Every published object is open access.◆No gatekeeping. All objects published openly.◆PHOTARCH — research infrastructure for archaeology.◆Every published object is open access.◆No gatekeeping. All objects published openly.◆PHOTARCH — research infrastructure for archaeology.◆
← PHOTARCH

Privacy Policy

Last updated: September 2026

1. Data Controller

PHOTARCH is operated by Milvus Productions AB · org. nr 559505-9485. For questions regarding your personal data, contact: info@photarch.com

2. What Data We Collect

When you create an account on PHOTARCH, we collect the following personal data:

  • Name (first and last)
  • Email address
  • Workplace and job title (optional)
  • ORCID iD, if you choose to link it (optional)
  • Profile picture, if you upload one (optional)
  • Newsletter preference (opt-in only)
  • Account creation date

While you use the archive, we also keep what you create in it:

  • Private notes you write on objects, visible only to you
  • Collections, canvases and favourites, and the people you share them with

Without an account, we process:

  • Your email address, if you subscribe to the newsletter
  • Your name, email address, organisation, message and IP address, if you use the contact form
  • The text of searches you enter in the natural-language archive search (see Section 5)

When you buy a licence or ask for an invoice, we keep:

  • For a card purchase: your email address, the country you state, which licence you bought, and Stripe’s reference for the payment. We never see or store your card details.
  • For an invoice request: the organisation’s name, organisation and VAT numbers, billing address and Peppol ID, the contact person’s name and email address, your reference, your message and your IP address.

We also collect anonymised usage data via Google Analytics (see Section 5). What the apps — the PHOTARCH app and PHOTARCH for iPhone — handle is described in Section 6.

3. Purpose and Legal Basis

We process your personal data for the following purposes:

  • Account management — to provide access to the PHOTARCH archive and its features. Legal basis: performance of a contract (GDPR Art. 6.1.b).
  • Newsletter — to send updates about new objects, methodology, and announcements, if you have opted in. Legal basis: consent (GDPR Art. 6.1.a). You can withdraw consent at any time from your account settings.
  • Analytics — to understand how the archive is used and improve it. Legal basis: legitimate interest (GDPR Art. 6.1.f), subject to your cookie consent.
  • Purchases and licences — to issue the licence you bought, tie it to your account, and take it back if the purchase is refunded. Legal basis: performance of a contract (GDPR Art. 6.1.b).
  • Invoices and bookkeeping — to write and send an invoice you asked for, and to keep the accounting records Swedish law requires. Legal basis: performance of a contract (GDPR Art. 6.1.b) and legal obligation (GDPR Art. 6.1.c).

4. Data Retention

Account data is retained for as long as your account is active. You can delete your account yourself at any time on app.photarch.com/account/delete, or from the account settings in either app; your personal data is then removed at once. An organisation’s account is deleted on request, within 30 days. Newsletter opt-in status is updated immediately upon unsubscribe.

A licence record is kept for as long as the licence exists. Invoices, and the invoice requests they came from, are kept for seven years, as the Swedish Bookkeeping Act (bokföringslagen) requires; an invoice request that never became an invoice is removed after one year.

5. Third Parties

We use the following third-party services that process personal data on our behalf:

  • Supabase — authentication, database and file storage. Your account data, notes, collections and profile picture are stored on Supabase infrastructure in the EU (Ireland). Privacy policy: supabase.com/privacy
  • Vercel — hosting of the website. Every request to PHOTARCH, including your IP address, passes through Vercel’s network; the site’s server functions run in the EU (Ireland). Privacy policy: vercel.com/legal/privacy-policy
  • Cloudflare — image storage and delivery (Cloudflare R2), and Cloudflare Turnstile, which checks that sign-up, contact, newsletter and invoice-request forms are sent by a person rather than a bot. Turnstile evaluates your IP address and browser signals when you use those forms. Privacy policy: cloudflare.com/privacypolicy
  • Resend — delivery of account emails, contact-form messages and the newsletter. Your email address and the content of the message are passed to Resend. Privacy policy: resend.com/legal/privacy-policy
  • Google Analytics — anonymised usage statistics, loaded only with your cookie consent. Data is processed by Google LLC. Privacy policy: policies.google.com/privacy
  • Apple — place search and the naming of a find spot in the PHOTARCH app use Apple Maps. The text you search for, or the coordinates of the spot, are sent to Apple. Privacy policy: apple.com/legal/privacy
  • Anthropic — the natural-language archive search. The text of your search is sent to Anthropic to turn it into archive filters; no account data is sent with it. Privacy policy: anthropic.com/legal/privacy

Card purchases — Link (Stripe). A licence bought by card is sold by Link, the merchant of record service of Stripe, and not by us. You give your name, email address, billing address and card details to Link/Stripe at checkout, which process them as an independent controller: to take the payment, charge and report VAT, prevent fraud, send your receipt and handle refunds. Stripe tells us only what is needed for the licence (Section 2). Privacy policies: link.com/privacy and stripe.com/privacy.

Voice search uses your browser’s built-in speech recognition. Depending on the browser, the recording may be processed by the browser’s maker (for example Google in Chrome); PHOTARCH receives only the resulting text, never the audio.

Images the archive seals with Content Credentials (C2PA) are timestamped by DigiCert. Only a cryptographic fingerprint of the image is sent; no personal data is involved.

Some of these providers are based in the United States. Where personal data is transferred outside the EU/EEA, the transfer relies on the provider’s safeguards under the GDPR, such as the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

6. The Apps

The PHOTARCH app and PHOTARCH for iPhone keep your photographs and records on your own devices. We receive them only when you publish objects to the archive. The apps contain no advertising, no tracking and no analytics or crash-reporting services.

  • Camera and motion (iPhone) — the camera takes the pictures; the motion sensors show whether the phone is square to the board. Neither is sent to us.
  • Local network (iPhone and Mac) — the iPhone finds the PHOTARCH app on your network, or over a cable, and sends each picture straight to it, encrypted. With the pictures go their metadata, the phone’s name and model, and an identifier created when the app was installed, so the Mac knows which phone it is paired with. None of this passes through us. A picture you import from the iPhone’s photo library keeps the metadata it already had, which may include where it was taken; it too goes only to your Mac.
  • Signing in — you sign in on a PHOTARCH web page, so the apps never see your password. The app keeps its sign-in token in the device’s keychain and sends the device’s name, so you can tell your signed-in devices apart. Searches you make in the archive from the app are sent to us to be answered.
  • Licence (Mac) — activating a licence sends the Mac’s name and a one-way hash of its hardware identifier, so that the licence is issued for that computer. The identifier itself never leaves the Mac.
  • Publishing (Mac) — when you publish an object, the pictures and the metadata you publish are uploaded to the archive (Supabase and Cloudflare R2, Section 5). Private notes are never sent, and a hidden find spot is stored apart from the public record.
  • Problem reports — a report is written on your device and shown to you in full; it reaches us only if you send it yourself, by email or the share sheet.
  • AI admin (Mac) — if you turn it on, your own AI tool reads and changes your library through a connection that stays on the Mac. What the tool reads is processed by its provider under your own account with them, not by us.

Legal basis: performance of a contract (GDPR Art. 6.1.b). Signing out removes the sign-in token from the device; deleting the app removes everything else it kept there.

7. Cookies

PHOTARCH uses the following types of cookies:

  • Necessary cookies — used for authentication and session management (Supabase). These cannot be disabled.
  • Analytics cookies — used by Google Analytics to collect anonymised data about how the archive is used. These are only set with your explicit consent.

You can change your cookie preference at any time by clearing your browser storage and reloading the page.

8. Your Rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Request erasure of your data
  • Withdraw consent (newsletter) at any time
  • Lodge a complaint with the Swedish supervisory authority, IMY (Integritetsskyddsmyndigheten), at imy.se

To exercise any of these rights, contact us at info@photarch.com

9. Changes to This Policy

We may update this policy as the service develops. Material changes will be communicated via the newsletter (if you are subscribed) or a notice on the platform.

Milvus Productions AB · Org. nr 559505-9485 · info@photarch.com