Terms of service

Privacy policy

Applies from 2026-11-01.

This policy describes how Irsta Bild AB (“we”) handles personal data in the service Framkalla, at framkalla.store and at print labs’ own addresses on it. Questions and requests go to info@monsym.se.

Our two roles

For photographers’ and labs’ accounts we are the controller. We decide how that data is used, and this policy describes it.

For what photographers and labs put in the service we are a processor. Photos, galleries, client names and email addresses, clients’ selections and comments, and delivery addresses for orders belong to the photographer or lab, who is the controller. We only handle them to provide the service, as set out in the data processing agreement in our terms. If you are a client of a photographer and want to see, correct or remove your data, contact the photographer; we help them do it.

What we collect

• Account: name, email address, password (stored only as a one-way hash), role, which lab you order from, sign-in times, and when you accepted the terms.
• Business and billing details: company name, VAT or organisation number, billing address, and your plan and invoices.
• Payments: card payments are handled by Stripe. We never see or store card numbers; we keep the payment’s reference, amount and status.
• Content: the photos, galleries, photobooks, logos and texts you upload or write.
• Your clients and their visitors: what photographers and clients enter: names, email addresses, selections, comments, orders and delivery addresses.
• Guests at a lab: photos and the details a guest gives to order prints from a lab without an account.
• Technical data: IP addresses in the web server’s logs; for a photographer who has asked to be told when a gallery is opened, the approximate town the visitor is in, worked out from the IP address on our own server (the address is not sent to anyone else and is not stored with the visit).

Why, and on what legal basis

• To provide the service you signed up for: accounts, storage, galleries, orders, payments and the emails that go with them (contract, GDPR art. 6.1 b).
• To keep accounting records such as invoices and orders, as the Swedish Bookkeeping Act requires (legal obligation, art. 6.1 c).
• To keep the service secure and working: logs, backups, preventing abuse and sign-up robots; to tell photographers when their gallery is opened, if they ask; and to make photos searchable by what they show (legitimate interest, art. 6.1 f). Photo search runs on our own server and does not recognise faces or people.

We do not sell personal data, show advertising, or use analytics or tracking services.

Who receives data

The lab a photographer orders from receives what it needs to make and deliver the order. A photographer’s clients see what the photographer shares with them. Besides that, these companies process data for us, under data processing agreements:

We may also disclose data when the law requires it, for example to a public authority.

Where the data is

Photos and files are stored in Stockholm, Sweden, and the service and its database run in Helsinki, Finland. Email is sent through Amazon in London; the United Kingdom has an EU adequacy decision. Stripe may transfer payment data to the United States under the EU–US Data Privacy Framework and the EU’s standard contractual clauses.

How long we keep it

• Account data and content: for as long as the account exists. When an account is closed, its content is deleted within 30 days.
• Deleted galleries and photos: kept for 30 days so they can be restored on request, then removed.
• Backups: nightly copies are kept for 30 days.
• Invoices, receipts and orders: 7 years, as the Bookkeeping Act requires.
• Log of sent emails (recipient and subject, not the text): 90 days.
• Web server logs: 14 days.
• Guests’ photos at a lab: 7 days, or 60 days after their last order.

Cookies

We only use cookies the service needs to work: to keep you signed in and protect forms (session), to remember your language, to recognise a photographer’s own browsers so their own visits to their galleries aren’t counted as clients’, and to mark a lab’s in-store kiosk. They are not used for tracking, so no consent banner is needed.

Your rights

You may ask for a copy of your personal data, have it corrected or erased, restrict or object to how it is used, and get the data you gave us in a format you can take elsewhere. Write to info@monsym.se; we answer within a month. Some data we must keep by law (such as invoices) even if you ask us to erase it. You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

Security

All traffic is encrypted (HTTPS), passwords are stored hashed, photos are only reachable through short-lived signed links, access for our staff is limited and logged, and data is backed up. If a breach puts your data at risk, we report it to IMY within 72 hours and tell those affected.

Changes

When we change this policy in substance we tell account holders by email before the change applies. The date at the top shows the current version.

Who we are

Irsta Bild AB
Org. no. 556309-4902
Hägersborgsvägen 10, 723 55 Västerås, Sweden
info@monsym.se