed for your event and for the financial records I'm legally required to retain. If you'd like your account and photos removed sooner, email me and I'll take care of it, financial-record requirements permitting.

Motocross and enduro events often include junior riders. If you're a parent or guardian registering a young rider's photos or placing an order on their behalf, that's done with your consent as their guardian.

Under Portuguese and EU data protection law (GDPR), you can ask me to access, correct, delete, or export the data I hold on you, or object to how I'm using it. Email geral@tsousafoto.pt and I'll respond directly. You can also lodge a complaint with Portugal's data protection authority, the CNPD (www.cnpd.pt), at any time.