Shootandflow Privacy Policy

Pre-launch version. Shootandflow is in early access. This document takes effect on the effective date shown below.

Controller/operator for our own business data: [LEGAL ENTITY NAME] (Oregon), operating as Shootandflow. Privacy contact: support@shootandflow.co. Effective date: [ADOPTION DATE] / [POLICY EFFECTIVE DATE]. Google Calendar section last updated: [GOOGLE SECTION LAST UPDATED]. Business mailing address: [LLC BUSINESS MAILING ADDRESS].

Draft scope: This is the proposed launch policy, based on the November 6, 2026 unpublished Shootandflow draft, plus a Google Calendar / Limited Use addition required for sensitive-scope OAuth verification. Shootandflow's described product is not confirmed live, and two-way Google Calendar sync is a planned feature, not a live integration. The vendor inventory, token-encryption, disconnect, retention, and security promises below must match the deployed service before adoption. This is a privacy notice, not a waiver of your legal rights.

1. Photographers, Clients, and visitors

We act as controller/business for our subscriptions, support, website operations, fraud prevention, legal compliance, and direct business communications. A Photographer generally acts as controller/business for their Client contacts, photographs, bookings, signatures, and gallery activity; we process those records on their instructions under the Data Processing Addendum (DPA). A studio's authorized staff can access records according to its permissions. Stripe and a fulfillment lab may have independent legal duties for some processing rather than always acting as our subprocessors. We explain those roles instead of labeling every recipient a processor.

Contact the Photographer for a request about their independent records or decisions. Contact us if you do not know which Photographer controls a record, need help forwarding a request, or have a request about our own processing, including a studio manager's Google Calendar connection. We will not simply reject a legally applicable direct request because a Photographer is involved.

2. Information, sources, and purposes

Images can reveal age, relationships, health, religion, or location, and embedded metadata may contain GPS. Avoid unnecessary metadata and sensitive details; the Photographer should remove GPS and obtain necessary permission. No face-recognition, biometric identity template, precise-location tracking, sale, or automated high-impact profiling is authorized by this policy. If proposed later, those features require a new assessment, clear notice and legally required consent before processing. An ordinary photograph is not automatically biometric data, but analysis that identifies a person can change that result.

Provide only information needed for the transaction. Required fields are indicated at collection; declining them may prevent that feature. We do not need full card numbers in support, galleries, or contracts. Payment fields must be handled by Stripe; our intended implementation stores only tokens, transaction references and limited billing metadata, not full card details. This must be verified in checkout testing. Connecting Google Calendar is optional and is not required to use Shootandflow.

3. Why we use data; no undisclosed monetization

We use information to provide requested features, maintain security, answer requests, send essential transaction/account notices, comply with law, and establish or defend claims. Optional marketing requires the applicable permission and can be stopped without losing service notices. We do not sell personal information, share it for cross-context behavioral advertising/targeted advertising, or train a general-purpose AI model on photos, contracts, Client records, or Google user data under this policy. We do not operate a public data-broker service. Optional analytics beyond necessary operations must be identified and, where required, consented to under the Cookie Policy.

Google Calendar data is used only for the user-facing sync features described in Section 9. We do not use it for advertising or for AI/ML training.

Where GDPR/UK GDPR applies to our own processing, grounds are contractual necessity for account/service duties, legitimate interests in proportionate security/support and business administration, legal obligations, and consent where required for optional tracking, marketing, or sensitive processing, and where the studio manager authorizes the optional Google Calendar connection. A Photographer must establish its own grounds for Client records. Consent can be withdrawn without affecting prior lawful processing. We do not claim that a contract or legitimate interest alone authorizes special-category data.

4. Recipients and public content

We disclose only relevant data to authorized studio users and the audience selected for a gallery/site; hosting/storage/network providers; transactional-email and payment providers; a selected print lab/carrier for production/delivery; and support/security providers actually engaged and disclosed. The proposed subprocessor list is: Render, Cloudflare R2, Stripe, Resend, and WHCC, with status and role caveats. It is not a statement that WHCC credentials or any deployment are active.

When a studio manager connects Google Calendar, Shootandflow sends booking-mirror event data to Google so the event can appear on that manager's Google Calendar, and receives free/busy ranges and event IDs from Google's Calendar API. Google processes that data under its own terms and privacy policy. We do not treat Google as a Shootandflow subprocessor for the manager's existing personal calendar content, and we do not send Client galleries, photos, or payment details to Google Calendar.

We may disclose narrowly necessary records under valid legal process, to prevent fraud or unlawful harm, to comply with reporting duties, or in a merger/asset transfer subject to confidentiality and existing privacy commitments. A buyer cannot silently use historical data for a new incompatible purpose. For Google user data, a merger, acquisition, or sale of assets that would transfer that data requires the user's explicit prior consent, as described in Section 9. We may share at your explicit direction. A private link can be forwarded, and public content can be copied/indexed; access controls are not a guarantee of secrecy. Changing visibility does not retrieve copies others have lawfully downloaded. We do not disclose an entire Client gallery to a lab merely because one print is purchased.

5. Retention and deletion: proposed launch schedule

A Photographer may select shorter lawful retention; we do not extend Client records merely for possible future monetization. Exceptions must be specific, access-restricted, and periodically reassessed. Deletion from our systems does not erase an independent Photographer's, Stripe's, lab's, or carrier's lawful records, or events that a manager chooses to leave on their own Google Calendar after disconnecting. We relay requests and explain the remaining responsibility. This is a proposed schedule, not evidence that deletion jobs or vendor retention settings are implemented.

6. Access, choices, and privacy rights

Email support@shootandflow.co with “Privacy request.” You may request access, correction, deletion, a reasonably portable copy, and information about our processing. Depending on applicable law and coverage thresholds, California and other state residents may also have rights to know categories and specific information, recipients, sources, purposes, sensitive-data choices, and to opt out of sale, sharing, targeted advertising, or profiling with significant effects. Oregon residents may have a right to a list of specific third parties, not only categories. We do not perform the sale/targeting/profiling activities listed above. We will recognize legally binding universal opt-out signals such as GPC for any covered activity; traditional Do Not Track is a different, nonuniform signal. No browser signal is claimed to erase a booking or contact submission.

We verify requests proportionately using information already held, avoid collecting unnecessary ID, accept authorized agents as required, explain lawful exceptions, and do not discriminate for exercising rights. We normally respond within 45 days for applicable U.S. state requests and within one month for GDPR requests, using only extensions permitted by the relevant law with notice. To appeal a denial, reply “Privacy appeal”; we respond within the applicable deadline (45 days in Oregon). You may complain to your state attorney general, including https://www.doj.state.or.us/consumer-protection/, or your competent data-protection authority where applicable. No appeal step is a prerequisite to a statutory complaint.

For Photographer-controlled data we assist, verify authority and route the request rather than deciding the Photographer's lawful grounds. A portable copy may include uploaded files and structured records, not someone else's private information, proprietary software, or third-party assets without a license.

A studio manager can also disconnect Google Calendar in the studio dashboard, or revoke Shootandflow in Google Account permissions, as described in Section 9.

7. Children and sensitive data

Paid studio accounts and contracting/purchasing Clients must be adults or use an authorized adult. We do not offer under-13 accounts or knowingly collect information directly from under-13 users. A child in an adult's uploaded family photo is not necessarily a child directly using an online service; COPPA applicability still depends on actual collection and audience, not a disclaimer alone. Photographers must obtain required permissions and cannot use this policy as a model release. Report suspected direct collection from a child to us; we will restrict it, investigate, and delete or obtain required consent where law permits, without continuing unnecessary collection.

Children's galleries should be private by default. Sensitive information is not needed for ordinary booking. No under-18 information is sold or used for targeted advertising. Separate, explicit lawful consent and operational safeguards are required before a sensitive-data feature, face-matching, or public child profile may launch. We do not offer HIPAA-compliant records storage or invite medical records through these tools. The optional Google Calendar connection is for adult studio managers only.

8. Security, location, and transfers

We will use reasonable safeguards proportionate to the data, including HTTPS, access controls, least-privilege studio roles, secure secret storage, monitoring and a tested recovery/deletion process. Google OAuth access and refresh tokens are stored encrypted at rest and transmitted only over HTTPS. This draft does not claim SOC 2, HIPAA certification, an independent audit, or absolute security. A security incident will be investigated and notices sent as applicable law and the DPA require.

The intended initial operation is U.S.-based. Actual storage/backup/support regions for every provider must be confirmed before launch. International availability does not itself establish an EU/UK transfer safeguard. For restricted transfers we require a valid mechanism, such as an applicable adequacy decision or completed SCC/UK addendum plus necessary assessment and safeguards; we do not claim Data Privacy Framework certification. International Client processing cannot begin under a placeholder transfer annex. The DPA describes the gating conditions.

9. Google Calendar and Google user data

Shootandflow offers an optional two-way Google Calendar connection for a studio manager who chooses to connect their own Google Account. Bookings themselves stay native to Shootandflow. The connection is not required to create an account, manage a studio, or take bookings.

Limited Use. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. We use Google Calendar data only to provide or improve the user-facing calendar-sync features described in this section and shown in the studio dashboard. We do not sell Google user data. We do not transfer or use it for advertising, retargeting, personalized or interest-based ads, credit or lending decisions, or any other purpose not disclosed here. We do not use Google user data, or data derived from it, to create, train, or improve a machine learning or artificial intelligence model, including a general-purpose or shared model.

What we access, and why. After the studio manager signs in to Shootandflow and explicitly connects Google Calendar from the studio dashboard, Shootandflow requests only the Calendar scopes needed for this feature:

• https://www.googleapis.com/auth/calendar.freebusy (fallback: https://www.googleapis.com/auth/calendar.events.freebusy), to read free/busy (available or busy) time ranges on the manager's own Google Calendar. We use those busy ranges to hide corresponding booking slots in Shootandflow so clients cannot book over times that are already busy on the connected calendar. This access is limited to whether a time range is free or busy. It is not used to display or store the titles, descriptions, attendees, or other details of events that Shootandflow did not create.
• https://www.googleapis.com/auth/calendar.events, to create, update, and cancel calendar events that represent confirmed, rescheduled, or cancelled Shootandflow bookings on the manager's connected calendar, so those bookings also appear on Google Calendar. We use this write access only for events that Shootandflow creates or has already created as booking mirrors. We do not edit, delete, or reschedule the manager's other Google Calendar events.

If, before verification, the product is limited to calendars the manager owns, we may instead request the narrower calendar.events.owned scope for the write path. That product decision should be locked before any verification form is submitted.

We request these scopes in context, from the studio dashboard, only when the manager chooses to connect Google Calendar. We do not request Calendar access as part of ordinary Shootandflow sign-in.

What we store. We store:

• OAuth access and refresh tokens for the connected Google Account, encrypted at rest, plus the Google Account identifier or email needed to keep the connection, the connected calendar identifier, and the IDs of Shootandflow-created mirror events so we can update or cancel them later;
• short-lived free/busy time ranges used to hide booking slots, refreshed as needed and not kept as a permanent copy of the manager's personal calendar;
• the booking records themselves, which remain Shootandflow records (session type, date and time, client and studio details already stored for the booking).

We do not store the titles, descriptions, attendees, conference links, or attachments of events that we did not create. We do not store the manager's full Google Calendar in Shootandflow.

How it is protected. Tokens and other Google credentials are encrypted at rest and transmitted only over HTTPS. Access is limited to the systems that perform calendar sync. Google user data is not placed in advertising tools, data-broker systems, or AI training pipelines.

Retention and deletion. Encrypted OAuth tokens, connection metadata, cached free/busy ranges, and stored mirror-event IDs are kept only while the Google Calendar connection is active and needed to provide the feature. When the manager disconnects Google Calendar, or when the studio account is deleted under the retention schedule in this policy, we delete the stored tokens, connection metadata, and cached free/busy data, and we stop reading or writing the Google Calendar. At disconnect, the manager can choose whether Shootandflow also removes the booking-mirror events it created on Google Calendar, or leaves those events in place on Google Calendar. Shootandflow booking records remain subject to the ordinary account and booking retention rules in this policy and are not deleted merely because the calendar connection is turned off, unless the studio account itself is deleted.

How to revoke access. A studio manager can disconnect Google Calendar at any time from the Shootandflow studio dashboard, which revokes Shootandflow's stored authorization and deletes the stored tokens as described above. The manager can also revoke Shootandflow's access in their Google Account under Google Account permissions. Revoking access in Google Account settings will cause later sync attempts to fail; the manager should also disconnect in Shootandflow so stored tokens are deleted promptly. Questions or privacy requests about this feature can be sent to support@shootandflow.co with the subject "Privacy request" or "Google Calendar connection."

No human review of calendar data, except as the policy allows. Shootandflow staff, contractors, and agents are not permitted to read a manager's Google Calendar data or free/busy ranges, except: (1) if the manager gives documented, affirmative agreement for us to view specific data in order to provide requested support; (2) when necessary for security purposes, such as investigating a bug or abuse; (3) when necessary to comply with applicable law; or (4) when the data, including derivations, is aggregated and anonymized and used only for internal operations in accordance with applicable law. Support staff do not need, and should not be given, routine access to OAuth tokens or free/busy caches.

No selling, ads, or AI/ML training. We do not sell Google user data or share it for cross-context behavioral advertising or targeted advertising. We do not use Google Calendar data, tokens, free/busy ranges, or data derived from them to serve ads or to create, train, or improve machine learning or artificial intelligence models.

If we later want to use Google user data in a new way, we will update this policy, notify affected users, and obtain any required consent before that new use begins.

10. Cookies, updates, and contact

The Cookie Policy explains necessary sessions, security, preferences, and any optional tracking. Before materially different data uses, we provide notice and obtain consent when required; revised language alone cannot retroactively authorize them. We post the new date and give at least 30 days' notice for a material policy change where feasible, except urgent legal/security updates with appropriate notice.

Shootandflow — [LEGAL ENTITY NAME], Oregon — support@shootandflow.co — [LLC BUSINESS MAILING ADDRESS].