PhotoShelter abides by global and US privacy laws. All customers can access the information PhotoShelter stores about them. We will never collect, use, or sell your information without written permission, nor do we contact our users directly.

PhotoShelter has been fully GDPR-compliant since 2017, adhering to all seven core data protection principles: lawfulness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability. Data Processing Agreements are in place for all contracts and sub-processors. EU users have the right to access, correct, amend, or delete their personal data at any time by contacting privacy@photoshelter.com. PhotoShelter’s Data Protection Officer is CTO Kathy Carter.

PhotoShelter is party to the EU-US Data Privacy Framework as set forth by the US Department of Commerce, governing the lawful collection, use, and retention of personal information transferred from the EU and Switzerland to the United States. Compliance is subject to FTC investigatory and enforcement powers. Unresolved complaints can be referred to the American Arbitration Association at no cost to the individual.

PhotoShelter honors all California consumer privacy rights: the right to know what personal information we collect and how it’s used; the right to delete; the right to opt out of sale or sharing; the right to correct inaccurate information; the right to limit use of sensitive personal information; and the right to non-discrimination for exercising any of these rights.

PhotoShelter complies with PIPEDA by obtaining consent for data collection and use, maintaining appropriate security measures including automated vendor risk scoring, and providing individuals with access to their personal information. We collect information only by fair and lawful means, use it only for the purposes disclosed, and maintain clear and accessible privacy policies.

PhotoShelter supports compliance with HIPAA’s Security Rule through the required administrative, physical, and technical safeguards for electronic Protected Health Information (e-PHI). This includes annual risk analysis, SSO with detailed usage-rights management, AES-256×2 encryption at rest, TLS 1.2/1.3 in transit, and activity logs for auditing all access to systems containing e-PHI. Business Associate Agreements are available. Contact security@photoshelter.com.

Educational institutions can use PhotoShelter in a FERPA-compliant manner. Flexible permission controls allow administrators to restrict assets to private access, ensuring only authorized users can view sensitive files — including imagery of students. Setting collections to “not public” gives precise control over access at every level of the library.

Our Lumen UI is designed to conform with WCAG 2.2 AA, which exceeds the 2.1 requirements typically referenced in ADA compliance. Accessibility gates at every stage of development: designs must meet WCAG 2.2 AA before entering engineering, code cannot ship without passing AXE accessibility tests, and issues are reviewed on a two-week cycle. We partner with UsableNet for independent audits, disability community testing, and ongoing AQA monitoring.