Order-photo privacy
How we handle photos submitted with an order
Effective August 1, 2026. Notice version order-photo-privacy-2026-08-01; consent version order-photo-consent-2026-08-01-v3.
What this notice covers
This notice applies when an authorized order participant chooses to upload property photos through the private Xpress Reports order-status page. Uploading photos is optional and does not guarantee that a photo will appear in an appraisal or other report.
Information we process
We process the image file and its filename, file type, size, dimensions, selected category, optional caption, related order reference, upload and processing timestamps, processing results, and retention status. Original files are preserved for the appraisal order and may contain embedded image metadata such as camera or device details, capture time, and GPS or other location information. Authorized staff should use that embedded metadata only for the order, appraisal, security, or compliance purposes described here. Cloudflare may also process limited request, security, and diagnostic metadata needed to deliver and protect the service.
Why we use it
We use submitted photos to authenticate the upload to the correct paid order, perform private file and image checks, make the photos available to authorized appraisal staff, prepare the order deliverable, prevent abuse, troubleshoot failures, and maintain an audit trail.
Cloudflare storage and processing
The photo workflow uses Cloudflare services exclusively for application storage and processing: private R2 buckets for image objects, D1 for order-photo metadata and audit events, Images for image inspection and transformation, and Queues for asynchronous processing. The buckets have no public development URL, public custom domain, or browser CORS policy. Incoming quarantine objects have a seven-day safety expiration; stored image objects are governed by the retention rule below.
Retention and deletion
Uploaded image files are scheduled for deletion three years (1,095 days) after upload. If appraisal staff select or include a photo, it becomes part of the professional workfile and is retained for at least three years from that review decision; an existing later deadline is never shortened.
An authorized order participant may remove an ordinary photo through the order-status page while it remains eligible for customer deletion. A photo cannot be removed there after it becomes workfile material or is actively processing. When deletion becomes due, the system marks the record deleted and removes associated image objects through a reconciled cleanup process. Minimal order, security, and audit metadata may remain when needed to document the transaction, deletion, professional workfile, or other legal obligations.
Access and sharing
Photos are available only to the authorized order participant using the private order credential and to authorized Xpress Reports appraisal or administrative staff with the required photo permissions. We do not publish submitted photos from the storage buckets. A selected photo may appear in the report delivered for the order as professional judgment requires.
Your choices and requests
Where applicable, you may ask about access, correction, or deletion of submitted photos. Fraud-prevention, security, and other legal requirements may limit or delay a request. Use the support or privacy contact shown in your order confirmation or engagement materials and include the order reference, but do not send the private order key by ordinary email.
Notice changes
The version shown above identifies the notice tied to new photo-upload consent. If this notice changes materially, new uploads will require the updated consent version.