Privacy

If you run a studio here

We are the controller. Write to us.

• The name and email address of everyone with a seat, the studio's own contact details, and its branding.

  To give the studio an account and let the right people into it.

  Basis Performance of the contract in the terms of service.

  Kept While the account is open, then deleted thirty days after it is closed.

• The plan, subscription status and billing history. Card details are entered on Stripe's own pages and never reach this software.

  To charge for the service and to show what was charged.

  Basis Performance of the contract, and legal obligation for the tax record of a sale.

  Kept As long as the law requires a record of the transaction.

• Sign-in attempts and whether each succeeded.

  It is what stops somebody walking a list of addresses to find which ones have accounts.

  Basis Legitimate interests in keeping accounts from being enumerated.

  Kept While the account is open.

• Error reports: the route that broke and the studio's id. Never a name, never a request body, and access links are stripped out of the address first.

  So a fault is noticed and fixed rather than reported by the person it happened to.

  Basis Legitimate interests in a service that works.

  Kept The reporting provider's own retention period.

If you are a studio's client

Your photographer is the controller. Ask them.

• Whatever the studio records: name, email address, phone number, venue addresses, the answers to their checklists, and messages either side has sent.

  It is the studio's client record. The software stores it on their behalf.

  Basis Held on the studio's instructions. They decide what is collected.

  Kept Until the studio deletes the client, the project, or closes the account.

• The photographs, video and documents a studio delivers, and the files a client uploads to a checklist. Photographs carry whatever the camera recorded, including when the frame was taken.

  Delivering the work is what the product is for.

  Basis Held on the studio's instructions.

  Kept Until the studio deletes the gallery, the project or the account.

• For a gallery a studio shares by invitation: the email address and name they invited, and when the gallery was last opened with it. The six-digit codes sent to that address are stored only as a one-way hash.

  So only the people a studio chose can open a gallery, without anybody having to make an account.

  Basis Held on the studio's instructions. They decide who is invited.

  Kept The invitation, until the studio removes it or deletes the gallery. Each code works for ten minutes and is deleted within a day of expiring.

• Notes left on a film: the words, the moment in the film they are about, and the name of the invited guest or signed-in client who left them.

  So a studio can see exactly what a client wants changed, and where.

  Basis Held on the studio's instructions.

  Kept Until the studio deletes the film or the gallery.

• The signing record on a contract: who signed, when, the wording they agreed to, their IP address and their browser's user agent.

  A signature nobody can evidence afterwards is not worth collecting. This is what makes it evidence.

  Basis Held on the studio's instructions, and the legitimate interest both sides have in a signature that holds up.

  Kept With the contract, until the studio deletes it.

If you sent a studio an enquiry

The studio you wrote to is the controller.

• The name, email address, phone number and answers given on a studio's enquiry or booking form, where the sender said they heard of them, the address of the studio's own web page the form was filled in on, the page of that site the visit started on, the site it was reached from, and the campaign tags in the link they followed — utm_source, utm_medium, utm_campaign, utm_term, utm_content, and the click identifiers gclid, fbclid and msclkid. No other part of any web address is kept.

  So the studio can reply, so a repeat enquiry finds the same person rather than making a second record, and so the studio can see which of its pages, and which of its campaigns, an enquiry came from.

  Basis Held on the studio's instructions, at the request of the person filling in the form.

  Kept Until the studio deletes the lead or closes the account.

• An anti-spam check on public forms sees the sender's IP address and browser signals at the moment of submitting. This software does not store either.

  It is what tells a person from a script on a form open to the whole internet.

  Basis Legitimate interests in not having the forms abused.

  Kept Not stored here at all. The provider keeps its own records.

• When somebody at the studio has connected their Gmail: the subject line, time and direction of each email exchanged with a lead or client, and the address it was exchanged with. Not what the email said.

  So the studio can see on one page that a conversation is already under way.

  Basis Held on the studio's instructions, with the consent of the staff member who connected the mailbox.

  Kept Until the lead or client is deleted, or the mailbox connection is removed.

If you shoot for a studio

The studio is the controller.

• The roster record: name, email address, phone number, biography, photograph, portfolio and tipping links, working days and time off. A studio's private notes about somebody are never shown to them.

  To schedule shoots and to credit the people on them.

  Basis Held on the studio's instructions.

  Kept Until the studio removes the record.

• Only for somebody who connects a calendar: their shoot and consultation times, and the busy periods on their own calendar. Titles of other people's events are not read.

  So a shoot does not get booked over something already in the diary.

  Basis Consent, given by connecting it and withdrawn by disconnecting.

  Kept Until the calendar is disconnected.

• Only for somebody who connects their Gmail: for each message to or from a person already in the studio's CRM, the subject line, the other person's address, whether it was sent or received, and when. Never the body or a preview — the permission asked of Google does not include them — and nothing at all about mail with anybody else.

  So an enquiry answered from the inbox does not look unanswered in the CRM.

  Basis Consent, given by connecting it and withdrawn by disconnecting.

  Kept Until the lead or client it is about is deleted, or the mailbox connection is removed.

If you opened a gallery link

The studio whose gallery it is, is the controller.

• A random identifier and the name typed in, kept in one cookie for a year, so a heart or a comment has an author. It grants no access to anything.

  So a gallery can say who liked a photograph without asking anybody to make an account.

  Basis Consent, given by typing a name. Clearing the cookie ends it.

  Kept Until the cookie is cleared, or the studio deletes the gallery it was used on.

• For a gallery shared by invitation, once a code is confirmed: a random token in a cookie for thirty days, readable only by that one gallery's address. We keep only a one-way hash of it, so the cookie cannot be recreated from anything we hold.

  So an invited guest confirms their address once per device rather than on every visit.

  Basis Strictly necessary to provide something that was asked for.

  Kept Thirty days, or until “Not you?” is pressed, or the studio removes the invitation — any of which ends it at once.

• For a gallery with a PIN, the PIN itself in a cookie for twelve hours, readable only by that one gallery's address.

  So a PIN is typed once rather than on every photograph.

  Basis Strictly necessary to provide something that was asked for.

  Kept Twelve hours.

• Where a studio has added our tracking line to their own website: the first page of it opened in this visit, the site it was reached from, and the campaign tags in the link. Held by the browser for that one tab, on the studio's own site, and read once — if and when a form on that site is submitted. It holds nothing that identifies anybody and it is never read on any other site.

  So an enquiry sent three pages later is credited to the page the visitor actually arrived on, rather than to whichever page happened to carry the form.

  Basis Held on the studio's instructions, on a website they operate. It is NOT strictly necessary — the form works without it — so where consent is required for it, that is the studio's to obtain, and we say so where they copy the line.

  Kept The length of the visit. The browser deletes it when the tab closes. Nothing is sent to us unless a form is submitted, and nothing at all is kept about somebody who does not send one.

If a studio emails you

The studio sending it is the controller.

• Whether a message was delivered, and — for a studio's marketing campaigns only — whether it was opened and which link was clicked. Never for a sign-in link, a reminder or anything else transactional.

  So a studio can tell whether a campaign landed.

  Basis Held on the studio's instructions, in their legitimate interests.

  Kept Until the studio deletes the campaign or closes the account.

• A record that somebody unsubscribed, which outlives the contact record it belonged to.

  Deleting the fact that a person opted out is how a person gets emailed again. This is the one record kept precisely so nothing else can undo it.

  Basis Legal obligation not to send marketing to somebody who has refused it.

  Kept Indefinitely, on purpose.