1. Information We Collect
Account Information
When you create an account we collect your name, email address, business name and username, and a password (stored only as a salted bcrypt hash) or your Google account identifier if you sign in with Google. You may also add a phone number, address, social links, a profile picture, a studio logo and favicon, and billing name and address details.
Content You Upload
We store the photos and videos you upload (originals and the smaller web versions we generate), your galleries, categories and settings, and any watermark image you provide. We also read technical metadata embedded in your photos (EXIF), such as capture date, camera and lens model, exposure settings and the owner/artist name if your camera records one, and show or store it with the photo.
Client & Visitor Data
When your clients open a gallery they may be asked for a gallery password. If you require registration, we collect their email address, optionally their name and phone number, and a 4-digit PIN they choose. We also store what they do in the gallery: favourites, comments, approvals and downloads. Visitors who interact without registering are given a random anonymous identifier. As the photographer, you decide what is collected and are the primary controller of your clients' information; we process it on your behalf.
Payment & Billing Information
When you buy a plan or storage add-on we record the plan, amount, payment method type, Razorpay payment and subscription identifiers, promo code used, and issue an invoice. We never receive or store your full card number, CVV, UPI PIN or bank credentials; those are handled entirely by Razorpay.
Technical, Security & Usage Data
We record your IP address and browser/device description when you sign in (so you can review and revoke sessions) and in activity logs of important account events, such as sign-ins, uploads and downloads. We count gallery views in aggregate. Google Analytics collects page-view and device information on our websites (see Cookies below).
Messages You Send Us
If you contact support we store your name, email address and message, and the emails we send you (such as verification codes, receipts and reminders) are logged together with their delivery status.
2. How We Use Your Information
We do not sell or rent your personal information.
- Provide, operate and deliver your galleries, portfolio and client proofing features
- Authenticate you, keep sessions secure, and let you review or revoke signed-in devices
- Generate image previews and thumbnails, and apply your watermark to web-size downloads
- Process subscription payments, issue invoices and manage your plan, renewals and storage
- Send transactional emails and in-app notifications: verification codes, receipts, renewal, trial, grace-period and account-hold reminders, gallery activity and support replies
- Detect and prevent abuse, enforce rate limits and access controls, and keep an audit trail of account activity
- Comply with legal and accounting obligations, including applicable data-protection laws such as India's Digital Personal Data Protection Act, 2023 and, where it applies, the EU GDPR
We do not sell or rent your personal information.
4. Data Storage, Retention & Security
Where data is kept
Original photos and videos are kept in a private Cloudflare R2 bucket that is not publicly addressable; downloads use short-lived signed links. Generated previews, thumbnails and branding images are served from a public CDN bucket. Account and gallery records are stored in our PostgreSQL database, with nightly backups of database records (not of media files).
How we protect it
Traffic is encrypted with HTTPS/TLS. Passwords and login tokens are stored hashed. Database access is isolated per photographer using PostgreSQL row-level security. We apply rate limiting to sign-in and gallery access, and use signed, expiring links for downloads and video playback. Gallery passwords and PINs are short access codes, not account passwords, and are stored so that visitors can be sent a PIN reminder; do not reuse an important password for them. No system is perfectly secure, and a watermark cannot stop someone photographing their own screen.
How long we keep it
Your content is kept while your account is active. If a paid plan lapses we keep your files through a 3-day grace period and a 14-day account hold; if the account is not renewed by the end of the hold, or a 14-day free trial is not upgraded, your galleries, photos and videos are permanently deleted. When you delete your account, your content and account data are removed from storage and the database by a background job, and any auto-renewing subscription is cancelled. Some records are kept longer for legal and operational reasons: payment and invoice records for accounting and dispute purposes, a record that an account was deleted (a one-way hash and masked form of the email address, kept for about a year so we can confirm a deletion), security and activity logs (about 6 months for account activity and about a year for platform logs), email delivery logs (about 3 months), and backups, which are overwritten on a rolling basis.
6. Your Rights
Clients and visitors who want their information in a gallery changed or removed should contact the photographer who shared it, or email us and we will pass the request on. To exercise any of these rights, email privacy@kairosstudia.com. We may need to verify your identity first.
- Access: ask for a copy of the personal data we hold about you
- Correction: update your profile and billing details in your account settings, or ask us to correct anything else
- Erasure: delete your account yourself under Settings > Security, or ask us to do it
- Portability: export your gallery analytics and activity logs as CSV files from your studio, where your plan includes it, or ask us for a copy of your data
- Withdraw consent or object to processing, and raise a grievance with our Privacy Contact
Clients and visitors who want their information in a gallery changed or removed should contact the photographer who shared it, or email us and we will pass the request on. To exercise any of these rights, email privacy@kairosstudia.com. We may need to verify your identity first.
7. Children's Privacy
The Service is intended for professional photographers and adult clients. We do not knowingly collect personal information from anyone under 18. Photographers who upload photos of minors are responsible for having the consent of the child's parent or guardian.
8. Changes to This Policy
We may update this Privacy Policy to reflect changes to the Service or the law. We will notify registered photographers by email or in-app notification at least 7 days before material changes take effect. The "Last updated" date above shows the current version.
9. Contact Us
For privacy questions or data protection requests, email privacy@kairosstudia.com, or use the contact form on our Support page at kairosstudia.com/support.