Privacy Policy

The controller responsible for personal data processed on the Platform is:

Arxes Consultancy GmbH
Zahnradstrasse 22
8005 Zürich, Switzerland
Commercial register: Canton Zürich, UID CHE-150.551.662
Email: hello@whoshotyou.com

Arxes Consultancy GmbH operates the Platform under the brand “whoshotyou” at whoshotyou.com. Within the meaning of Art. 5 lit. j FADP and Art. 4(7) GDPR, Arxes Consultancy GmbH is the data controller. Correspondence should be addressed to the email above.

This Privacy Policy applies to all use of the whoshotyou platform at whoshotyou.com, including:

3a. Account data

3b. Profile contact channels and socials (Photographers, optional)

You may add any of the following to your public profile. Each is optional and may be removed at any time.

This information is shown on your public photographer page and is the means by which athletes can reach you outside the on-site contact form.

3c. Transaction and payment data

3d. Media and session data

3e. Content reporting and moderation

3f. Customer-support data

Submissions made through the on-site contact form: your first name, surname, email address, self-declared role (Athlete / Photographer / Other), category, message, and any file attachments. Attachments are stored on Cloudflare R2; the submission record is retained until the inquiry is handled and then in line with Section 7.

3g. Technical and usage data

For users in the EU/EEA we identify a GDPR Art. 6 legal basis below. For users in Switzerland, the FADP permits processing by private persons by default; we set out the corresponding purposes here for transparency.

Contract performance (Art. 6(1)(b) GDPR / Art. 31 FADP)

Legitimate interests (Art. 6(1)(f) GDPR / overriding interest under Art. 31 FADP)

Legal obligations (Art. 6(1)(c) GDPR / Art. 31 al. 2 lit. c FADP and Swiss accounting law)

Consent (Art. 6(1)(a) GDPR / Art. 6 al. 7 lit. b FADP)

You can withdraw any consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We use PostHog as our product-analytics tool to understand how the Platform is used and to improve it. PostHog runs strictly under cookie consent: it is inactive on first load and is enabled only after you choose “Accept all” on the cookie banner. If you select “Essentials only” or “Reject all non-essential”, PostHog captures nothing and no PostHog cookie or local-storage entry is written in your browser.

Where you have consented, PostHog collects:

Data residency. PostHog is configured on PostHog's EU cloud, with all event, person, and session-replay data stored in Frankfurt, Germany. We do not use PostHog's US cloud.

Reverse-proxy endpoint. Analytics requests are routed through whoshotyou.com/ingest/, a transparent reverse proxy that forwards requests to PostHog's EU endpoint. Its sole purpose is resilience to ad-blockers and request-classification heuristics that block well-known analytics domains; it does not bypass your consent choice. When you have not consented, the Platform does not send any requests to/ingest/ in the first place.

Withdrawing consent. You can withdraw consent at any time via the “Cookie Preferences” link in the site footer. After withdrawal, the Platform stops sending data to PostHog immediately. Previously-collected data may persist on PostHog's side until the applicable retention period expires; to request deletion of previously-collected analytics data, contact us at the address in Section 14.

Sentry is used only for application error monitoring; it is not used to build user profiles or to make automated decisions about you. Mapbox is used for location autocomplete and reverse-geocoding when you set or search a location. Neither Sentry nor Mapbox is used as a behavioral-analytics service.

We do not use Photographer-uploaded media to train artificial-intelligence models, whether our own or those of third parties. We do not license, share, or sell uploaded media to third parties for AI training purposes. We do not permit our infrastructure providers to use uploaded media for AI training purposes.

Uploaded media is processed only as necessary to operate the marketplace: storage on Cloudflare R2 (Section 6), watermark and thumbnail generation, delivery to buyers who have purchased the media, and the limited internal processing described in Section 3d.

Should we ever wish to use uploaded media for new purposes — including AI training, dataset licensing, or platform-marketing usage beyond the marketplace function — we will notify affected Photographers in advance and obtain explicit opt-in consent. Continued use of the Platform without opt-in shall not constitute consent for such purposes.

We do not permit our product-analytics provider PostHog (Section 5) to use event data, person-property data, or session-replay recordings collected through the Platform to train artificial-intelligence models.

We share personal data only to the extent necessary for Platform operations, contract performance, or legal compliance. Recipients are listed below by category, together with the country of processing and the transfer-safeguard relied upon for transfers outside Switzerland or the EU/EEA.

Payment and payout providers

Infrastructure, hosting, and tooling

Other recipients

For all transfers to countries that are not on the Federal Council's adequacy list (Annex 1 to the Swiss Data Protection Ordinance), we rely on the safeguards in Art. 16 al. 2 FADP — primarily Standard Contractual Clauses (with the FDPIC-approved Swiss Addendum) or the Swiss-US Data Privacy Framework, supplemented by a transfer-risk assessment where appropriate.

An up-to-date list of our sub-processors is available on request from hello@whoshotyou.com. We will give reasonable advance notice of any material change.

Account data – Athletes

Retained for as long as the account is active. Upon deletion, personal identifiers are permanently scrubbed and the authentication record is removed, subject to the exceptions below for transaction data.

Account data – Photographers

Retained for as long as the account is active. When a Photographer requests deletion, the account enters a 7-day grace period during which the request can be cancelled by the account holder. After the grace period, personal identifiers (full name, username, biography, profile picture, social and contact channels listed in Section 3b) are permanently scrubbed by an automated job and the authentication record is removed. The username is rewritten to a random, non-identifying value so foreign-key references in the database can survive without leaking the original identity. The underlying media files (originals and watermarked previews) are retained in our storage to honor the perpetual licenses already granted to buyers under Section 4 of the Terms of Service; these files are no longer publicly browsable but remain accessible to the buyers who purchased them.

Transaction and billing data

Retained for the period required under Swiss accounting and tax law (Art. 958f OR), currently 10 years from the end of the relevant financial year. The platform ledger and order records are kept on this schedule even after account deletion.

Audit log

Entries recording administrative actions (takedowns, account suspensions, refunds, content moderation decisions) are kept for the same accounting-law period — 10 years — so the platform's actions remain auditable and defensible against later legal claims.

Technical and log data

Server request logs and error events are retained at our hosting and error-monitoring providers' default periods (typically up to 90 days), unless longer retention is required for an ongoing investigation or legal proceeding.

Guest purchase data

Email address and order data for guest purchases are retained for the statutory accounting period and used only to deliver the order confirmation and download link. Guest download links are valid for 30 days. Guest email addresses are not used for marketing.

Contact-form submissions

Submissions are retained until the inquiry is handled and then for a reasonable additional period to evidence the response, typically not exceeding 24 months. Attachments are deleted on the same schedule.

Content reports

Reports and any associated moderation decision are retained alongside the audit log for the 10-year period, so that we have a complete record of the basis on which content was retained or removed.

Depending on the law that applies to you — the FADP for users in Switzerland, the GDPR for users in the EU/EEA, or other applicable national law — you may have the rights set out below.

To exercise any of these rights, contact us at hello@whoshotyou.com. We may ask you to verify your identity before processing your request and will respond within the timeframes required by applicable law, generally 30 days.

If you believe that our processing of your personal data violates applicable law, you have the right to lodge a complaint with the relevant supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC). In EU member states you may contact the data protection authority in your country of residence.

We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, or alteration. These include:

No method of internet transmission or electronic storage is completely secure. We will notify you and any applicable supervisory authority of a security breach affecting your rights as required under Art. 24 FADP and Art. 33–34 GDPR.

whoshotyou uses two categories of client-side storage:

Strictly necessary (no consent required)

Non-essential (consent required)

We use PostHog for product analytics and short session recordings, as described in Section 5. PostHog cookies and local-storage entries are written only after you have selected “Accept all” on the cookie banner. If you select “Essentials only” or “Reject all non-essential”, no PostHog cookie or local-storage entry is created and no analytics request is sent.

The cookie banner offers three symmetric options:

Your choice is stored in a small first-party preference cookie so we do not ask you again on every visit. You can revisit and change your choice at any time via the “Cookie Preferences” link in the site footer or by clearing the preference cookie in your browser. Changes take effect immediately without a page reload.

Cookies in detail

Our notice-and-action procedure for reporting content that infringes your rights — including copyright, personality rights under Art. 28 ZGB, or other applicable rules — is set out in Section 8.2 of our Terms of Service. The procedure includes in-platform reporting, email submission to hello@whoshotyou.com, auto-hide of content reported as a personality-rights claim, acknowledgment within 5 business days and substantive response within 14 business days, and a statement of reasons to affected users where content is removed.

Moderation decisions and report records are stored in our audit log and retained as described in Section 7.

We may update this Privacy Policy from time to time to reflect changes in our data practices, Platform features, or applicable law. We will notify registered users of material changes by email or by a prominent notice on the Platform at least 30 days before the changes take effect, except for changes required by law or to address an immediate security or compliance issue.

The date at the top of this document reflects the most recent update.

For any questions, requests, or concerns about this Privacy Policy or how we handle your personal data, please contact:

Arxes Consultancy GmbH
Zahnradstrasse 22
8005 Zürich, Switzerland
Email: hello@whoshotyou.com

We aim to respond to all privacy inquiries within 30 days.