Privacy policy

StudioStack Ltd is registered in England and Wales, company number 16881728. Registered office: 7 Norman Street, York, England, YO10 3LH. Contact: hello@studiostack.co.uk.

1. Information We Collect

We collect several types of information to provide and improve the Service.

1.1 Information You Provide Directly

Account Information:

Full name and email address
Password (stored as a one-way hash)
Organisation/business name
Phone number (optional)
Professional details (photography specialties, business type)

Client Data You Upload:

Client names and contact information
Client email addresses and phone numbers
Additional contact persons (billing, delivery contacts)
Job details (dates, times, locations, descriptions, pricing)
Communication preferences and notification settings

Content You Upload:

Photographs and images
Gallery titles and descriptions
Watermark templates and branding assets
Invoice information (line items, prices, tax amounts)
Purchase order numbers and financial references

1.2 Information Collected Automatically

Usage Data:

Pages and features you access
Time and date of access
Actions you take (creating galleries, sending invoices)
Browser type, version, and language settings
Device type and operating system

Technical Data:

IP address and geographic location (country/region)
Session identifiers and authentication tokens
API request logs and performance metrics
Error logs and crash reports

1.3 Information from Third Parties

Payment information from payment processors (Stripe)
Email delivery status from email providers (Resend)
Infrastructure performance data from hosting providers
Basic profile information from SSO providers (Google, if enabled)

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 To Provide the Service

Create and manage your account
Authenticate your identity and secure your account
Enable you to create and manage clients, jobs, galleries, and invoices
Process and store photographs and content you upload
Generate thumbnails and apply watermarks to images
Create and deliver galleries to your clients
Generate invoice PDFs and send them to clients
Send automated email notifications
Provide the Client Portal for your clients

2.2 To Improve and Develop the Service

Analyze usage patterns to understand feature usage
Identify and fix bugs, errors, and performance issues
Test new features and improvements
Monitor system performance and reliability
Optimize infrastructure and reduce costs

2.3 To Communicate With You

Send account notifications (password resets, security alerts)
Respond to support requests and inquiries
Send updates about Service changes and new features
Notify you of Terms or Privacy Policy changes
Request feedback about the Service

2.4 To Ensure Security and Prevent Fraud

Detect and prevent unauthorized access
Identify and investigate suspicious activity
Enforce our Terms of Service
Protect against spam and malicious use
Maintain audit logs for security purposes

2.5 Legal and Compliance

Comply with applicable laws and regulations
Respond to legal processes and law enforcement requests
Establish, exercise, or defend legal claims
Maintain financial records for applicable accounting and legal requirements

3. Legal Basis for Processing (UK GDPR)

Under UK GDPR, we must have a lawful basis for processing your personal data:

Contract Performance:

We process your account data to perform our contract with you under the Terms of Service.

Legitimate Interests:

We process data based on our legitimate interests in:

Improving the Service and developing new features
Ensuring security and preventing fraud
Operational monitoring to maintain reliability; optional usage analytics relies on consent

Legal Obligation:

We process certain data to comply with legal obligations (tax records, legal requests).

Consent:

For certain activities, we obtain your explicit consent (marketing, cookies where required).

4. Your Role as Data Controller

Important: Controller vs Processor Roles

When you upload information about your clients to StudioStack, you are the Data Controller and we are the Data Processor. This distinction is critical under UK GDPR.

4.1 Your Responsibilities as Controller

You are responsible for:

Having a lawful basis under UK GDPR to collect and process your clients' personal data
Obtaining consent where required or establishing another appropriate lawful basis before uploading client data
Providing your clients with appropriate privacy notices
Responding to data subject access requests from your clients
Ensuring the accuracy and relevance of data you upload
Complying with data protection principles (lawfulness, fairness, transparency, accuracy, storage limitation)

4.2 Our Role as Processor

We process your client data only according to your instructions (through your use of the Service features), as necessary to provide the Service, and subject to appropriate technical and organisational security measures.

4.3 Client Rights

Your clients have rights under UK GDPR (access, rectification, erasure, restriction, portability, objection). You are responsible for handling these requests from your clients. We provide tools to help you manage client data, but the obligation to respond rests with you as the Data Controller.

5. How We Share Your Information

We do not sell your personal information. We share your information only in the following limited circumstances:

5.1 Service Providers (Sub-Processors)

We use trusted third-party service providers to help operate the Service:

Hosting and Infrastructure:

Vercel (Netherlands/US) - Frontend hosting
Render (Frankfurt, EU) - Backend API and worker hosting
Cloudflare (Global) - CDN, storage (R2), DDoS protection
Neon (Frankfurt, EU) - PostgreSQL database hosting

Communication Services:

Resend (US) - Transactional email delivery
Render (Frankfurt, EU) - Redis queue management

Payment Processing:

Stripe (US/EU) - Payment processing (when enabled)

All sub-processors are selected based on their security standards and data protection commitments. We have contracts requiring them to process data only according to our instructions and comply with UK GDPR.

5.2 Legal Requirements

We may disclose your information if required by law or in response to:

Valid legal processes (subpoenas, court orders)
Government or regulatory requests
To protect our rights or detect fraud

5.3 Business Transfers

If StudioStack is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change.

6. International Data Transfers

StudioStack operates globally, which means your data may be transferred to, stored in, and accessed from countries outside the United Kingdom.

6.1 Safeguards for International Transfers

When we transfer data outside the UK, we ensure appropriate safeguards:

Adequacy Decisions: We transfer data to countries the UK Government has deemed to provide adequate data protection
Standard Contractual Clauses: For other countries, we use UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses with the UK Addendum
Additional Safeguards: We implement supplementary security measures where necessary

6.2 Primary Data Locations

Your data is primarily stored in: UK/EU (database servers), United States (hosting infrastructure), and Global (Cloudflare CDN).

7. Data Security

We implement industry-standard security measures to protect your data from unauthorized access, alteration, disclosure, or destruction.

7.1 Technical Security Measures

Encryption:

Data in transit encrypted using TLS/SSL (HTTPS)
Passwords protected using one-way hashing
Sensitive data at rest encrypted where feasible

Access Controls:

Role-based access control within the Service
Multi-tenant isolation (your data isolated from other users)
Authentication or scoped access tokens protect private workspace and portal operations
Session management with secure cookies

Infrastructure Security:

Secure data centers with physical access controls
Network firewalls and DDoS protection
Regular security monitoring and threat detection
Automated security patches and updates

7.2 Operational Security

Database recovery facilities provided by our hosting provider; keep independent copies of photographs
Disaster recovery procedures
Limited employee access to production data
Security incident response plan

7.3 Your Security Responsibilities

Choose a strong, unique password
Keep your password confidential
Secure your devices and internet connections
Log out of shared devices
Report suspicious activity

7.4 Security Limitations

No system is completely secure. Despite our efforts, we cannot guarantee absolute security. Internet transmission is inherently insecure, and software may have undiscovered vulnerabilities. You acknowledge and accept these inherent security risks.

Connected services and client documents

Client records may include enquiries, form responses, quotes, briefs, contracts, acceptance or signature records and related audit information. We use this information to provide the workflows requested by the photographer. Billing and delivery contacts receive the communications enabled for them. Named-client verification protects changes to portal preferences; additional contacts can unsubscribe from applicable notifications.

When a client connects Google Drive, we store the connection credentials and selected folder identifiers needed to deliver gallery files and, if selected, invoice PDFs. Google receives those files under the client’s instructions. Disconnecting stops future transfers; copies already delivered remain in their Drive. Google also receives account information when Google sign-in is used.

Stripe handles card details and payment processing. StudioStack receives payment status, references, authorisation records and limited payment-method information, such as card brand and last digits, rather than full card numbers. Stripe may act as an independent controller for its own payment, fraud-prevention and legal purposes.

Google Analytics 4 and PostHog receive the consented measurement data described in section 10. PostHog is configured for EU hosting. EU hosting does not exclude international support or processing by providers. Contact us for information about applicable transfer safeguards.

Account and service records are kept while needed to operate the account, resolve disputes and meet legal obligations. Optional measurement identifiers and our pending analytics delivery queue have a 180-day lifetime; this is not a promise that historical reports at analytics providers are deleted at 180 days. Withdrawing consent stops future optional collection and does not automatically erase previously collected data. Contact us to request erasure.

8. Data retention

Full access ends when a trial expires, at the end of a cancelled paid period, or after a seven-day failed-payment grace period. The workspace becomes read-only, with billing, downloads and exports of retained data still accessible. New uploads, jobs and automated invoice creation are paused.

Already published client galleries remain available for 30 days after full access ends. Client photo access and Google Drive sync then pause. Photos, previews and generated download archives become eligible for deletion 90 days after full access ends. We notify the photographer at expiry and before deletion, with 14-day and three-day warnings. Delayed notices or an administrative hold may extend retention; photographs are not deleted earlier.

Resubscribing before deletion restores access and cancels pending deletion. Deleted photographs cannot be recovered. Copies already delivered to a client’s Google Drive are not removed. Existing invoices remain payable and payment reconciliation continues.

Financial records are separate from photo retention and may be retained for accounting, legal obligations or disputes. Account-erasure requests are handled separately under our Privacy Policy. Export the data you need before deletion and keep your own original photographs.

9. Your Privacy Rights

Under UK GDPR and data protection laws, you have the following rights regarding your personal data:

9.1 Right of Access

Request confirmation of whether we process your personal data and receive a copy of your data. Contact us at hello@studiostack.co.uk. We normally respond within one calendar month.

9.2 Right to Rectification

Correct inaccurate personal data. You can update most information directly in your account settings.

9.3 Right to Erasure

Request deletion of your personal data when it's no longer necessary, you withdraw consent, or you object to processing. Close your account through settings or contact us. Some financial records may need to be retained to meet applicable legal obligations.

9.4 Right to Restriction

Request we restrict processing when you contest data accuracy, processing is unlawful, or you've objected to processing.

9.5 Right to Data Portability

Receive your data in a structured, machine-readable format. Use available export tools or contact us for help with your request.

9.6 Right to Object

Object to processing based on legitimate interests or direct marketing. We will stop processing unless we have compelling legitimate grounds.

9.7 Right to Withdraw Consent

Where processing is based on consent, withdraw consent at any time through account settings or by contacting us.

9.8 Right to Lodge a Complaint

Lodge a complaint with the Information Commissioner's Office (ICO) if you believe we've violated data protection laws. Visit ico.org.uk or call 0303 123 1113.

9.9 Exercising Your Rights

To exercise any rights, email hello@studiostack.co.uk with your request and sufficient information to verify your identity. We will respond within one calendar month at no charge (unless requests are manifestly unfounded or excessive).

10. Cookies and Tracking Technologies

StudioStack uses essential storage to provide the Service. With your analytics consent, Google Analytics 4 measures public marketing visits, trial starts and the first paid subscription using your existing Analytics browser identifier, event time and an opaque event reference. Paid events include the payment amount and currency. PostHog (EU hosting) measures signup, product use and subscription events using opaque identifiers. Subscription payment events include the amount paid, currency and payment time, including renewals, to measure customer revenue. We exclude client content and private document links. Automatic form capture and session recording are disabled. Optional analytics starts only after consent. With a separate advertising choice, Google Ads associates ad clicks with completed first trial workspaces using click identifiers and an opaque conversion reference. When analytics is also accepted, we can import the first paid subscription from Google Analytics into Google Ads for advertising attribution. Google also receives standard network information. We do not send signup form fields or enable Google enhanced conversions or Google personalised advertising. With advertising consent, Meta Pixel and the Conversions API measure marketing visits, trial starts and the first paid StudioStack subscription, and support Meta remarketing and audience creation. Meta receives browser/network information, advertising identifiers, event timestamps and an opaque conversion reference; paid-subscription events also include the amount and currency. We do not send email addresses, client data, gallery content or private portal links. We disable automatic event detection and advanced matching. Meta may process data internationally under its privacy policy and applicable transfer safeguards. We recheck consent before server delivery and remove stored advertising identifiers when consent is withdrawn or expires. See our cookie policy for storage and withdrawal details.

10.1 Types of Cookies We Use

Essential Cookies (Strictly Necessary):

Session authentication cookies (required to log in)
Security cookies (CSRF protection)
Load balancing cookies

These cookies are necessary for the Service to function and cannot be disabled.

Functional Cookies:

User preference cookies (remember settings)
Feature usage cookies

Analytics Cookies:

Usage analytics (understand how Service is used)
Performance monitoring (identify errors)

10.2 Managing Cookies

Use Cookie settings to accept, reject or withdraw optional analytics choices. You can also control cookies through your browser settings. However, blocking essential cookies will prevent you from using the Service.

11. Children’s information

Studio accounts are intended for adults using the service for business. Photographers may upload family, school or other photographs and records that include children. We process that content on the photographer’s instructions. The photographer must establish an appropriate lawful basis, provide relevant privacy information and obtain any permissions required. Contact the photographer about those records, or contact us if you need help identifying the responsible studio.

12. Protecting your files

Keep independent copies of original photographs and export the records you need. StudioStack provides gallery delivery and retained-file downloads; it is not a substitute for your own backup system.

We use access controls to protect client portals and workspace data. Contact hello@studiostack.co.uk to report a suspected security incident or ask about your data.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Service, legal requirements, or our business practices.

Material Changes:

We will email you at least 30 days before material changes take effect
We may display a prominent notice in the Service
We will update the "Last updated" date at the top

Continued use of the Service after changes constitutes acceptance of the updated Privacy Policy. If you don't agree to changes, you must stop using the Service and close your account.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:

Email: hello@studiostack.co.uk

Response Time: We aim to respond to all privacy inquiries within 5 business days , and within one calendar month for formal data subject rights requests. Where a lawful extension is necessary, we will explain it within that first month.

15. Summary of Key Points

For quick reference:

✅ What we collect: Account details, client data you upload, photographs, usage data
✅ How we use it: Provide the Service, improve features, communicate, ensure security
✅ Your role: You're the Data Controller for your client data; we're the Data Processor
✅ Data security: Encryption, access controls, backups, monitoring
✅ Data sharing: Only with trusted sub-processors, never sold
✅ Your rights: Access, rectification, erasure, restriction, portability, objection
✅ Data retention: Photographs become eligible for deletion after the expiry period in section 8; other records follow their purpose and legal requirements
✅ Backups: Maintain your own backups; retain independent copies of original photographs
✅ Contact: hello@studiostack.co.uk for all privacy inquiries

You can contact us about this notice or exercise your privacy rights without agreeing to optional analytics.