Data Processing Agreement

You, the studio, are the controller of your clients’ personal data. You decide whose data goes into the platform and why. We are the processor: we act on your instructions and do not decide what to do with your clients’ data on our own account.

For your own account data — your name, your login, your billing — we are the controller, and our Privacy Policy governs it.

We process your clients’ personal data only to provide the platform to you, and only as your use of it instructs: client records and contact details, session and booking information, photographs and the data derived from them, invoices and payment records, correspondence you choose to bring into the platform, and — if you enable it — face templates.

We do not sell it, rent it, use it for advertising, or use it to train AI models. We do not use it for any purpose of our own other than operating, securing and improving the service, and producing aggregate statistics from which no studio or client can be identified.

We use the third parties listed on our Subprocessors page, which forms part of this agreement. Each is bound by written terms no less protective than these, and we remain responsible to you for what they do.

We will update that page before a new subprocessor begins handling customer data. Ask to be put on the notification list and we will tell you directly. If you object to a new subprocessor on reasonable data protection grounds, tell us within 30 days and we will either find an alternative or let you terminate without penalty and refund any prepaid period.

These are the measures actually in place, not aspirations:

• data encrypted in transit (TLS) and at rest, across the database, object storage and backups;
• every request authenticated, and every query scoped to the organisation making it — a studio cannot address another studio’s records;
• client-facing galleries protected by a PIN, and client portal sessions by a signed cookie;
• credentials held by our hosting provider as encrypted environment secrets, never in the codebase, with an automated secret scan that blocks a commit containing one;
• dependency vulnerability alerts monitored, with security patches prioritised;
• access to production data limited to personnel who need it to operate or support the service.

We do not currently hold SOC 2 or ISO 27001 certification, and we will not imply otherwise. If you need one to proceed, tell us — it is better to know before you build on us.

If we become aware of a personal data breach affecting your clients’ data, we will notify you without undue delay and within 72 hours of becoming aware, giving what we know at the time: what happened, which data and roughly how many people are affected, what we have done, and what we recommend you do.

We will not wait until we have a complete picture before telling you. As the controller, any obligation to notify a regulator or the individuals themselves is yours, and we will give you what you need to meet it.

If one of your clients asks for their data — a copy, a correction, deletion — that request is yours to answer, and the platform is built so you can: client records are editable and deletable, galleries and their contents can be removed, and face data can be cleared from any gallery at any time.

If a request reaches us directly, we will not act on it unilaterally. We will point the person to you and tell you it happened, unless the law requires otherwise. The exception is biometric data: if someone asks us to destroy a face template of themselves, we will do it and tell you, because the statutes governing it give that right to the person rather than to you.

We process data in the United States. If you or your clients are in the UK, the EEA or Switzerland, that is a transfer out, and we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where relevant), which are incorporated into this agreement by reference.

We keep your clients’ data while your account is active. When you cancel, it is retained for 90 days so you can reactivate or export it, and then permanently deleted. Encrypted backups are kept for 30 days and then age out.

You can ask for earlier deletion at any time, and we will act within 30 days. Face templates are the exception in the other direction — they are destroyed on the shorter schedule published in our Biometric Data Retention & Destruction Policy, currently 18 months, whether or not you ask.

On reasonable notice, and no more than once a year unless a regulator requires otherwise, we will answer a written security questionnaire and provide the documentation we hold. We are a small company: we can give you honest answers and evidence, and we would rather do that than agree to an on-site audit we could not usefully host.

Data protection questions, breach notifications and requests under this agreement: hello@thephotographersframer.com.