Privacy policy: Client Gallery & Proofing

Last updated: 10 November 2026

This policy explains what data the Wix app “Client Gallery & Proofing” (the app), published by Kayabyte, the trading name of Caner Kaya, Stasjonsveien 64, 0771 Oslo, Norway (we, us), processes when it is installed on a Wix site.

What the app does

The app lets a site owner (a photographer) share private photo galleries with their clients and collect the clients’ favorites, notes and comments.

Roles

The site owner is the controller for the galleries and the client data in them. Kayabyte acts as a processor that handles the data only to run the galleries the owner set up. Wix.com Ltd. hosts the site, the Media Manager and the app’s dashboard; Cloudflare runs our backend.

Data the app handles

• From the site owner’s Wix account: the site and app instance IDs, the plan, and the site’s business email address (used only to send notices about client activity).
• Photos: uploaded from the owner’s browser directly into the owner’s Wix Media Manager as private files. Our backend never receives the photo files; it keeps their file IDs, names and sizes.
• Gallery data we store: title, client name and optional client email (for the owner’s own reference), the PIN as a salted hash (never the PIN itself), settings (favorites limit, downloads, expiry day, watermark), sets and order of photos.
• Client activity we store: which photos a client marked as favorites, notes, comments, the first name the client typed, and when a selection was sent.
• Visitors: a gallery visitor needs no account. Entering a PIN creates a signed session valid for 12 hours. The visitor’s IP address is used to count wrong PIN tries and to rate limit requests; it is not stored with the gallery.

What leaves our backend

• Download and preview links are requested from Wix Media Manager when a client opens the gallery or downloads a photo. A zip download is created by Wix and its link is only handed to a client who opened the gallery.
• Notices about client activity are sent to the site owner as a Wix notification where Wix shows it and, as an extra, by email from support@kayabyte.dev to the site’s business email address (sent with Resend).
• No data is sold or shared with anyone else.

Retention and deletion

Removing the app disables the galleries at once. The gallery data, picks and comments are deleted 30 days later (a reinstall within that time restores them). The owner can delete a gallery at any time, which deletes its picks and comments; the owner chooses whether the photo files also go to the Media Manager trash. Photo files in the Media Manager belong to the owner and are never deleted by us.

Logs

The service writes technical log lines (the app instance ID, the request path, the outcome and error codes). Logs are kept by Cloudflare for a short time.

Plans and payments

Paid plans are sold and billed by Wix. We never receive card details.

Cookies, tracking and third parties

The app sets no tracking cookies and uses no analytics or advertising services. The client’s first name is kept in the browser’s local storage so the client is not asked twice. No data is shared with third parties other than Wix, Cloudflare and Resend, as described above.

Your rights

For questions about this policy, or to exercise your rights under the GDPR, contact support@kayabyte.dev. Clients of a photographer who want their picks or comments removed should ask the photographer first, who controls the gallery.

Changes

We will update this page when the app’s data use changes and show the date at the top.