Date of Last Revision: November 20, 2020
SmugMug, Inc. and our subsidiary SmugMug Limited ("SmugMug", "we" or "us"), are passionately committed to the privacy of our customers.
We collect information you provide directly to us. For example, we collect information when you:
The types of information we may collect include your name, email address, postal address, phone number, fax number, credit card information, bank transfer information, Social Security number (and other data necessary for tax reporting relating to payments to users), title, gender, and other information you choose to provide.
You have the option of telling us how you wish to be identified in connection with your photos, galleries, comments and elsewhere using the Services. If you choose to use your real name (or include any identifying information as part of your "nickname") that information will be publicly displayed through the Services. Therefore, please use caution in determining how you wish to be identified in using the Services.
Information Collected by Cookies and Other Tracking Technologies
Information We Collect From Other Sources
We may also obtain information from other sources and combine that with information we collect through our Services. For example, if you create or log into your account through a social media site, we will have access to certain information from that site, such as your name, account information and friends lists, in accordance with the authorization procedures determined by such social media site. We may receive updated information about you, such as an updated billing address, from the financial institution issuing your credit card in connection with our billing for the Services. When somebody buys a gift for you on our service, we’ll receive your shipping information from the purchaser. Users also can share another person’s email address with us through features that can invite the other person to view the user’s content.
Our use of the following information, which we call “Photographer Personal Data,” is limited by our agreements with our registered users: (i) images and videos that the user uploads to or creates in the Services, and (ii) any labels, tags, comments, descriptions or categorizations that user adds to those images and videos in the Services.
We use other information for the following purposes:
We may also share aggregated or anonymized information that does not directly identify you.
Our sharing of Photographer Personal Data is governed by our agreement with the user who posted it. If you contact us regarding a request or complaint about Photographer Personal Data, we may forward your communication to the user who posted it.
Social Sharing Features and Third-Party Integrations
The Services may offer social sharing features and other integrated tools which let you share actions you take on our Services with other media, and vice versa. The use of such features enables the sharing of information with your friends, the public, and others, depending on the settings you establish with the entity that provides the social sharing feature, and depending on that entity’s other sharing practices. For more information about the purpose and scope of data collection and processing in connection with social sharing features, please visit the privacy policies of the entities that provide these features.
Additionally, you may give certain third-party apps different levels of permissions to interact with your account to take advantage of things like photo editing tools. If you want to stop using one of these apps and revoke your permission, click the "Revoke" link under "Authorized Services" in the Privacy section on your account settings page.
Advertising and Analytics Services Provided by Others
Legal Basis for Processing
The laws in some jurisdictions require companies to tell you about the legal grounds that allow them to use or disclose your personal data. Where those laws apply, our legal grounds are:
We process a user’s Photographer Personal Data as the user’s “processor” (under the GDPR and similar laws) or “service provider” (under the California Consumer Privacy Act) as set forth in our agreement with the user.
SmugMug takes physical, technical and administrative measures to help protect information about you from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction. However, no security measure is perfect. SmugMug cannot and does not promise that any information will remain secure.
To provide the Services, we may transfer your information to servers operated by SmugMug or our service providers in the United States or other countries. When we transfer information from the European Economic Area (“EEA”) or UK to countries that the European Commission has not deemed to provide an adequate level of protection, we normally do so on the basis of either (i) Standard Contractual Clauses approved by the European Commission for such purpose or (ii) the recipient’s participation in the EU-U.S. Privacy Shield Framework (described below). You may request a copy of the Standard Contractual Clauses by contacting us as described below.
SmugMug, Inc. complies with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal data we receive in the U.S. from the European Economic Area, and Switzerland. This commitment extends to the personal information received in the U.S. from the UK, regardless of the status of Brexit. SmugMug has certified to the Department of Commerce that it adheres to the Privacy Shield Principles. To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/.
Under certain conditions, you may be able to invoke binding arbitration to resolve your complaint. SmugMug, Inc. is subject to the investigatory and enforcement powers of the Federal Trade Commission.
If we share personal data transferred to the U.S. under the Privacy Shield with an agent that processes such data on our behalf, then we will have certain responsibility under the Privacy Shield Principles if both (i) the agent Processes the information in a manner inconsistent with the Privacy Shield Principles and (ii) we are responsible for the event giving rise to the damage.
Our Services allow our users to transfer Photographer Personal Data (such as by publishing it), and our users (not SmugMug) are responsible for their transfers.
Privacy Requests Regarding Users’ Photos, Videos, and Some Related Data
For privacy-related takedown requests, or to exercise any rights you may have under privacy law regarding images or videos that a SmugMug user uploaded to or created in the Services, or any labels, tags, comments, descriptions or categorizations that the same user added to those images and videos in the Services (Photographer Personal Data), please contact that user directly. SmugMug processes this data on behalf of the user, and the user has responsibility for handling these requests. Under the GDPR and similar laws, SmugMug is the user’s “processor” of this limited set of data, and under the California Consumer Privacy Act (CCPA), SmugMug is the user’s “service provider” for this data. (SmugMug still can remove illegal content and other material that users are not entitled to maintain on the Service, such as nonconsensual intimate images, which can be reported at https://help.smugmug.com/contact.)
SmugMug users can follow the instructions below to handle such requests or to otherwise manage their Photographer Personal Data.
You can delete individual photos that you have on SmugMug by selecting the photos that you wish to delete, then clicking the delete button. Or you can delete groups of photos using batch operations.
Photo Sharing Features
In the "Privacy" section of your Account Settings, you can determine who you intend to access your site by leaving it set to "Anyone" by default, setting a site-wide password, or inviting only specific people to have access to your site. You can control at a more granular level each folder and gallery's settings, leaving them set to "Anyone" by default, making them unlisted, applying a password, allowing access to only specific people, or giving only yourself access.
Privacy and Profile Information
In the "Edit Profile" section of your User Menu, you can add, edit, or remove various pieces of profile information, including: first/last name, display name, contact email address, personal description, profile photo, and social media URLs.
Information provided in your Profile will be publicly available through the Services, including to your site visitors and via the search function on smugmug.com/search. Visibility of your account in search results can be limited via the “Discovery” tab of your Account Settings. Visibility of individual folders/galleries/photos in search results can be limited via each folder or gallery's settings.
By default, SmugMug will display a link showing EXIF data about photos or video you upload. The link shows on all your individual photo pages, and displays the make & model of the camera you used to take the shot. You can elect to hide this link in “Appearance” section of your Gallery Settings.
When you first launch any of our mobile applications that collect location information, you will be asked to consent to the application's collection of this information. If you initially consent to our collection of location information, you can subsequently stop the collection of this information by our application’s camera function at any time by changing the preferences on your mobile device.
Some cameras and applications can store GPS (location) coordinates in a photo's EXIF header. SmugMug imports that data and if you choose, SmugMug can display that data publicly. This display setting can be changed in gallery settings "Permissions and Sharing" on smugmug.com. You can also change the settings on your camera to stop location data storage.
If you turn on the auto-upload feature, photos and videos from your mobile device camera roll will be automatically uploaded to SmugMug. These photos and videos will be stored as private (non-public) on SmugMug until you choose to share them. You can turn off auto-upload at any time in your mobile app settings.
Please see the “Advertising and Analytics Services Provided by Others” section above for options for controlling cookies and similar technology.
You may opt out of receiving promotional communications from SmugMug by following the instructions in those communications or by emailing us at help@SmugMug.com. If you opt out, we may still send you non-promotional communications, such as those about your account or our ongoing business relations.
Visit your SmugMug Account Settings area to edit your SmugMug email notification settings.
Other Data Protection Rights
The law of your jurisdiction may give you additional rights to make certain requests with respect to your personal data. This is the case, for example, for residents of the European Economic Area and Switzerland, and, as described further below, residents of California. Our preference is to treat requests from all users in a similar way, regardless of where they live, to the extent we find this practicable and legally feasible. So although we describe the rights that exist under certain specific laws and frameworks below, we are happy to receive such requests from users in different jurisdictions as well.
As a reminder, regardless of where you live, all requests to exercise privacy rights with respect to Photographer Personal Data should be addressed to the user who uploaded that content, not SmugMug.
Under the Privacy Shield and laws like the GDPR, some individuals have a legal request access to, correction of, or deletion of certain personal data we store. In some cases, they are be entitled to receive a copy of the personal data they provided to us in portable form or to request that we share it with a third party. The law also gives them the right to request certain restrictions on the use of their personal data, to object to our use of their personal data, or, where applicable, to withdraw their consent to use of their personal data (which will not affect the legality of any processing that happened before your request takes effect).
People who live in the UK or elsewhere in the European Economic Area (and certain other people) have additional rights to opt out of our use of personal data for direct marketing. They can exercise their rights to opt out, or to object to other processing, by contacting us as described below. Every individual has the right to lodge a complaint with the data privacy authority where they reside.
Individuals and data protection supervisory authorities in the EU and the UK may contact our data protection representatives according to Articles 27 EU and UK GDPR:
EU: DP-Dock GmbH, Attn: SmugMug Inc., Ballindamm 39, 20095 Hamburg, Germany
UK: DP Data Protection Services UK Ltd., Attn: SmugMug Inc., 16 Great Queen Street, Covent Garden, London, WC2B 5AH, United Kingdom
Additional Privacy Details for California Residents
CCPA categories of California personal information we collect:
CCPA description of uses of California personal information:
CCPA “sale” of California personal information
SmugMug does not “sell” and has not “sold” its personal information in the way most people understood those words before the CCPA was passed. We don’t sell copies of our user lists like a data broker would, for example. And while we’ve built a great home for photographers to promote their own creations, we don’t take money for letting unrelated third parties target advertisements to our users.
California Privacy Rights
This section describes rights under California law, but we plan to accept requests under this law from non-Californians, to the extent practicable and legally permissible. California law may permit you to request that we:
Certain information is exempt from such requests under applicable law. You also may have the right to receive information about the financial incentives that we offer to you (if any). You also have certain rights under the CCPA not to be subject to certain negative consequences for exercising CCPA rights.
To exercise any rights relating to “Photographer Personal Data”, including (i) the images and videos that a user uploads to or creates in the Services or Products, or (ii) any labels, tags, comments, descriptions or categorizations that user adds to those images and videos in the Services or Products, users should contact the relevant user, and not SmugMug. ?You can find contact information for many users by going to their SmugMug page and clicking on “About me” section. ?(Even if this were not the case under the CCPA, SmugMug would normally have multiple legal grounds for denying CCPA-based takedown requests for Photographer Personal Data due to multiple exceptions under that law, including those applicable to the exercise of First Amendment rights. Similar exceptions are common in other laws.)
To contact SmugMug to exercise CCPA rights with respect to other data, please visit https://help.smugmug.com/contact for the fastest response. Alternatively, you can make your CCPA request via voicemail at the following number: (833) 522-8821. No other requests are accepted at that number.
Attention: Copyright Agent
67 E Evelyn Ave, Ste 200
Mountain View, CA 94041, USA
Attention: Copyright Agent
3rd Floor, Chancery House, St. Nicholas Way
Sutton, England, SM1 1JB
Get to know your new all-in-one photography platform with a 14-day free trial.
(No credit card required.)