Find my photos
Legal

600mm Privacy Policy

Version: 1.0 Effective date: 20 July 2026

Contact

Privacy email: hello@600mm.surf.

In this Policy, "600mm", "we", "us", and "our" refer to the provider of the Service and the party responsible for the processing described below.

This Policy explains how 600mm handles personal data when you visit 600mm.surf, create or use a photographer account, browse media, submit an order request, use a download link, or contact us.

1. Personal Data We Handle

Depending on how you use the Service, we may handle:

Photographer account data

  • name, email address, WhatsApp number, account status, and account creation time;
  • password hash and account-security records; we do not store the readable password;
  • password-reset token hash, expiry, and use status; and
  • session and authentication information needed to keep an account signed in and secure.

Uploaded media and session data

  • photos, videos, previews, posters, and technical versions of those files;
  • file name, size, media type, upload identifier, storage information, status, and timestamps;
  • capture date and time obtained from file metadata where available;
  • surf spot, session date and time, shooting method, photographer, price note, and publication status; and
  • people, boards, locations, and other information visible or audible in the content.

Photos and videos may be personal data when a person can be identified. They may also reveal sensitive information depending on their content and context.

Buyer and order data

  • selected media, order code, session and photographer, order status, and timestamps;
  • a pseudonymous browser/order key used to retrieve the order;
  • order and download activity, such as page views, WhatsApp-button clicks, issue status, and download counts; and
  • first-touch attribution fields: source, medium, campaign, landing path, and referring host.

The current Service does not ask buyers to create an account and does not collect or store buyer payment-card or bank-account details. Payment is arranged directly with the photographer outside 600mm.

Device, usage, and security data

  • browser/session cookies and similar identifiers needed for sign-in, security, and service functions;
  • page and feature interactions collected through first-party event records;
  • Google Analytics data, which may include online identifiers, device/browser information, approximate location, referral and interaction information; and
  • server, proxy, storage, and security logs that may include IP address, request time, requested path, response status, device or browser information, and diagnostic data.

Communications

We handle the information you include when you contact us about support, privacy, rights, safety, or content removal. When you choose to contact a photographer through WhatsApp, WhatsApp and the photographer handle that conversation under their own privacy practices. 600mm records that the contact button was used but does not receive the contents of the WhatsApp conversation through the current Service.

2. Where the Data Comes From

We receive personal data:

  • directly from photographers, buyers, people shown in content, and people who contact us;
  • automatically from browsers, devices, files, and use of the Service;
  • from photographers who upload content or provide order and delivery information; and
  • from service providers that help us operate, secure, measure, and support the Service.

If a photographer uploads information about another person, the photographer is responsible for having a lawful basis and giving any notice or obtaining any permission required by applicable law.

3. Why We Use Personal Data

We use personal data to:

  • create, authenticate, secure, and support photographer accounts;
  • receive, process, store, watermark, display, organise, and deliver media;
  • create and maintain order requests, connect buyers with photographers, and support temporary delivery links;
  • operate, troubleshoot, protect, measure, and improve the Service;
  • prevent fraud, abuse, unauthorised access, and infringement;
  • respond to support, removal, privacy, legal, and safety requests;
  • maintain records needed for disputes, compliance, and enforcement; and
  • comply with applicable law and lawful authority requests.

Depending on the country and activity, we rely on one or more lawful grounds: performing or taking steps toward a contract, consent, compliance with a legal obligation, and our or another party's legitimate interests in operating and protecting the Service. Where law requires consent for a particular activity, you may withdraw it, but withdrawal does not make earlier lawful processing unlawful.

We will not use a person's image for unrelated advertising or social-media promotion merely because the image was uploaded to the Service. Any separate promotional use requires the permissions and legal basis applicable to that use.

4. Cookies and Analytics

The Service uses essential browser storage or cookies for sign-in, security, CSRF protection, and core functions. Blocking them may prevent parts of the Service from working.

Ordinary public and Studio pages currently use Google Analytics 4. Google may set or read analytics identifiers and process device, browser, network, approximate-location, referral, and usage information. Token-bearing order and download pages, administration pages, and password-reset links are excluded from analytics by the current application configuration.

You can limit cookies through your browser and may use Google's browser opt-out tools where available. The availability of additional cookie choices may depend on applicable law and the version of the Service available in your location.

600mm does not currently use personal data to sell third-party behavioural advertising, and does not sell personal data for money. If that practice changes, we will update this Policy and provide any choices required by law before the change takes effect.

5. Who Receives Personal Data

We may disclose personal data only as reasonably necessary to:

  • the photographer involved in an order or content complaint;
  • the buyer where needed to provide the selected content and order status;
  • Hetzner, which hosts the application, database, logs, and local fallback files;
  • Cloudflare, which provides DNS and private R2 media storage and delivery infrastructure;
  • Google, which provides Google Analytics 4 on the pages described above;
  • Resend and related email infrastructure, which send password-reset messages;
  • WhatsApp/Meta when a user chooses to open WhatsApp and continue communication there;
  • professional advisers, insurers, auditors, or transaction counterparties under appropriate confidentiality safeguards;
  • authorities or other parties where required by law, a lawful request, protection of rights or safety, or establishment, exercise, or defence of legal claims; and
  • a genuine successor in a merger, financing, reorganisation, or transfer of the Service, subject to applicable law and appropriate notice.

Photographers and WhatsApp may act as independent controllers for data they receive and use for their own purposes.

6. International Data Transfers

600mm is an international online service. Personal data may be handled in countries other than the country where you are located, including where the Service and its providers operate. The current core infrastructure uses Hetzner hosting and Cloudflare R2 media storage. Provider systems, support access, and onward transfers may involve additional countries.

Where applicable law requires safeguards for an international transfer, we will use an approved transfer mechanism, contractual safeguards, an adequacy basis, consent where legally valid, or another permitted mechanism.

7. How Long We Keep Data

We keep personal data only for as long as reasonably needed for the purposes described above, subject to applicable legal, dispute, security, and backup requirements.

Current application defaults are:

  • incomplete upload chunks: up to 24 hours;
  • public previews and posters: scheduled for deletion 14 days after media creation;
  • original media: scheduled for deletion 30 days after media creation, unless temporarily needed for a pending or issued order;
  • new, uncompleted orders: generally expire after 3 days;
  • issued order archives and download access: generally expire after 7 days; and
  • password-reset links: no more than 60 minutes.

These periods are configurable and may differ if the Service displays or communicates another period. Deletion from active systems may not immediately remove a securely retained backup, provider log, fraud-prevention record, or record required by law or a dispute.

Account data, session metadata, order records, first-party events, complaints, and general server logs are retained only while reasonably necessary for account operation, security, support, disputes, compliance, and legal obligations. Different periods may apply depending on the nature of the record and applicable law.

8. Security

We use technical and organisational safeguards designed for the nature of the Service, including password hashing, access controls, private object storage, protected previews, temporary signed links, restricted token-bearing pages, and transport encryption. No online service can guarantee absolute security.

Keep account credentials and download links confidential. Tell us promptly at hello@600mm.surf if you suspect unauthorised access or disclosure.

9. Your Privacy Rights

Depending on applicable law, you may have the right to:

  • receive information about our processing;
  • access and obtain a copy of your personal data;
  • correct inaccurate or incomplete data;
  • request deletion, restriction, or objection;
  • withdraw consent;
  • request data portability;
  • complain to a competent data-protection or consumer authority; and
  • receive information about or challenge certain automated decisions.

To make a request, email hello@600mm.surf. Describe what you need and provide enough information to locate the relevant data. We may request proportionate verification, but do not send unnecessary identity documents. Rights are subject to legal exceptions, including the rights of others, security, legal obligations, and establishment, exercise, or defence of claims.

We do not currently make decisions producing legal or similarly significant effects based solely on automated processing.

10. Image and Content Removal

If you appear in a photo or video and want it reviewed or removed, email hello@600mm.surf with the page URL or enough information to locate the content and a brief explanation. An authorised parent, guardian, or representative may submit a request for another person.

We may temporarily restrict the content, contact the photographer, and ask for limited information needed to verify the request. We will assess privacy, image, copyright, safety, public-interest, contractual, and other relevant rights under applicable law. We will not require a person to purchase an image as a condition of requesting review or removal.

11. Children

The Service is not intended for children to create accounts or submit orders independently. Photographs and videos may incidentally show children at public surf locations. Such content receives heightened care. A parent or legal guardian may request prompt review using the removal contact above.

Photographers must obtain parental or guardian permission where required and must not upload exploitative, intimate, unsafe, or otherwise unlawful content involving a child. We may apply additional child-safety and age-assurance measures where required by applicable law.

12. Third-Party Links

The Service may link to websites, payment methods, or communications tools that we do not control. Their privacy policies apply to their processing. Review those policies before providing personal data.

13. Changes to This Policy

We may update this Policy to reflect legal, technical, or operational changes. We will display the effective date and give additional notice or seek consent where required by applicable law. Material changes will not be applied retroactively where prohibited.

14. Contact and Complaints

Privacy and removal email: hello@600mm.surf

You may also complain to the privacy or consumer authority competent for your location or for the relevant processing. Please contact us first if you are comfortable doing so, so we have an opportunity to address the issue.