Privacy Policy

Last updated: October 8, 2026

This Privacy Policy explains what personal data Ultra collects, how we use it, who we share it with, how long we keep it and what rights you have. It applies to the website theultra.io, the dashboard at app.theultra.io, the Ultra iOS app, and the websites, galleries and booking pages that photographers publish with Ultra (together, the "Services").

1. Who we are

The Services are operated by FOP Revenko Pavlo (Kharkiv, Ukraine), referred to as "Ultra", "we" or "us". We are the controller of the personal data of our users (photographers and other account holders).

When a photographer uses Ultra to collect data from their own clients (for example, through a booking form or a client gallery), the photographer decides how that data is used and is its controller. We process that data on the photographer's behalf. See section 9.

Contact for privacy questions and requests: legal@theultra.io. General support: hey@theultra.io.

2. Data we collect

Account data. When you sign in with Google or Apple, we receive your name, email address and, from Google, your profile picture, together with an account identifier and sign-in tokens issued by that provider. If you choose "Hide My Email" with Apple, we receive a private relay address instead of your real email. We do not receive your Google or Apple password.

Content you upload or create. Photos and other files, folders and galleries, website pages, blog posts, products, booking event types, availability and payment instructions, and settings such as site name, description, contact email, phone number and social links.

Data about your clients. If you use galleries or booking, your clients may give us their name, email address, phone number, chosen booking time, messages, gallery selections and feedback, and order details.

Payment data. Ultra subscriptions are sold through Paddle, which acts as the merchant of record and processes your payment details. We receive your subscription status, plan, billing period and transaction references, never your full card number. If a photographer enables online payments for bookings, those payments are processed by LiqPay.

Usage and device data. When you visit our websites or the dashboard, we and our analytics providers collect information such as pages visited, clicks, browser and device type, approximate location derived from IP address, and referral source, using cookies and similar technologies (see section 6).

Photo quality checks. If you use photo analysis in the dashboard, it runs entirely in your browser. It detects facial landmarks only to estimate blur and closed eyes, and we store only the resulting scores and counts (for example, "2 faces, 1 with closed eyes"). We do not perform facial recognition, do not identify people and do not create or store facial templates.

Google Drive. If you choose to import photos from Google Drive, you select the files in Google's own picker, and we access only those files, only to copy them into your Ultra folder. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Communications. Messages you send us and records of emails we send you.

3. The Ultra iOS app

The iOS app uses the same account and data as the dashboard. In addition:

You sign in through the Ultra web login in a secure system browser sheet. The app receives only a session token, which is stored in the iOS Keychain on your device.
The app uploads only the photos you select in the system photo picker. It does not access the rest of your photo library.
The app contains no advertising or analytics SDKs and does not track you across other companies' apps or websites.
You can delete your account in the app under Settings → Delete account.

4. How we use your data

To provide the Services: create and secure your account, store and deliver your photos, galleries and websites, and run bookings (legal basis: performance of our contract with you).
To send service emails, such as booking confirmations and cancellations, gallery notifications and important account notices (contract).
To process subscriptions and refunds (contract, legal obligation).
To send onboarding tips and product news. You can opt out at any time using the link in these emails (legitimate interests, or consent where required).
To understand how the Services are used, fix problems and improve them (legitimate interests, or consent where required).
To prevent fraud and abuse, keep the Services secure and comply with the law (legitimate interests, legal obligation).

We do not sell your personal data and do not use it for targeted advertising in the iOS app.

We share personal data only with service providers that help us run the Services, under agreements that require them to protect it and use it only on our instructions:

Vercel – hosting of our websites and APIs.
Neon – database hosting.
Cloudflare – file storage (R2) and image delivery.
Cloudinary – hosting of some website images.
Resend – sending emails.
Google – sign-in, Google Drive import (only if you use it) and Google Analytics.
Apple – Sign in with Apple and its private email relay.
Microsoft – Microsoft Clarity analytics on the dashboard.
Meta – Meta Pixel on theultra.io, to measure our marketing.
Paddle – subscription payments.
LiqPay – booking payments, only where a photographer enables them.

Content you publish (websites, public galleries and booking pages) is visible to anyone who has the link or visits the site. We may also disclose data if required by law, to protect our rights or users' safety, or as part of a business transfer (with this Policy continuing to apply).

6. Cookies and analytics

Our websites and the dashboard use essential cookies to keep you signed in and to remember your language, and analytics cookies from Google Analytics, Microsoft Clarity (which records how pages are used, such as clicks and scrolling) and, on theultra.io, Meta Pixel. You can block or delete cookies in your browser settings; essential cookies are required for signing in.

Websites that photographers publish with Ultra may use their own analytics or marketing tags that the photographer adds; those are the photographer's responsibility.

7. International transfers

Our service providers may process data outside your country, including in the European Union and the United States. Where required, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

8. How long we keep data

Account data and content: for as long as your account exists. Folders you schedule for automatic deletion are removed on the date you choose.
After you delete your account: your profile, sites, folders, photos, bookings and sign-in sessions are deleted from our systems, and your Sign in with Apple authorization is revoked. Copies in backups are overwritten within 30 days.
Sign-in sessions expire after 30 days of inactivity.
Billing records: as long as required by tax and accounting law.

9. Data of photographers' clients

If you booked a session with or received a gallery from a photographer who uses Ultra, that photographer is responsible for your data. Please contact them first to access, correct or delete it. If you cannot reach them, write to legal@theultra.io and we will help.

10. Your rights

Depending on where you live (including under the GDPR), you have the right to access your data, correct it, delete it, receive a copy in a portable format, restrict or object to its processing, and withdraw consent at any time. You can edit most data directly in the dashboard or the app, and delete your account in Settings. For any other request, email legal@theultra.io. We will reply within 30 days. You also have the right to complain to your local data protection authority.

11. Security

We use encryption in transit (HTTPS), access controls, hashed one-time codes and secure storage of sign-in tokens. No method of transmission or storage is completely secure, but we work to protect your data and will notify you of any breach where required by law.

12. Children

The Services are intended for professionals and are not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has given us data, contact us and we will delete it.

13. Changes to this Policy

We may update this Policy from time to time. We will change the "Last updated" date above and, for significant changes, notify you by email or in the Services.

14. Contact

FOP Revenko Pavlo, Kharkiv, Ukraine Email: legal@theultra.io