Privacy Policy

Effective date: June 12, 2026

PumbaPhoto (pumbaphoto.com) is a private photo proofing and delivery portal used by a photographer to share session photos with their clients. This policy describes what information the service collects and how it is used.

Information We Collect

• Account information — your name, email address, and a password (stored in hashed form). Accounts are created by the photographer so you can access your gallery.
• Login records — the IP address and time of logins to your account, kept for security purposes (for example, detecting unauthorized access attempts).
• Photos — photographs from your session, uploaded by the photographer for your review and delivery. You do not upload photos yourself.
• Selections and notes — the photo selections and any notes you submit through your gallery.

Cookies

We use functional cookies only — a CSRF protection cookie (valid up to one year) and a session cookie, both set as part of the login flow. No cookies are set on public pages, and we use no advertising or third-party tracking cookies.

Analytics

We use a self-hosted, cookieless analytics tool (Umami) to count page views and understand aggregate site usage. It sets no cookies, does not track you across other sites, and the data stays on infrastructure we operate.

Third-Party Services

• Cloudflare — content delivery network and proxy in front of the site; it processes requests (including IP addresses) to serve and protect the site.
• MXRoute — email delivery provider used to send transactional email (gallery created, photos uploaded, selections submitted, edits delivered) from web@pumbaphoto.com. We send no marketing email.
• Unsplash — decorative images on the public landing page load from images.unsplash.com; your browser requests them directly from Unsplash.
• Self-hosted analytics — the cookieless analytics described above, which we operate ourselves.

We do not sell or share your personal information with advertisers or data brokers.

How Photos Are Handled

Galleries are private. Access requires logging in to an account that has been assigned to the gallery. Photos are stored on private, access-controlled storage; they are never made public and never sold.

Data Retention

Your account, photos, and selections are kept for the duration of the client engagement. You can request deletion of your account and associated data at any time by emailing web@pumbaphoto.com.

California Privacy Rights

If you are a California resident, you have the right to know what personal information we hold about you and to request its deletion. To exercise either right, email web@pumbaphoto.com. We do not sell personal information.

Children

This service is not directed at children, and we do not knowingly collect personal information from minors. Accounts are created for adult photography clients.

Changes & Contact

If this policy changes, the updated version will be posted on this page with a new effective date. Questions? Email web@pumbaphoto.com.