Privacy notice

1. Who is responsible

The identified service operator is normally controller for photographer-account information, service enquiries, support correspondence, operator billing, agreement records and service security. Contact the operator using the details above about that processing.

A photographer will normally be controller for their client records, galleries, invoices, notes and other business content. GlassSuite normally hosts and handles that content as processor on the photographer’s documented instructions. A studio-listing owner is responsible for the information they publish and for their separate hire business. The actual processing determines the role.

If your request concerns a shoot, a photograph, an invoice, a gallery licence or a photographer’s retained records, contact that photographer first. The operator can help direct the request and assist the photographer where appropriate; it does not silently replace them as decision-maker.

2. Information the service handles

Account and contact information may include a name, business name, sign-in email, verified contact addresses, account identifiers, role, plan, allowance and account status. Public interest enquiries contain the details supplied on the enquiry form; submitting an enquiry does not create a login account.

The Contact form stores your name, email, subject and message for the operator to respond, alongside spam-control and message-status records. A notification can be emailed to the operator without the message body; authorised administrators read the message in the platform inbox. Invitation records contain the invitee address, purpose, inviter and timestamps. Invitation setup uses a new inbox code rather than an emailed password. Internal inbox notes are not replies to the sender.

Photographer-supplied content can include original files and viewing versions in local storage or a configured private OVH S3-compatible bucket, photographs and embedded file metadata, client contact details, notes, dates and locations, job-specific terms and acceptance evidence, questionnaire questions and responses, supplier-upload invitations or professional documents, invoices, manual payment records, expense and mileage records, assets details and studio-listing information. Do not upload personal or sensitive information you do not need or are not entitled to process.

Service information includes essential cookies and opaque session identifiers, records of the terms version and document accepted and when, email verification or recovery requests, email-delivery status, support correspondence and administrator audit. Credentials and provider secrets require restricted handling; they are not public profile information.

Technical and security information may include request and diagnostic logs, connection or device information available to the service, failed actions, software version and security or rate-limit events. Transfer and network history is designed to store aggregate counts and measurements rather than private filenames, original links or raw session tokens. This does not mean that the whole server or every configured supplier has no logs.

3. Why information is used

We use account information to provide the requested account service, authenticate access, apply the displayed plan and permissions, provide recovery and service communications, and maintain the agreement. The usual legal basis for the operator’s own necessary account processing is performance of a contract or steps you request before entering one.

We use appropriate limited information to protect the service, investigate faults and misuse, support users and keep attributable administration and agreement records. Where legitimate interests is the basis, the operator must consider necessity and the effect on individuals rather than treat every possible use as justified.

We may keep or disclose information where necessary to meet a legal obligation, respond to a lawful request or establish, exercise or defend a legal claim. Photographers determine and document their own lawful bases for client content. Accepting service terms does not manufacture consent from everyone pictured or change the photographer’s responsibilities.

Optional processing that requires consent must be explained separately and use a genuine choice. This version’s cookie controls do not introduce analytics or advertising trackers. A terms checkbox is not consent to marketing or permission to train a general-purpose AI model using private photographs.

4. Sharing and people who can access information

Content is shared with the people authorised by the photographer’s settings and client access. Published private galleries, permitted downloads, invoices and explicitly shared professional documents may be accessible through the client portal. Internal working notes and another studio’s data are not intended for that portal.

An owner may choose to publish studio-listing contact and booking information to prospective hirers. Check the publication screen before sharing. Recipients may keep a legitimately downloaded copy under their own obligations; revoking an app link cannot erase copies already held elsewhere.

Authorised operator personnel may access information as reasonably needed for support, security, administration or a legal obligation. Administrator support access is attributable and restricted; a support view is not a licence to publish the photographer’s files.

The deployment may use hosting and storage providers, transactional-email transport, a configured payment provider, optional postcode or route services, and other necessary security or delivery suppliers. Which suppliers are active depends on the actual operator setup. Before live use, ask the operator for its current supplier, processing-location and transfer information; this notice does not invent a fixed data-centre country or imply that an unconfigured provider has been used.

Optional postcode checks send the two submitted UK postcodes to postcodes.io after the acknowledgement shown by the tool. When road estimates are enabled, their postcode-centre coordinates are sent to the configured Geoapify, Openrouteservice or trusted OSRM service. GlassSuite retains the distance, estimated time, postcodes and source as a private journey reference. Names, photographs, invoices and sign-in credentials are not included in that routing request. Limited account and request identifiers are retained to control shared Geoapify usage and prevent duplicate lookups.

Billing or email integration may involve a separate supplier’s privacy information. We may also disclose information when a lawful obligation requires it or as part of a legitimate service transfer with appropriate safeguards and notice.

5. International processing

A service used worldwide may involve users or suppliers in different countries. The operator must identify actual processing locations and apply any safeguards required for restricted international transfers, rather than assume that every overseas use is automatically permitted.

Where a transfer requires an adequacy decision, appropriate contractual safeguards or another lawful mechanism, the relevant controller must establish that mechanism and give the required information. Contact the operator for the current supplier and transfer arrangements for your deployment.

6. Storage limits, retention and deletion

Account age, the end of a paid subscription period and storage overage do not start automatic account or gallery-media removal. A reduced allowance retains existing files and blocks new uploads while usage is above that allowance.

An ordinary account on any plan, including manual or complimentary access, may be permanently removed after twelve calendar months without a completed sign-in, an initial warning email queued and thirty days from that queued warning to return. A final reminder is scheduled seven days before removal. Completing sign-in cancels the pending removal. Administrator accounts are excluded. Existing accounts without reliable earlier sign-in history start from a prospective tracking baseline; newer accounts without a completed sign-in use their recorded creation date. The initial queued warning starts the full thirty-day return period. Failed, suppressed or unread email does not stop the clock or postpone removal. Unresolved safe-removal holds may defer physical erasure. This is full live-account removal, including stored files and business records, so export records you need.

Photographers can schedule gallery expiry with permanent file deletion and expiry reminders. No-download permissions, passwords and link revocation remain effective while the gallery is available. Removal is deferred during active transfers, incomplete provider deletion or recovery holds; failed or suppressed warning emails do not constitute received delivery.

Retention depends on the purpose, instructions, account state and applicable legal requirements. Not every record has the same retention period. Photographers are responsible for their own tax and business-record duties and should export copies they need before ending access.

A photographer’s explicit gallery deletion may move a gallery into the recoverable Bin before its displayed permanent-removal period. Binned files count toward storage until physical removal. Separate reviewed file or account purge actions remove only their stated scope.

Recoverable account deletion disables access while retaining records until a separately reviewed purge or qualifying inactivity removal. It does not start an automatic seven-day account-removal timer. A separately confirmed permanent purge removes the stated live account data. Limited operator records may still need restricted retention for legal, security or agreement-evidence purposes where a lawful basis applies. This is not a promise to keep every private photograph indefinitely.

Independent backups and already-delivered emails are separate from the live gallery. Where backup erasure is not immediately possible, affected data must be put beyond ordinary use until the relevant backup replacement or deletion process. A backup restore must not make revoked access or erased content available again contrary to an applicable instruction. Contact the operator for the actual deployment’s retention and backup schedule.

Verification challenges, email records, telemetry and audit have different purposes and may have different controls. Their actual retention is a matter for the configured service and operator policy. We do not claim that all security logs disappear after one invented universal period.

7. Your rights and privacy requests

Depending on the applicable law and the circumstances, you may have rights to access information, receive certain information in a portable form, correct inaccurate information, request erasure or restriction, object to certain processing and withdraw consent where consent is the basis. Those rights have legal conditions and exceptions; erasure is not an automatic instruction to falsify a paid invoice or delete a legally required record.

Contact the controller responsible for the information and explain the request. We may need proportionate information to verify your identity. A private gallery link is not by itself authority to obtain another person’s entire account. We will deal with requests within the applicable legal timescales and explain a lawful refusal or extension.

For processing within the UK supervisory system you can raise a concern with the Information Commissioner’s Office at ico.org.uk. You may also have the right to complain to the relevant authority in your country. Contacting the operator first can help resolve a practical issue, but does not remove your right to complain.

Sign-in protection

GlassSuite keeps sign-in outcomes, browser family, a masked network address, approximate country when available, and keyed device/source identifiers. It does not store raw passwords, security codes or session bearer tokens in this security history. History is retained for up to 90 days, capped at 1,000 events per account; active session controls remain governed by their own expiry and revocation.

If local location data is configured, a trusted ingress address can be checked against a local MaxMind database. GlassSuite does not send the address to an external location lookup. Approximate location may be wrong, especially with VPNs or mobile networks; it can require extra verification but does not automatically ban a country or account.

When configured, Cloudflare Turnstile is loaded only after repeated failed password attempts. Cloudflare processes the challenge and browser/network information; GlassSuite sends the temporary challenge response to its validation service. The challenge token is not retained in the security history.

New or changed passwords are checked by default against Have I Been Pwned Pwned Passwords. The server sends only the first five characters of a SHA-1 password hash, then compares the returned suffixes locally. The full password and full hash are not sent to that service. An operator may disable the online check for an offline deployment; local password rules still apply.

8. Cookies, security and children

Read the Cookie information page for the current essential sign-in, private-access and cookie-choice cookies. Remember me affects persistence of the access cookie and does not prevent server-side expiry or revocation. Blocking essential authentication cookies can stop sign-in or private access from working.

We apply appropriate security measures and access controls, but no service can guarantee absolute security. Keep your login and private links secure, use trusted devices and report suspected misuse promptly. Keep independent copies of important originals and records.

Photographer accounts are intended for adults able to enter a service agreement. A parent or guardian should manage access for a child who cannot contract for themselves. A photographer uploading children’s images or sensitive content must consider the additional safeguards and lawful basis that apply.

9. Changes to this notice

We may update this notice to reflect an actual processing or legal change and will give further notice where required. Its version and date are shown here. Material changes to the service agreement are handled through the separate versioned terms process; a privacy notice is an explanation of processing, not a blanket consent form.