Privacy policy

Last updated: 30 October 2026

This page explains which personal data passes through image57.com and through the websites of the photo studios hosted by Im.Age 57, why, who receives it, how long it is kept and how to exercise your rights. It describes what the software actually does today.

Who is responsible
The data collected
Why
Who receives it
Cookies, Google and Meta
Sharing with Google and Meta for advertising
How long
Outside Burkina Faso
Your rights
Security
Google app « Im.Age 57 site builder »
Changes

1. Who is responsible

Im.Age 57 and the image57.com website are published by GAIA (GOLDEN AGE IM AGE), a sole proprietorship under Burkina Faso law, until a dedicated company is created. « Perspective Gaia » is a GAIA brand, not a company.

Owner: TCHALA Essoham · RCCM BF-OUA-01-2026-A10-16158 (Ouagadougou Commercial Court, 21/08/2026) · IFU 00324910D
Main establishment: Ouagadougou, Nouveau Secteur 44, Parcelle 16, Lot 30, Section KS, Burkina Faso · Postal address: S/C 01 BV 30642 Ouaga CNTC

Contact for your personal data: [email protected] — or the form image57.com/contact.

On image57.com — Im.Age 57 is responsible for the data collected on its own pages (contact form, launch sign-up) and for the accounts of the studios that use the software.
On a studio's site — (an address ending in .image57.com, or the studio's own domain name): the studio is responsible for its clients' data. Im.Age 57 hosts its site, bookings, shop and galleries, and processes that data on the studio's behalf.

2. The data collected

Only what you type, or what the service needs in order to work:

Booking a sessionName, phone number (with the country code), e-mail (optional), note for the studio, the session, date and options chosen, outfits or looks chosen. If you arrive from an ad: the campaign parameters in the address (utm_source, utm_medium, utm_campaign, utm_term, utm_content, fbclid).

Order or rental in the shopName, phone, items, pickup at the studio or delivery. For a delivery: the address you type and the position on the map — your phone's position if you allow it, a point you place, or a link you paste. For a rental: your agreement to the contract, with an encrypted fingerprint (HMAC) of your IP address, never the address itself.

Client accountPhone, name, password (kept only in hashed form, bcrypt), e-mail if you add one, two-step sign-in if you turn it on, backup number if you add one. For each sign-in: the browser and the IP address, to show you your devices and let you sign them out.

PhotosThe photos from your sessions that the studio delivers to you, your picks, comments and retouching requests.

ReviewsDisplay name, rating, text and photos of your review. The photos are stripped of all their metadata, GPS position included. The buyer's number links the review to the purchase and is never shown.

Text messagesFor each text message sent: the number and the delivery status. The text of the message is not kept. If you refuse promotional texts (« stop » link), your number is kept in the opt-out list.

Contact form and sign-up (image57.com)Name, studio, country, phone, e-mail, the plan you are interested in, message, and the page or campaign you came from.

A studio's accountStudio name, manager's name, e-mail, phone, WhatsApp number, country, business and billing address, logo, hashed password, two-step sign-in.

We collect no biometric data: Im.Age 57's servers do no face recognition.

3. Why

Record and confirm your booking or order, remind you of it, take the payment, arrange the delivery.
Deliver your photos and let you pick the ones to retouch.
Protect your account (sign-in, second step, devices).
Send you the text messages and e-mails about your booking, your order or your account.
Measure which ads bring bookings and purchases — only if you accept (section 5).
Answer the studios that write to us.

4. Who receives it

We do not sell your data. It is passed only to those who need it for the service:

The studio you book with, order from or receive your photos from.
Hosting — a server rented from Contabo (in Germany, according to Contabo's network registry). All traffic goes through Cloudflare, which provides the HTTPS encryption and the studios' domain names. Photos and the encrypted backups of the database are stored on Cloudflare R2.
Text messages — sent through GAIA Commerce to the Orange network: your number and the message.
E-mails — sent by Brevo (sign-in codes, replies to your messages): your address and the message.
Payment — the provider the studio chose: GAIA (LigdiCash), LigdiCash, Flutterwave, LeekPay or SebPay. It receives the amount and what it asks for the payment (depending on the case: name, e-mail, phone number). You enter your Mobile Money code or your card on its page or on your phone: Im.Age 57 never sees them.
Home delivery — when the studio delivers through a GAIA courier: your name, your phone, the delivery address or position, and the items.
Retouching by artificial intelligence — when the studio asks for an online retouch, the photo concerned is sent to the service that does it (Retouch4me, Stability AI or Novita AI).
Error tracking — Sentry receives the server's error reports; passwords, phone numbers, cookies and sign-in tokens are removed from them before they are sent.
Map — when you open the delivery map, your browser loads the map tiles from OpenStreetMap. A Google Maps link you paste is opened by our server to read the position, without sending anything else.
Google and Meta — for measuring visits and advertising, sections 5 and 6.

5. Cookies and your device's memory

The public pages of image57.com and of the studios' sites (booking, shop, contact, gallery, portfolio) ask for your consent first, with two buttons of the same size: « Necessary only » and « Accept all ». « Choose » opens the list of categories below, with a switch for each optional one: you turn off what you do not want. Your choice is kept in this browser for 6 months. Until you have answered, nothing optional is stored.

Necessary — always on

Your sign-in to your account and « Stay signed in », the cart, the photo selection in progress, the language and your cookie choice. Without them the site cannot do what you ask of it; they stay on your device and are never used for advertising.

Preferences — this device's memory

If you keep them, the site remembers, on this device only: your name, number and e-mail for your next booking or order; the Mobile Money operator and number you paid with; the address or location of your last delivery; your last search, sort and the items you viewed in the shop (« Recently viewed »); a message not yet sent from the contact form; the session and filter open in your gallery; the first name left on a shared photo. None of this is sent to Google or Meta. If you turn Preferences off, all of it is erased from the device at once.

The next two categories only appear on sites that have a Google tag, Google Analytics or a Meta pixel.

Statistics — Google Analytics

Google Analytics counts visits: the pages viewed, the type of device, the approximate city and how you arrived (ad, search, shared link). It sets its cookies (_ga) to recognise your browser from one visit to the next. Google Analytics does not store your IP address.

Advertising — Google Ads and Meta

Google sets its advertising cookies and counts the visits, calls, WhatsApp messages, bookings and payments that came from its ads.
Meta (pixel and Conversions API, relayed by our server) receives the same events with your IP address, your browser and its _fbp / _fbc cookies.

While Statistics and Advertising are off

Google: the tag and Google Analytics run in « consent denied » mode — no cookie. Google receives only signals with no cookie and no identifier (for example « a page was viewed », « a booking happened »), which it may use to estimate what it cannot see.
Meta: nothing is loaded or sent from your browser.

When a payment starts or is confirmed, our server also reports the event to Meta (service, amount, technical reference), with no name, number, e-mail or IP address, only if Advertising was accepted on this site when the payment was started. Otherwise, or if the studio started the payment, our server tells Meta nothing about it.

On a studio's site, the Google tag, Google Analytics and the Meta pixel are the studio's: the data goes to its own Google Ads, Google Analytics and Meta accounts.

Change my cookie choice

6. Sharing with Google and Meta for advertising

Your phone number and your e-mail may be shared with Google in hashed form (turned by the SHA-256 algorithm into a fingerprint from which the number cannot be recovered):

Enhanced conversions — when you send a booking or a payment is confirmed on the site, your number (and your e-mail if you gave it) is hashed in your browser and sent with the conversion, so that Google can link it to the ad you clicked. Only if Advertising is accepted, only on an HTTPS page and only if the site has a Google tag.
Customer lists — Im.Age 57, for its own customers, and each studio, for its own, may send Google Ads a list of hashed numbers and e-mails, to stop showing ads to people who are already customers and to measure results.

Today, neither your number nor your e-mail is sent to Meta, in clear or hashed. If that changes, this page will say so first.

Google uses these fingerprints for matching and measurement, under its own rules: policies.google.com/privacy.

To object

Choose « Necessary only », or turn Advertising off with « Change my cookie choice » above: nothing more is shared from your browser.
To be removed from customer lists: write to the studio, or to Im.Age 57 (section 1).
You can also adjust personalised advertising in your Google account: myadcenter.google.com.

7. How long

Delivered photos: the full-size file is deleted at the end of the delivery window the studio chose (1 to 30 days, 30 by default); the thumbnail stays. A client who pays for hosting keeps their photos.
Originals from the session, to pick the photos to retouch: 7 days by default, or the window the studio set.
Encrypted database backups: 30 days for the daily copies, 365 days for the monthly copies.
Sign-ins: erased one day after they expire, or 30 days after a sign-out. Codes sent by e-mail: 10 minutes. Sign-in link sent by text message: 30 days. New-password link: 24 hours.
Bookings, orders, accounts, reviews and contact messages: kept as long as the client's account exists. You can ask for them to be deleted at any time (section 9); only records the law requires us to keep, such as accounting documents, are then kept for the legal period.

8. Outside Burkina Faso

Several of the providers in section 4 (hosting, Cloudflare, Brevo, Sentry, Google, Meta, retouching services) process data outside Burkina Faso. These countries include Germany (server), France (Brevo) and the United States (Cloudflare, Google, Meta); retouching services may process photos in other countries. The request to the CIL to authorise these transfers (article 42 of law no. 001-2021/AN) is in progress.

9. Your rights

Burkina Faso's law n° 001-2021/AN of 30 March 2021 on the protection of persons with regard to the processing of personal data gives you the right:

to access your data (article 17);
to have it corrected, completed, updated or deleted (article 21);
to object, on legitimate grounds, to its processing (article 20), and to withdraw your agreement at any time;
to have data about you that was made public on a website taken down (right to be forgotten, article 22);
to receive marketing only with your prior agreement (article 14).

How

A studio's data (booking, order, account, photos): write to or call the studio, using the contact details on its site. If it does not answer, write to Im.Age 57.
image57.com's data: write to Im.Age 57 (section 1).
What you can do yourself: change your cookie choice; refuse promotional text messages with the « stop » link they contain; in your account, change your number, remove a backup number, remove comments on your photos, cancel your retouching picks.

We may ask you to prove your identity (for example with a code sent to your number). A correction or a deletion is made at the latest two months after your request, as article 21 requires.

You can also refer the matter to the Commission de l'informatique et des libertés (CIL), Burkina Faso's supervisory authority: www.cil.bf.

10. Security

Pages and the API are served over HTTPS, encrypted by Cloudflare.
Passwords are kept only hashed (bcrypt); two-step sign-in keys are encrypted.
Database backups are encrypted before they leave the server.
Galleries and shared photos open through a personal link, with no advertising tag.

11. Google app « Im.Age 57 site builder »

Im.Age 57 is preparing a « Connect Google Ads » button in the site editor, so that a studio can link its own Google Ads account. This connection is not in service yet.

When it is, it will happen only at the studio's request, with the permission the studio gives on Google's screen (Google Ads access, « adwords »), and the studio will be able to withdraw it at any time. It will read the list of Google Ads accounts the studio can access, create the site's conversion actions in the chosen account (booking sent, payment received, WhatsApp click, Call click) and read their codes to fill them into the site builder. It will not touch campaigns, budgets or billing, and will send no client data.

Data received from Google APIs will be used only to provide this feature to the studio: it will not be sold, used for advertising, or read by a person without the studio's agreement, in accordance with the Google API Services User Data Policy, including the Limited Use requirements.

12. Changes

When the software changes what it does with your data, this page changes with it; the date at the top shows the last update.