Your photos
Privacy notice
We use your wedding photos, and the faces in them, only to make your album. To see, correct or delete your data, write to us; we reply within 72 hours.
In short
Stored and sorted in Mumbai. Only you and the people you send a link can see them.
Gone within 30 days of asking, and always 90 days after your album is done.
We read faces only to make your album.
On this page14 sections
1. Who we are
Phopho and Toto is run by Rita Gupta in India. Rita Gupta decides how your data is used, and so is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023.
Write to privacy@phophoandtoto.com about anything in this notice.
2. What we collect
- Your Google account: your email, your name and a user id, when you sign in with Google.
- Your wedding photos, and what we read from them: the faces in them, when each was taken, and how clear it is.
- For each face, a numeric description of the face, used only to tell people apart in your photos.
- What you tell us: your names, who is who, the names of your functions, how big an album, and every choice you make in it.
- If you choose together: the Google email of the person you invite (section 9).
- If you send family links: what is in section 8.
- If you pay: the amount, the date and the payment reference from Dodo Payments. Dodo Payments takes the payment; we never see your card, UPI or bank details.
- How the site is used: pages opened and buttons pressed, without your photos, their file names or your email.
3. Why we use it, and your consent
Only to sort your photos and make your album, to let you and the people you send a link to see it, to take payment, and to write to you about your album.
Never for advertising, never sold, and never used to train software.
We read the faces in your photos only with your consent: you tick a box before you add photos, and we keep the date you ticked it with your album. No outside service reads your faces unless we tell you first. You can withdraw it at any time by writing to privacy@phophoandtoto.com. We then stop, and delete your photos and face data as in section 5. Withdrawing does not undo what was done before.
4. How long we keep it
Your original photos and face data are deleted within 30 days of your request, and in any case 90 days after your album is finished (or after your last activity on it, if it is never finished).
Your album, its previews and its family-link data are deleted with them.
The download you make (the zip file) is deleted 7 days after it is made.
Your account (your email and user id) is deleted 12 months after your last album is deleted, or sooner if you ask.
Payment records are kept for as long as Indian tax law requires.
5. Deleting your data
An extra album (one for each side, or for friends) can be deleted from its own page: Delete this album. Your photos stay for your other albums.
To delete your photos, your wedding or your account, write to privacy@phophoandtoto.com from the Google email you sign in with. We reply within 72 hours and delete within 30 days.
6. Your rights
You can ask for a summary of the data we hold about you, have it corrected or deleted, withdraw your consent, and name someone to act for you if you cannot. Write to privacy@phophoandtoto.com.
7. Grievance Officer
Rita Gupta
Email: privacy@phophoandtoto.com
Postal address: on request at privacy@phophoandtoto.com
We acknowledge every grievance within 72 hours and resolve it within 30 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
8. Family links
When you send a family link, anyone who opens it can see your current album (previews, not originals) and heart photos; they never need an account. We store the name they type, their language, which photos they hearted, and a random id kept in their browser, with your album, and delete them with it. Only you see who hearted what. You can turn a link off at any time; links stop working after 30 days. We keep only a fingerprint of each link, never the link itself.
9. Choosing together
When you invite the person you married to choose with you, we keep the Google email you type so only that account can open the link. They sign in with Google as you do, and their choices are kept with your album. The link stops working after 7 days if it is not used. We keep only a fingerprint of the link.
10. Google Drive
If you bring photos from Google Drive, there are two ways. You can pick the files or a folder in Google's own window; we ask Google only for the access that copy needs. Or you can paste the link to a folder your photographer shared: it must be open to anyone with the link, or shared with our album email address, and we copy every photo in that folder and the folders inside it. Either way, we use that access only to copy your photos, and for nothing else.
If you send your album to a Google Drive folder, you add our address to that folder as an editor. We put your album's photos there and nothing else. You can take our access away from the folder at any time.
11. Who helps us, and where
Your photos are stored and sorted in Mumbai, India. Some of the services below are outside India; each gets only what it needs to do its job.
- Google Cloud: stores your photos, sorts them, and keeps your album's records and your sign-in. Mumbai, India.
- Vercel: runs this website. Mumbai, India.
- Google: sign-in with Google and the Google Drive window. Google's own servers.
- Dodo Payments: takes payments. India.
- Resend: sends our emails to you. United States.
- Sentry: tells us when something on the site breaks. United States.
- PostHog: tells us how the site is used, without your photos or email. United States.
12. Security
Your photos are encrypted on the way to us and where they are stored. They sit in private storage, and your album opens only for your Google account and the links you choose to send.
13. Children
You must be 18 or over to use Phopho and Toto.
14. Changes
This notice is effective 14 October 2026 and was last updated 26 October 2026. If we change it in a way that matters, we will update this page and its date.