GDPR & EU hosting
Your galleries live in Europe
A Belgian company, German servers, photos stored in Western Europe. If a client ever asks where their pictures are kept, you have an answer.
What stays, and what travels
Stays in the EU4 of 5
- The databaseAccounts, bookings, contracts, orders
- Your original photo filesFull-resolution masters, as uploaded
- The servers running XposureHetzner, Germany
- AnalyticsIn house, no third-party tracker
Travels1 of 5
- Cached copies of images being viewedHeld near the viewer so galleries open quickly
A gallery opened in Sydney loads from a server near Sydney. That is how it loads quickly, and it is the images only. Your account, your records and your original files do not move.
Who else touches it
The full list. There is nobody else.
- HetznerServers, database and analyticsGermany
- CloudflarePhoto storage and deliveryEurope location
- StripePayments and payoutsUnited States
- ResendTransactional emailUnited States
- GoogleCalendar sync, only if you connect itUnited States
For your clients' details you are the data controller and we are the processor. For your own account, we are the controller. Either way you can export or delete everything from your account. The privacy policy is the full and authoritative version.
Common questions
Is Xposure GDPR compliant?
Yes. Xposure is run by a Belgian company under EU law. The servers and database are in Germany, original photo files are stored in Western Europe, and every sub-processor is named here and in the privacy policy. You can export or delete your data at any time.
Where is my data stored?
The servers running Xposure and the database holding accounts, bookings, contracts and orders are in Germany, with Hetzner. Your original photo files are stored in Western Europe. Copies of images being viewed are cached near the viewer, which may be outside the EU.
Is Xposure hosted in Europe?
Yes. The platform runs on Hetzner, a German provider, on servers in Germany. The original photos are stored in Western Europe. The company behind Xposure is registered in Belgium.
Are my client photos ever stored outside the EU?
The originals are not. When a client opens a gallery, copies of the images they are viewing are temporarily stored on servers near them so the gallery loads quickly. That applies to the images only, never to the database.
Who is the data controller for my clients’ data?
You are. For your clients’ personal data, such as their name, email and booking details, the photographer is the controller and Xposure is the processor acting on your instructions. For your own account data, Xposure is the controller.
Can I export or delete everything?
Yes, at any time from your account. A limited set of records such as invoices and signed contracts is retained where financial record-keeping law requires it, then deleted.