Viewfolio Privacy Policy
Effective date: 26 October 2026
1. Who we are
Viewfolio is operated by Staghill SRL, a company registered in Belgium, which is the data controller for the personal data described in this policy.
| Legal name | Staghill SRL |
| Company number | 0798.712.846 |
| VAT | BE 0798.712.846 |
| Registered office | Rue des Anciens Étangs 40, 1190 Forest, Belgium |
| Represented by | Moritz Freiherr von Hirsch |
| Privacy contact | info@viewfolio.app |
Questions about this policy or about your personal data can be sent to info@viewfolio.app or by post to the registered office above.
2. What this policy covers
This policy applies to the Viewfolio web application at viewfolio.app, the public website on the same domain and any related support channels. It explains what personal data we collect, why, how long we keep it and what rights you have.
Viewfolio is a business tool. Our customers are agencies, photographers and businesses that manage Google Street View content for their own clients. Where a customer uploads or syncs data about third parties, such as the names of their clients or the locations of their clients' premises, the customer is the controller of that data and Viewfolio processes it on the customer's instructions. This policy describes both roles.
This policy does not cover Google's own processing of your data. When you connect a Google account to Viewfolio, Google's privacy policy applies to Google's handling of that account.
3. Data we collect
We collect only what Viewfolio needs to manage, monitor and report on Street View publications.
| Category | What it includes | Source |
|---|---|---|
| Account data | Name, email address, profile picture if you sign in with Google, workspace name, billing details, plan and invoices. Viewfolio has no passwords: you sign in with Google or with a one-time email link, which is stored only as a hash | You, when you sign up and subscribe |
| Google account data | Google account identifier, email address and profile name of each connected Google account; OAuth access and refresh tokens | Google, when you authorise a connection |
| Street View content data | Photo and panorama identifiers, capture dates, GPS coordinates and headings, place identifiers, connection links between photos, publication status and view counts | Google Street View Publish API, on your behalf |
| Uploaded content | Panoramas, photos and metadata you upload through Viewfolio for publication | You |
| Client and location data | Names and addresses of locations and the clients you group them under, project names, notes | You and your team members |
| Team data | Names, email addresses and roles of people you invite to your workspace, and a log of changes they make | You and your team members |
| Usage and technical data | IP address, browser type, device type, pages visited, actions taken, timestamps, error reports | Automatically, when you use Viewfolio |
| Support correspondence | Messages you send to info@viewfolio.app and our replies | You |
We do not collect special categories of personal data as defined in Article 9 GDPR, and we ask that you do not upload them.
4. How we use data from your Google account
Viewfolio connects to Google through the Street View Publish API using OAuth 2.0 and the scope https://www.googleapis.com/auth/streetviewpublish. This scope lets Viewfolio read and manage the Street View photos published from the Google account you connect. We request it only when you choose to connect an account, and you can revoke it at any time.
We use data obtained through this API for the following purposes only:
- Listing and organising the photos, panoramas and tours published from your connected accounts, grouped by client, location and project.
- Recording view counts and publication status over time so that you can see trends and detect problems such as rejected photos or missing location data.
- Uploading content, updating metadata and managing connections between photos when you ask Viewfolio to do so.
- Producing reports and dashboards for you and, where you choose, for your clients.
Viewfolio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google user data only to provide and improve the features described above.
- We do not sell Google user data.
- We do not use Google user data for advertising, for building user profiles or for any purpose unrelated to Viewfolio.
- We do not transfer Google user data to third parties except to the infrastructure providers listed in section 6 that host and operate Viewfolio, where required by law or as part of a merger or acquisition, in which case this policy continues to apply.
- We do not allow humans to read Google user data except with your explicit permission for support, where necessary for security or legal compliance, or where the data has been aggregated and anonymised.
- We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models.
OAuth tokens are stored encrypted and are used solely to perform the actions above on your behalf. They are never shown to you, to your team members or to anyone else.
5. Legal bases
Under the GDPR we rely on the following bases for each use of your data.
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, providing the service you subscribed to, billing | Performance of a contract (Article 6(1)(b)) |
| Connecting Google accounts and syncing Street View data | Performance of a contract, and your consent given through the Google authorisation screen (Article 6(1)(a) and (b)) |
| Processing client and location data you upload | Performance of a contract with you; for the third parties in that data, you are the controller and Viewfolio is the processor |
| Keeping an audit trail of team changes | Legitimate interest in accountability and security within your workspace (Article 6(1)(f)) |
| Securing the service, preventing abuse, diagnosing errors | Legitimate interest in running a secure and reliable service (Article 6(1)(f)) |
| Answering support requests | Performance of a contract or legitimate interest, depending on whether you are a customer |
| Sending service notices such as sync failures, token expiry or billing | Performance of a contract |
| Sending product news | Consent, which you can withdraw at any time (Article 6(1)(a)) |
| Keeping invoices and accounting records | Legal obligation under Belgian accounting and tax law (Article 6(1)(c)) |
Where we rely on legitimate interest, we have assessed that the processing is necessary and does not override your rights. You can object at any time using the contact in section 9.
6. Who we share data with
We do not sell personal data. We share it only with the providers below, who process it on our instructions under a data processing agreement, and with the people you choose to share it with.
| Recipient | Purpose | Location |
|---|---|---|
| Google LLC | Street View Publish API, OAuth sign-in | United States, EU |
| Vercel, Inc. | Application hosting and serverless functions | United States, EU regions |
| Neon (Databricks, Inc.) | Database hosting | EU region (Frankfurt) |
| Cloudflare, Inc. | DNS, content delivery, email routing, and file storage (R2) for uploads before they are published | EU and global edge network |
| Stripe Payments Europe, Ltd. | Subscription billing and invoicing; Stripe handles card details directly and Viewfolio never stores them | Ireland, United States |
| Resend, Inc. | Transactional email such as service notices and support replies | United States, EU |
Within your workspace, data is visible to the team members you invite, according to the role you assign them. If you share a client dashboard or report, the client you share it with can see the data in that dashboard or report.
We may also disclose personal data where the law requires it, to protect our rights or safety, or to a successor in the event of a merger, acquisition or sale of assets, in which case this policy continues to apply.
International transfers. Google and Cloudflare may process data outside the European Economic Area, including in the United States. Where that happens we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework for certified recipients, and otherwise on the Standard Contractual Clauses, together with additional safeguards where needed.
7. How long we keep data
| Data | Retention |
|---|---|
| Account and workspace data | For as long as your account is active, then deleted within 30 days of account closure |
| Google OAuth tokens | Until you disconnect the account in Viewfolio, revoke access in your Google account settings or close your Viewfolio account, whichever comes first; deleted immediately on any of these |
| Street View content data and view-count history | For as long as the connected account remains connected, then deleted within 30 days of disconnection |
| Uploaded content awaiting publication | Deleted within 30 days after successful publication or after you delete it |
| Audit trail | 12 months, or for as long as your account is active if shorter |
| Usage and technical logs | 90 days |
| Support correspondence | 24 months after the last message |
| Invoices and accounting records | 7 years, as required by Belgian law |
Revoking Google access. You can disconnect a Google account from Viewfolio at any time in your account settings. You can also revoke Viewfolio's access directly at myaccount.google.com/permissions. Either action stops all further syncing and deletes the stored tokens for that account. Content already published to Street View remains on Google and is not affected.
Deleting your account. Workspace owners can export their data and delete a workspace with all its data at any time under Settings. You can also request deletion of your account and all associated data by email to info@viewfolio.app. We confirm deletion within 30 days, except for records we must keep by law.
8. How we protect data
All traffic to and from Viewfolio is encrypted with TLS. Data is encrypted at rest. OAuth tokens are stored encrypted with keys held separately from the database. Viewfolio does not use passwords; sign-in links and session tokens are stored only as one-way hashes.
Access to production systems is limited to the people who need it, protected by multi-factor authentication and logged. Each customer's workspace is isolated so that no customer can see another customer's data. We review access rights and dependencies regularly and apply security updates promptly.
If we become aware of a personal data breach that is likely to put you at risk, we will inform you and, where required, the Belgian Data Protection Authority without undue delay and within 72 hours of becoming aware.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy
- have inaccurate data corrected
- have your data erased, subject to the retention obligations in section 7
- restrict or object to processing based on legitimate interest
- receive the data you provided in a structured, machine-readable format and have it transferred to another provider
- withdraw consent at any time, without affecting processing that took place before withdrawal
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you; Viewfolio makes no such decisions
To exercise any of these rights, email info@viewfolio.app. We may ask you to confirm your identity. We respond within one month, which may be extended by two further months for complex requests, in which case we will tell you.
If you believe we have not handled your data correctly, you can complain to the Belgian Data Protection Authority: Gegevensbeschermingsautoriteit / Autorité de protection des données, Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be. You can also complain to the supervisory authority in the EU country where you live or work.
If you are a client of a Viewfolio customer and your data appears in their workspace, please contact that customer first, as they are the controller of that data. We will assist them in responding to your request.
10. Cookies
The Viewfolio application uses strictly necessary cookies to keep you signed in and to remember your language. These do not require consent. We do not use advertising or cross-site tracking cookies. If we add analytics cookies to the public website, we will ask for your consent first through a banner that lets you decline.
11. Children
Viewfolio is intended for businesses and professionals. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy as Viewfolio develops or the law changes. The effective date at the top shows the current version. For material changes we will notify you by email or through a notice in the application before they take effect. Earlier versions are available on request.
13. Contact
Staghill SRL, Rue des Anciens Étangs 40, 1190 Forest, Belgium. Email: info@viewfolio.app.