GDPR & EU hosting
GDPR compliant client gallery software, hosted in the EU
Xposure is EU hosted client gallery software for photographers: a Belgian company, servers and database at Hetzner in Germany, original photos stored in Western Europe. If a client asks where their pictures are kept, you have an answer. Checked 17 September 2026.
What stays, and what travels
Stays in the EU4 of 8
- The databaseAccounts, bookings, contracts, orders
- Your original photo and film filesFull-resolution masters, as uploaded
- The servers running XposureHetzner, Germany
- AnalyticsIn house, no third-party tracker
Travels4 of 8
- Cached copies of images being viewedHeld near the viewer so galleries open quickly
- The Google sign in promptLoaded from Google on public pages while you are signed out
- Print orders, if you sell printsSent to the lab, whose plant can be outside the EU
- The streaming copy of an uploaded filmEncoded and played by Cloudflare Stream, not kept in the EU
A gallery opened in Sydney loads from a server near Sydney. That is how it loads quickly, and it is the images only. Your account, your records and your original files do not move.
Who else touches it
The full list. There is nobody else.
- HetznerServers, database and analyticsGermany
- CloudflarePhoto storage and deliveryEurope location
- Cloudflare StreamStreaming copies of films uploaded to a gallery, on Pro and StudioUnited States
- StripePayments and payoutsUnited States
- ResendTransactional emailUnited States
- BackblazeOff-site backupsUnited States, EU Central region
- GoogleSign in with Google and its prompt on public pages, and calendar sync if you connect itUnited States
- ProdigiPrint orders, only if you sell printsUnited Kingdom
Where one of them sits outside the EU, the transfer runs on Standard Contractual Clauses, except Google, which is certified under the EU US Data Privacy Framework. The United Kingdom, where Prodigi is, has an adequacy decision from the European Commission.
For your clients' details you are the data controller and we are the processor. For your own account, we are the controller. Either way you can export or delete everything from your account. When a client asks you for a data processing agreement, the one in our terms of service is written to be handed straight over. The privacy policy is the full and authoritative version. How your account and galleries are protected is on the security page.
Where each client gallery platform keeps your data
In each vendor's own words, from its privacy or security page, checked 17 September 2026. Where a vendor does not say, the table says so.
| Platform | Company based in | Where data is stored |
|---|---|---|
| Xposure | Belgium | Servers and database in Germany (Hetzner). Original photos in Western Europe. Backups in the EU Central region (Backblaze). Source |
| picdrop | Germany | States "Based in Germany" on its pricing page. Server location is not named there. Source |
| CloudSpot | United States (California) | Personal information "will be processed in the United States". Source |
| Pic-Time | Not stated on the security page | Stored on Microsoft Azure servers "located in the EU, the US and Australia". Source |
| Pixieset | Canada | Not stated. EEA transfers run on Standard Contractual Clauses and Canadian PIPEDA. Source |
| SmugMug | United States | May transfer information "to servers operated by SmugMug or our service providers in the United States or other countries". Source |
| Zenfolio | United States | Personal information "is retained and stored in the United States". Source |
Common questions
Is Xposure GDPR compliant client gallery software?
Yes. Xposure is run by a Belgian company under EU law. The servers and database are in Germany, original photo files are stored in Western Europe, and every sub-processor is named here and in the privacy policy. You can export or delete your data at any time.
Where is my data stored?
The servers running Xposure and the database holding accounts, bookings, contracts and orders are in Germany, with Hetzner. Your original photo and film files are stored in Western Europe. Copies of images being viewed are cached near the viewer, which may be outside the EU. The copy of an uploaded film that plays in a gallery is kept and delivered by Cloudflare Stream, outside the EU.
Is Xposure hosted in Europe?
Yes. The platform runs on Hetzner, a German provider, on servers in Germany. The original photos are stored in Western Europe. The company behind Xposure is registered in Belgium.
Which client gallery platforms host in the EU?
Of the platforms photographers compare most often, Xposure and picdrop are EU companies. Pic-Time states that data is stored on Azure servers in the EU, the US and Australia. CloudSpot, SmugMug and Zenfolio state that data is processed or stored in the United States. Pixieset is Canadian and does not state a hosting region. Each statement is quoted with its source on this page.
Are my client photos ever stored outside the EU?
The originals are not. When a client opens a gallery, copies of the images they are viewing are temporarily stored on servers near them so the gallery loads quickly. That applies to the images only, never to the database. Print orders are the exception: the lab receives the order and the print file, and the plant that makes it can be outside the EU. Films uploaded to a gallery are another: the original stays in Western Europe with the photos, and Cloudflare Stream keeps the copy that plays, outside the EU.
Who is the data controller for my clients’ data?
You are. For your clients’ personal data, such as their name, email and booking details, the photographer is the controller and Xposure is the processor acting on your instructions. For your own account data, Xposure is the controller.
Can I export or delete everything?
Yes, at any time from your account. Deleting locks the account straight away and erases everything 30 days later, so a deletion by mistake can still be undone. Invoices and signed contracts are held for seven years because Belgian accounting law requires it, then deleted.