Privacy Policy

1. Operator information

2. Information we collect

• Email address (for photographer registration and notifications)
• Name / business name (photographer profile)
• Client name and email address (for project management; entered by the photographer)
• Uploaded photo data (which may include personal data such as faces of the people photographed)
• Service usage logs (access timestamps, etc.)
• For photographers using the customer management (CRM) feature: the name, contact details, address, family composition, and children's names and dates of birth, contact history, and other information ("customer data") of the photographer's own customers (e.g., families who commission shoots)

Customer data is held and processed by the operator on the photographer's instructions and on the photographer's behalf. The operator does not use customer data for its own business purposes (see "4-2. Our role in the customer management (CRM) feature" below for details).

3. Purpose of use

• To provide and operate the Service
• To send selection-completion notifications and subscription renewal reminder emails
• To improve the Service and respond to incidents
• To comply with legal obligations

4. Provision to third parties located abroad (subprocessors)

We entrust data to the following subprocessors. All are U.S. companies. In line with Article 28 of Japan's Act on the Protection of Personal Information, we have confirmed that each maintains a data protection framework consistent with applicable standard contractual clauses under its data processing agreement before entrusting data to them.

• Supabase, Inc. (database, storage, authentication)
• Vercel Inc. (application hosting)
• Resend, Inc. (email delivery)
• Stripe, Inc. (credit card payment processing)

* Data is stored on servers located outside Japan (primarily in the United States). For information about the personal data protection systems of the destination countries, please contactkainan0880jwr@gmail.com. Except as required by law, we do not provide personal data to third parties other than the subprocessors listed above.

4-2. Our role in the customer management (CRM) feature

In the customer management (CRM) feature, a photographer registers and manages personal data about their own customers (third parties). The roles are divided as follows:

• Photographer: acts as the data controller for customer data under Japan's Act on the Protection of Personal Information, and bears primary responsibility for specifying the purpose of use, lawfully obtaining data, and responding to the data subject
• Operator: processes customer data as a processor entrusted by the photographer, and only within the scope of the photographer's instructions (see Article 7-3 of the Terms of Service)

If a customer (or their legal guardian) wishes to access, correct, or delete their own information, please contact the photographer who registered it first. If the photographer then requests deletion or another action from the operator, the operator will respond within a reasonable period after verifying identity.

5. Data retention period

• Photo data (Free plan): 30 days after a project is created, the underlying photo files are removed from our servers and storage, and become inaccessible from the selection page. Some records (such as the project name and upload timestamp) may be retained for operational purposes
• Photo data (Light, Standard, Pro plans): retained indefinitely while a paid plan is active
• If a paid plan is canceled and the account reverts to the Free plan, we retain photo data for 30 days from the date of cancellation. We will email you in advance if this grace period is about to end. After the grace period, the Free plan conditions above apply
• Account information and photo data: if you delete your account, both your photo files and account information are permanently deleted from our servers
• Customer management (CRM) feature data: unlike photo data, this is retained for as long as the photographer continues to use it for customer management purposes. Photographers may delete individual customer records at any time. If a photographer's CRM contract ends, we keep the data exportable for 30 days from the termination date, after which it is deleted. We will email you in advance if this grace period is about to end

6. Security

• All photos are accessible only via time-limited signed URLs
• Row-level security (RLS) prevents access to other users' data
• All communications are encrypted via HTTPS (TLS)
• Credit card details never pass through our servers; Stripe, Inc. collects and stores them directly. We never hold your card number

7. Access, correction, and deletion

To access, correct, or delete your own personal data, you can delete your account from the "Settings" page in your dashboard. For other requests, please contact us at the email address below. We will respond, after verifying your identity, generally within 30 days.

8. Cookies, analytics, and external data transmission

The Service uses cookies to maintain login sessions. If you disable cookies in your browser, some features may not work correctly.

On the Service's marketing pages and the photographer dashboard, we use Google Analytics (GA4), provided by Google LLC, only if you consent via the banner shown at the bottom of the screen. It is never loaded unless you consent. The client-facing page where subjects select their photos (the URL-token-based selection page) never uses Google Analytics, regardless of consent. Google Analytics uses cookies to collect access information (page views, time on page, referral source, etc.), but we do not use it in a way that identifies you personally. Collected data is managed under Google's own privacy policy. If you wish to withdraw consent after accepting, you can clear your browser's cookies and site data, or use theGoogle Analytics Opt-out Browser Add-on.

We also use Stripe, Inc.'s JavaScript library for payment processing, which transmits browser information to Stripe. Please refer to Stripe's privacy policy for details.

9. Changes to this policy

If we make material changes to this policy, we will provide at least 30 days' notice within the Service or by email before the change takes effect. Minor changes may be made at any time, with the "last updated" date revised accordingly.

10. Contact

For inquiries regarding the disclosure, correction, deletion, or suspension of use of your personal data, please contact us at the email address below. We will respond, after verifying your identity, within a reasonable period (generally within 30 days).

kainan0880jwr@gmail.com