Privacy policy for photography studios

BackstagePost edits photographs and films for wedding and event photographers and filmmakers. Our customers are studios, not couples. BackstagePost decides how the data in this policy is used. Questions go to hello@backstagepost.com.

This policy covers data about studios and the people who work at them. Images and footage of your clients, which we edit for you, are covered by our data processing terms, because there we act on your instructions.

When you fill in a form on this website (free trial, send a project, contact, or the short form at the bottom of a page) we receive:

• Contact details: your name (required on some forms, optional on others), email, studio name, country, and a phone number if you choose to give one.
• Project brief: the package and add-ons you pick, event type and date, the cameras and drone used, the style and music you want, your notes, and the link to your footage.
• Couple names, if you add them: the form marks this field optional and for our records only. We use it to label the project and nothing else.
• Visit details sent with the form: the page you sent it from, the page that referred you, the first page you landed on, campaign tags in the link (UTM tags) and ad click identifiers, if the link you followed had them.

When you pay for a project we keep a record of what you paid and when. Card payments go through a card payment provider such as Stripe, and your card details never reach us.

Our hosting and media providers keep basic server logs, such as IP address and browser type, to run and protect the website.

• To reply to your enquiry and set up your project. You asked us to, so we need the data to take the steps you requested before a contract.
• To edit, deliver and support your projects. We need it to do the work you have paid for or asked for under the free trial.
• To take payment and keep accounts. The law requires us to keep payment and tax records.
• To understand which pages and campaigns bring studios to us. The visit details help us spend our time where it works. This is our legitimate interest in running the business, and it only applies to the details you send with a form.
• To keep the website and our systems secure. Also a legitimate interest.

We do not sell your data, share it for advertising, or use it to build advertising profiles. If we ever want to send you marketing email, we will ask first where the law requires it, and every such email will have a way to stop them.

Raw files stay in your own Dropbox, Google Drive, WeTransfer, pCloud or Box account. We download from the link you give us only to edit your project, and only the people working on it see the files. We never show your work without your written permission and never contact your clients. More in our confidentiality promise.

We use these service providers. Each one handles data only to provide its service to us.

• Supabase: our database for enquiries and project records. Our project is hosted in the AWS us-east-1 region (North Virginia, USA).
• Cloudflare: stores and serves the images and video on this website.
• Hostinger: hosts this website.
• Email and messaging providers: we use services such as Resend (email) and Telegram (team messaging) to notify our team about new enquiries and projects.
• A card payment provider such as Stripe: takes card payments. Card details go to the provider, not to us.

Our database is in the United States. Our editing team works from Pakistan, so the people who read your brief and edit your project access it from there. If you are in the UK, the EU, Canada or Australia, this means your data leaves your country. Our team sees only what a project needs. You can ask us for more detail about these transfers and how the data is handled in each place.

• Studio and project records: while your studio keeps working with us. After that, you can ask us to delete them at any time.
• Payment records: as long as tax law requires.
• Enquiries that never became a project: deleted after 24 months, or earlier if you ask.
• Working copies of your footage and edits: deleted once the project and its revisions are finished, unless you ask us to keep them. See our data processing terms.

Wherever you are, you can email hello@backstagepost.com to ask what we hold about you, to correct it, to get a copy, or to have it deleted. We reply within 30 days. Depending on where you live, the law gives you more specific rights:

• UK and EU (UK GDPR and EU GDPR): you can ask for access, correction, deletion, a portable copy, to restrict our use, and to object to use based on our legitimate interests. You can also complain to your data protection authority, such as the ICO in the UK.
• California (CCPA as amended by the CPRA): you can ask to know what personal information we collect and how we use it, to delete it and to correct it. We do not sell or share personal information for cross-context behavioural advertising, and we will not treat you differently for using these rights.
• Canada (PIPEDA): you can ask to see and correct your information and withdraw consent, and you can complain to the Office of the Privacy Commissioner of Canada.
• Australia (Privacy Act): you can ask to access and correct your information, and if you are not happy with our answer you can complain to the Office of the Australian Information Commissioner.

We may need to confirm that a request comes from you before we act on it.

This website sets no advertising or analytics cookies. It uses your browser's storage to remember your region and the details of your visit, as explained on our cookies page.

BackstagePost is a service for businesses. It is not meant for anyone under 18, and we do not knowingly collect data from children through this website.

We update this policy when what we do changes. The date at the top shows the latest version. If a change matters to studios we work with, we will email them before it takes effect.

Privacy questions and requests go to hello@backstagepost.com.