Privacy Policy for Photographers

1. Information We Collect

When you register as a photographer, we collect:

1.1 Account Information

When you create an account or use our services, you provide us with personal information that includes:

• Full name and business name
• Email address
• Phone number
• Password (stored using Argon2id encryption)
• Billing address and payment information

1.2 SmugMug Integration Data

To provide our services, we securely store:

• SmugMug OAuth tokens (encrypted using AES-256-GCM)
• SmugMug account identifiers
• Gallery structure and album information

1.3 Student and School Data You Upload

When you import student rosters and school information, this data is stored in our system to facilitate gallery creation and photo organization. This includes:

• Student names
• Grade and teacher assignments
• School and district information
• Unique Gallery IDs

1.4 Usage Information

We automatically collect:

• Log data (IP address, browser type, access times)
• Feature usage and interaction data
• Error reports and diagnostic information

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our platform
• Process your subscription payments through Stripe
• Create and manage SmugMug gallery structures on your behalf
• Generate QR codes and Gallery IDs for student identification
• Send transactional emails (account verification, password resets, subscription notices)
• Provide customer support
• Send product updates and marketing communications (with your consent)

3. Data Security

We implement industry-standard security measures to protect your information:

• All data transmitted over HTTPS/TLS encryption
• Passwords hashed using Argon2id algorithm
• SmugMug API credentials encrypted with AES-256-GCM
• Secure session management with automatic timeouts
• Regular security audits and updates

4. Data Sharing

We do not sell your personal information. We may share data with:

• Service Providers: Stripe (payment processing), AWS (cloud infrastructure), SmugMug (gallery hosting), Sendy/AWS SES (email delivery)
• Legal Requirements: When required by law, court order, or governmental authority
• Business Transfers: In connection with a merger, acquisition, or sale of assets

5. Data Retention

• Account data is retained while your subscription is active
• Student roster data is retained for the duration you specify or until you delete it
• Upon account cancellation, your data is deleted within 90 days unless legally required to retain it

6. Your Rights

You have the right to:

• Access and download your data
• Correct inaccurate information
• Delete your account and associated data
• Opt out of marketing communications
• Export student data you have uploaded

To exercise these rights, contact us at [email protected].

7. Third-Party Services

Our platform integrates with third-party services governed by their own privacy policies:

• SmugMug: https://www.smugmug.com/about/privacy
• Stripe: https://stripe.com/privacy

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the platform.