Privacy Policy
This policy explains how ISO100 handles account information, photographs, portfolio visits, product analytics, payments, referrals, and support requests.
Last updated September 21, 2026
On this page
Operator
ISO100 is operated by Alias Labs Pty Ltd. Alias Labs Pty Ltd is responsible for the ISO100 account, portfolio, support, security, abuse, and public analytics data described in this policy. Alias Labs' company website is https://alias.io.
Information we collect
- Account information, such as email address, profile details, and authentication records.
- Portfolio content, including photographs, display names, galleries, captions, alt text, links, rights notices, and publish metadata.
- AI-assisted photo metadata and internal curation signals, including generated alt text suggestions, broad subject categories, visible artistic and technical qualities, snapshot likelihood, assessment confidence, whether a person may be under 18 or their age is unclear, model and prompt versions, and your edits or choices about suggestions.
- Discovery and featuring choices, including whether a portfolio may appear in an ISO100 discovery feature, whether individual photos are excluded, and whether ISO100 may feature public portfolios or galleries.
- Moderation and publishing records, including upload status, automated moderation results, sensitive-content flags, manual markings, report history, enforcement decisions, and restricted operational notes.
- Technical records, such as IP address, user agent, request path, timestamps, rate-limit decisions, and security events.
- Support messages and operational correspondence you send to ISO100.
- Affiliate applications, referral attribution, commission calculations, payout details and payment records. Affiliates see anonymous referral identifiers and earnings; they do not receive referred customers’ names, email addresses, or billing details.
Automated photo analysis
When you select a photo in Studio, ISO100 may send a smaller JPEG preview to Amazon Web Services for automated analysis. The analysis drafts alt text and broad categories. It is separate from the automated moderation check performed on the accepted original upload.
The same analysis may create internal curation signals about visible artistic intent, technical quality, snapshot likelihood, assessment confidence, and whether a person may be under 18 or their age is unclear. ISO100 staff may use these signals to shortlist public work for possible featuring.
AI suggestions and curation signals can be incomplete or wrong. You can edit or ignore metadata suggestions, and a late alt text suggestion does not replace text you entered or become public automatically. Curation scores do not decide whether a photo can be uploaded, published, discovered, pass moderation, or be featured. Staff review any shortlisted work before featuring it. ISO100 stores analysis results and technical provenance with the photo so the service can avoid repeating the same work.
Google Photos imports
If you choose to import from Google Photos, ISO100 requests permission to access only the photos you select using Google's picker. This permission is separate from signing in to ISO100 with Google. ISO100 uses the selected images and available filenames, dates, and image metadata to prepare your upload and provide the portfolio features described in this policy, including automated photo analysis and moderation. Google excludes location metadata from downloaded photos.
Google access tokens are used temporarily for the import and are not saved to your ISO100 account. Temporary image copies are deleted after transfer to your browser; abandoned copies are scheduled for automatic deletion through a one-day storage lifecycle. Photos you upload remain in ISO100 until you delete them, subject to the retention described in this policy. Later edits or deletions in Google Photos do not change your ISO100 copies.
You can cancel an import, discard selected photos before uploading, delete uploaded photos in Studio, and revoke ISO100's Google Photos permission in your Google Account's third-party connections settings. Revoking access stops future Google Photos access; it does not delete photos already uploaded to ISO100. Contact privacy@iso100.app for help with deletion.
ISO100's use of information received from Google Photos APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. ISO100 does not sell this data, use it for advertising, or use it to train general-purpose AI models.
Lightroom imports
If you connect Lightroom, ISO100 uses your Adobe permission to display albums, photo information, and thumbnails from your Lightroom cloud library. Only photos you select for import are copied into the upload review flow. Selected photos use the same automated analysis, moderation, and publishing features as device uploads.
The connection is temporary. ISO100 does not save Adobe access tokens to your account or browser storage, or request ongoing access. Temporary download copies are deleted after transfer or expire through a one-day storage lifecycle. Imported photos retain a Lightroom catalog and photo reference and the imported resolution so ISO100 can identify their source.
ISO100 does not change your Lightroom library or automatically sync later edits. You can cancel the import, discard photos before uploading, delete uploaded copies in Studio, or revoke ISO100 access in your Adobe account. Revoking access does not delete photos already uploaded to ISO100.
Discovery choices
New portfolios have discovery enabled by default. You can turn it off at any time and exclude individual photos while it is enabled. The setting prepares eligible public photos for future discovery features and does not mean a public discovery feature is currently available.
When discovery is enabled, ISO100 may use processed public display photos and public metadata, including titles, captions, alt text, and broad categories, to index, categorize, rank, and display photos in ISO100-owned discovery features. A photo must still be public, approved by moderation, and otherwise eligible before it can appear in discovery.
ISO100 may create and keep broad photo categories even when discovery is off. The categories support portfolio management and allow a later opt-in without analyzing every photo again. Turning discovery off stops discovery eligibility but does not delete stored analysis results or categories.
Featuring choices
Featuring is separate from discovery. If you enable Allow ISO100 to feature this portfolio, ISO100 may use eligible public portfolio or gallery content and public metadata in ISO100 marketing, email, social posts, App Store previews, and product showcase pages. Turning the setting off does not unpublish your portfolio or change the public license or rights notice attached to a photo.
After you turn featuring off, ISO100 will stop new featuring and remove the portfolio from active showcase surfaces within a reasonable operational period. Already-sent emails and previously published posts may remain. Backups and cached copies are removed under normal retention and expiry practices.
Public portfolio analytics
Public portfolio pages may send no-cookie analytics events such as portfolio views and gallery views. These events are used for aggregate reporting and service health. ISO100 does not use public portfolio analytics to build a cross-site visitor identity graph.
Marketing and Studio measurement
ISO100 uses Google Analytics and linked Google Ads measurement on the ISO100 Marketing site and in Studio. These services may use first-party cookies or similar browser storage and receive page, campaign, device, and conversion measurement needed to understand advertising performance. ISO100 does not send account email addresses or photograph contents as analytics event properties.
You can control or block Marketing-site and Studio storage and scripts through your browser settings or content-blocking tools.
Studio product analytics
ISO100 uses PostHog in Studio to understand feature use and diagnose problems, including steps such as uploading, editing, and publishing. Events can include a pseudonymous account analytics identifier, event times, device and browser information, sanitized page paths, and limited information about actions or errors. A pseudonymous identifier can associate events with the same account; it is not the account email address.
Our Studio integration disables session recording and automatic capture of page contents and clicks. It uses memory-only browser persistence for PostHog rather than storing its identifiers in cookies or local storage. ISO100 does not send photograph contents or account email addresses as PostHog event properties. PostHog may receive network information such as an IP address when your browser connects to it. You can block these requests using browser or content-blocking controls.
Support chat
ISO100 uses Crisp for live support chat. Marketing chat loads with the Marketing site. In Studio, support chat loads only when you choose to open it and may receive the signed-in email address so support can identify the account. Email support remains available without opening Studio chat.
IP addresses and abuse controls
ISO100 may process IP addresses and user agents for security, abuse prevention, bot filtering, rate limiting, troubleshooting, and legal compliance. Raw IP access is restricted and should be retained only for the short operational period needed for those purposes, normally 30 to 90 days unless a longer retention period is required for an active abuse, security, support, or legal matter.
How we use information
- Operate, publish, render, secure, and support ISO100 portfolios.
- Process photos into public display variants while keeping originals private by default.
- Create and improve optional AI-assisted alt text drafts and broad photo categories.
- Create internal curation signals to help staff review eligible public work for possible featuring.
- Build and operate ISO100 discovery features when discovery is enabled.
- Feature eligible public portfolios and galleries when the showcase setting allows it.
- Review, classify, restrict, blur, remove, or preserve content when needed to enforce the Terms, Content Policy, copyright process, abuse controls, or legal obligations.
- Respond to privacy, copyright, abuse, support, and security requests.
- Maintain service logs, audit records, reliability metrics, and aggregate analytics.
Photo purchases and payments
For photo sales, ISO100 processes the buyer email address, order and payment references, purchased photo and file version, price, currency, license acceptance, download expiry, and payment, refund, and dispute status. Tax records may include the buyer’s country and postal code.
Stripe processes checkout and payment details in the seller’s connected account. ISO100 receives the payment and tax information needed to confirm orders and provide downloads; it does not receive full card numbers through this checkout flow. Sellers receive the purchase and buyer contact information needed to fulfill and support their sales.
ISO100 uses this information to confirm payments, deliver private downloads, send purchase emails on the photographer’s behalf, handle support and disputes, prevent abuse, and meet applicable obligations. Purchase emails use the photographer’s name and configured reply address.
The purchase page uses a private access link and does not include analytics, advertising, or chat scripts. Access links should be kept private. Operational request and security records may still be processed to protect the service.
The 90-day download window is not a deletion deadline for all purchase data. Purchased files and their previews are retained to fulfill valid access and may also remain while offered for sale or required for a hold. Financial, license, and transaction records are retained separately as needed for accounting, disputes, security, and legal obligations, including after account closure. Contact privacy@iso100.app about access or deletion requests.
Affiliate referrals and payouts
When you follow a referral link or use an affiliate discount code, ISO100 may associate the referral with your account and first qualifying subscription payment. We use referral codes, account and payment references, discount information, and refund or dispute status to attribute referrals, calculate commissions, prevent misuse, and resolve payment questions. Referral and campaign information may be carried through signup links and browser storage.
For applicants and affiliates, ISO100 processes application details, promotional channels, acceptance of referral terms, the payout email address, commission records, and payout references. Authorized staff use this information to review applications and administer the program. Affiliates receive anonymous referral identifiers and earnings information, not referred customers’ names, email addresses, or billing details.
Affiliate payouts are sent through PayPal. We provide the payout address, amount, currency, and payment details needed to make the transfer. PayPal processes payment information under its own privacy terms. ISO100 keeps the transfer reference and related financial records for reconciliation, support, refunds, disputes, and applicable obligations. Deleting an account does not automatically erase those records; contact privacy@iso100.app about retained payout contact details.
Service providers
ISO100 uses infrastructure and operational service providers to host the site, store data, authenticate users, process photos, monitor reliability, and deliver support. Providers acting on our behalf process data to provide their services to ISO100. Payment providers may also process information for their own fraud prevention, regulatory, and legal obligations under their privacy terms.
Overseas processing
ISO100 is operated from Australia. Our core AWS hosting and account infrastructure is configured in the United States, and Studio product analytics uses PostHog’s US service. Public pages and display images may be delivered through AWS and Cloudflare infrastructure in other countries near visitors.
Crisp is based in France and states that its messaging data is stored in the Netherlands and plugin data in Germany. Google, Stripe, PayPal, and other infrastructure providers operate internationally, so processing can take place outside Australia and outside your country. The locations depend on the provider, the feature you use, and the routing of the request.
We use providers and access controls appropriate to the services involved. Contact privacy@iso100.app if you need more information about overseas recipients or the handling of your information.
Deletion and retention
Deleted photos and galleries normally remain recoverable in Recently deleted for 30 days. Restoration depends on eligibility and available plan capacity. Photo-file cleanup is scheduled after that period and may take additional time to complete. Unpublishing a page is different from deleting its stored content.
When you request account deletion, ISO100 unpublishes your portfolios, starts revoking account access, and requests subscription cancellation. Ordinary account and portfolio data enters a 30-day retention period before final cleanup. Completion may take longer if cleanup or subscription cancellation is pending. The retained data is not offered as an account-recovery service.
Purchased files and previews may be kept to fulfill valid download access, as described under Photo purchases and payments. Billing, affiliate payout, license, transaction, audit, support, and security records may be retained where needed for their stated purposes or legal obligations. Records subject to a legal or safety hold are handled separately. We may keep a limited account-deletion record to prevent accidental account recreation.
Backups and cached copies may persist until their normal expiry or deletion cycle. Copies obtained by portfolio visitors, search engines, or other third parties are outside ISO100’s direct control. Contact privacy@iso100.app for help with a specific deletion request or information about retained records.
Reports, safety, and legal preservation
When ISO100 receives a report or detects a serious safety, exploitation, copyright, security, or legal concern, we may restrict public access while reviewing the issue, keep records needed to investigate or document the matter, and escalate to appropriate parties where required or appropriate.
Suspected child sexual exploitation, non-consensual intimate imagery, threats, or other illegal content may require longer retention and restricted handling even after an account is deleted.
Access, correction, and privacy complaints
You can update your portfolio content and available profile settings in Studio. To request access to personal information we hold about you, correct information you cannot change yourself, or request deletion, email privacy@iso100.app. Explain the information or account involved and what you would like us to do. We may ask for information reasonably needed to verify your identity and protect other people’s information.
We will assess your request and explain the outcome, including any information we cannot provide, correct, or delete and the reason, subject to applicable law. Deletion requests remain subject to the retention purposes described in this policy.
To make a privacy complaint, email privacy@iso100.app with the issue, relevant dates, and the outcome you are seeking. We will review the complaint, may ask for supporting information, and respond within a reasonable period. If you are not satisfied, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au where the matter falls within its jurisdiction, or the relevant privacy regulator in your country. The OAIC generally expects you to complain to the organization first and allow about 30 days for a response.
Your choices
You can update portfolio content, unpublish public pages, turn discovery and featuring on or off, exclude individual photos from discovery, control Marketing-site and Studio storage through your browser, request access or deletion, and contact ISO100 about privacy concerns. Some records may be retained where needed for security, abuse prevention, legal compliance, or transaction integrity.