Privacy Policy

1. Two kinds of information

Studios' own information: the details of the photographers and staff who use Flashslash (names, emails, sign-in and billing details). For this, Flashslash Labs LLC is responsible (the "controller").

Clients' information: the details studios keep about their clients and website visitors (names, contact details, sessions, messages, forms, contracts, gallery visits). For this, each studio is responsible and Flashslash handles it on the studio's behalf (the "processor"), under the Data Processing Agreement. If you're a studio's client, contact the studio first about your information; we'll help them respond. Each studio's website has its own privacy notice (at /privacy on the studio's site) explaining this.

2. What we collect about studios

Account details: name, email, password (stored only as a secure hash), two-step sign-in setup, studio name and settings.

Billing: your plan and payment status. Card details are handled by Stripe; we never see or store full card numbers.

Activity: sign-ins, important changes in your studio (the activity log), IP addresses and browser type for security, and error reports.

What you send us: support requests and ideas.

Signing up: if you start creating an account on flashslashapp.com and don't finish, we keep the name and email you typed (never your password) so we can send you one or two reminders to finish. If you'd rather we didn't, use the unsubscribe link in the reminder, or email hello@flashslashapp.com.

Flashslash updates: if you ask for Flashslash news and offers (the form at the bottom of flashslashapp.com), we keep your email to send them. Unsubscribe any time from the link in any of those emails.

3. How we use it

To run your studio and provide the service you signed up for; to bill you; to keep accounts and data secure and prevent abuse; to support you; to tell you about your account, billing, and important changes to Flashslash; to send you news and occasional offers from Flashslash if you're a customer (now or before), a beta tester, or you asked for them; and to improve Flashslash. You can stop news and offers any time with the unsubscribe link in those emails; emails your account needs (like receipts and sign-in codes) still come. We don't sell personal information, don't share it for advertising, and don't use tracking or advertising cookies on Flashslash's own pages. (A studio can choose to add its own ad and analytics tags to its website; see section 4.)

4. Cookies

Flashslash itself only uses cookies needed for it to work: keeping you signed in, remembering a client's access to a gallery or portal, and a few preferences (like light or dark mode). Flashslash adds no advertising or analytics cookies of its own.

A studio can choose to add a Meta Pixel or Google Analytics to its own website (never to galleries, client portals, forms or the admin). When it does, the website asks each visitor first, and those tags only load for visitors who allow them; visitors can change their choice from the studio's privacy notice. Meta and Google then receive the visitor's IP address, the pages visited, and when they send an inquiry or book. The studio decides to use these tools and is responsible for that use under Meta's and Google's terms; its privacy notice says so.

Studio websites count their visits without cookies and without storing anyone's IP address. Each visit is counted with a code made from the visitor's IP address and browser, scrambled with a random key that is replaced every day, so a visitor can't be recognized from one day to the next or across studios, even by us. These counts (page, date, and the site a visitor came from) are kept for 13 months and only shown to the studio as totals.

Fonts on studio websites, portals, galleries and forms are served by Flashslash itself. A studio's map loads only when a visitor asks to see it.

Links in Flashslash's news and offer emails go through Flashslash first, so we can count how many people clicked. We don't use tracking pixels to see whether you opened an email.

5. Who helps us

We use the services below to run Flashslash. They only get what they need for their part, and are bound to protect it:

Vercel Inc.: Hosting and running the app (United States).

Neon Inc.: Database (United States (AWS, us-east-2)).

Cloudflare, Inc.: Photo and file storage (R2), video streaming for gallery videos (Stream), DNS, bot protection (Turnstile) (United States, with global delivery).

Backblaze, Inc.: A backup copy of gallery originals (photos, RAW files and videos), kept at a different company from the main storage in case of loss (United States).

Stripe, Inc.: Flashslash subscription billing; studios' client payments through their own Stripe accounts (United States).

Resend (Plus Five Five, Inc.): Sending email and reporting delivery (United States).

Functional Software, Inc. (Sentry): Error reports (with secret links masked) (United States).

OpenStreetMap Foundation: Map images on studio websites, loaded only when a visitor chooses to show the map (their browser shares its IP address); place search, sent from Flashslash's servers with only the words typed (United Kingdom / European Union).

Unsplash Inc.: Sample photos on a new studio's website until the studio adds its own, loaded by the visitor's browser (which shares its IP address) (Canada / United States).

Anthropic, PBC: Flashslash Assist (Claude), only when a studio uses it: drafting replies to inquiries, website and email text, blog posts, and photo descriptions. Only what's needed for the draft is sent, and Anthropic doesn't train its models on it (United States).

Google LLC: Google Calendar sync, only for studios that connect a calendar (session times, client names and contact details go on the studio's calendar); web fonts in some email designs, loaded by the reader's email app (United States).

We may also share information if the law requires it, to protect people's safety or our rights, or as part of a sale or reorganization of our business (and would tell you).

6. Google user data

If you connect Google Calendar, Flashslash reads your calendar's busy times so booked times aren't offered to clients, and adds your sessions to your calendar. We use this data only to provide that feature. We don't sell it, use it for advertising, or let people read it except with your permission, for security, or as the law requires.

We don't use data from Google APIs to develop, improve or train generalized AI or machine-learning models, and we don't send it to AI services.

Flashslash's use and transfer of information received from Google APIs follows the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

7. Where it's stored

Flashslash's data is stored and processed in the United States. If you're outside the United States, your information is transferred there; where the law requires it, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

8. How long we keep it

Studio data is kept while the studio's account is open, and studios can delete records themselves any time. When a studio is deleted, its records are removed 30 days after the request, and its photos 30 days after that. We keep only billing records the law requires, the notices we emailed about the deletion (24 months), and proof that the owner accepted these terms (which version, and when).

Some records are trimmed automatically while a studio is open: copies of sent emails keep their text for 24 months (after that, only the subject and date), and links inside them for 30 days; gallery activity (visits, favorites, downloads) is kept 24 months; website visit counts 13 months; IP addresses and browser details in activity logs 12 months; support-session records 12 months; our own emails to studio owners 24 months. Studios can also choose to have old inquiries deleted automatically.

Database backups hold deleted data until they roll off, within 30 days. Gallery photos, RAW files and videos are also copied to a backup store at a separate company, in case of loss. Anything a studio deletes goes to its trash for 30 days, where the studio can restore it; it is then deleted for good, along with its streaming copy and its backup copy. Videos are also kept as a streaming copy (at Cloudflare) for as long as the original is. A deleted studio's photos and their backup copies are kept, unreachable, for 30 days and then deleted. Records of incoming webhooks are kept for up to 90 days, sign-in attempt counters for a day, and expired sign-in sessions are removed.

Someone who started signing up and didn't finish: their name and email are deleted 12 months later if they never come back. People who unsubscribe stay on our "don't email" list so we keep honoring it.

9. Security

Each studio's data is kept separate from every other studio's in the app and in the database. Connections are encrypted, passwords are hashed, two-step sign-in is available, access by our staff is limited, logged and time-limited, and secret links (portals, galleries, forms) are masked in error reports. No system is perfectly secure; if a breach affects your information, we'll tell you without undue delay.

To report a security issue, email security@flashslashapp.com.

10. Your rights

Depending on where you live (for example under the GDPR in Europe or the CCPA in California), you may have the right to access, correct, download, or delete your personal information, to object to or restrict some uses of it, and to complain to a data protection authority. Studios can download and delete their data themselves from Your data. For anything else, email privacy@flashslashapp.com and we'll respond within the time the law requires. We won't treat you differently for using these rights.

11. Children

Flashslash is for businesses and isn't meant for children. Studios may keep information about clients of any age (for example family sessions) as part of their own records, as controllers of that information.

12. Changes and contact

We'll post changes here and tell studio owners about important ones. Privacy questions or requests: privacy@flashslashapp.com, or Flashslash Labs LLC, Texas, United States.