Who we are
Alita Gallery is a client gallery service made by Alita Moments, a photography and videography studio based in Riverview, Florida. In this policy, “Alita Gallery,” “we,” and “us” refer to the service and its operator.
Information we collect
Studio accounts. We receive the name, email address, profile information, and authentication details needed to create and secure a studio account. If you choose Google sign-in, Google provides the basic account information you approve. We also store your studio name, public address, preferences, plan and trial status, and messages you send to support.
Gallery content. We process photographs, previews, filenames, gallery titles, collection settings, and related information that a studio uploads. Browser-generated previews remove camera metadata, including location data. Original files are stored and delivered as uploaded unless the studio changes or removes them.
Gallery visitors. Visitors can browse a public or unlocked gallery without creating an account. We collect an email address only when a visitor chooses to favorite or download photographs, to order from a studio’s store, or to sign up for a studio’s emails. We record favorites, downloads, photos a client hides from other visitors, access events, and the technical request information needed to deliver the service, prevent abuse, and investigate errors.
Store orders. When a client buys from a studio’s store, we process their name, email address, shipping address for prints, and what they ordered, for that studio.
Client payments. When a client pays through a studio’s payment link or buys a gift card, we also process the name and email address they give, and the name, email address and message for the person receiving a gift card, on the studio’s behalf, to record the payment, send receipts and deliver the gift card.
How we use information
We use information to provide and secure the service, authenticate studios, store and deliver galleries, remember visitor choices, show studio activity, enforce storage and access limits, respond to support requests, prevent fraud and abuse, and improve reliability. We do not sell personal information or use client gallery activity for targeted advertising.
Service providers
Cloudflare provides the network, application hosting, database, and object storage used by Alita Gallery. Clerk provides studio authentication. Google processes information when a person chooses Google sign-in. Stripe processes payments: studios’ subscriptions to Alita Gallery, payments for event galleries, and the payments a studio takes from its own clients. Card details go to Stripe directly and never reach Alita Gallery. We keep Stripe’s references to each payment, its amount and when it was made. Resend delivers the emails Alita Gallery sends, including a studio’s marketing emails to its subscribers, and receives each recipient’s address and the email’s content to do so. These providers process information under their own terms and privacy notices and only for the functions used by Alita Gallery.
So that photographs can be recovered if our main storage fails, we keep a backup copy of every photograph a studio stores (each original, and the previews made from it) with an independent storage provider outside Cloudflare. Each copy is encrypted by Alita Gallery before it leaves our main storage, with keys separated by studio that the provider never receives, so the provider holds only encrypted data. We also keep a daily backup copy of our database (account, gallery, client, and business records) with the same provider, encrypted by Alita Gallery in the same way before it leaves, and each day’s copy is deleted after 30 days. If a studio connects an Instagram account, Instagram (Meta) receives the photographs and captions the studio chooses to post (see Instagram posting). If a studio turns on Find my photos for a gallery, Amazon Web Services (Amazon Rekognition) receives web-size copies of that gallery’s photographs and the photos visitors search with (see Find my photos). If a studio sells prints through its store and connects a print lab, the lab (WHCC) receives the print files and the buyer’s name, shipping address and order details it needs to make and ship the order.
We may disclose information when required by law, to protect the service or another person, or as part of a business transfer. We do not give a studio access to another studio’s galleries or client activity.
Contract signing evidence
When a client signs a contract in Alita Gallery, we record each step so the signature can be shown to be theirs: opening the contract, agreeing to sign electronically, asking for and entering an emailed code, signing, and declining. Until the client has agreed to sign electronically, opening the contract records only the time. Every other step records the network (IP) address it came from; an approximate location (city, region, country, and time zone) that Cloudflare, our network provider, estimates from that address; the browser, operating system, full browser description (user agent), and whether the connection was encrypted; and the screen size, time zone, and language the browser reports. When a studio member countersigns, the same details are recorded about them.
The signing page also sends a random identifier that the browser creates and keeps in its local storage for this site (or a new one for each visit, if the browser refuses storage). We do not store that identifier: we keep only a pseudonym made from it with a secret key and the studio’s account, so the same browser has a different identifier at each studio. When a contract asks for an emailed code, a six-digit code that works for 10 minutes is sent to the email address the studio has for the client. We keep only a keyed hash of it, never the code itself, and the signing record notes the address it was sent to.
This evidence is stored encrypted, in the studio’s account. The studio has all of it in its records and its data export. The signed copy, a PDF that the client and the studio can download, ends with a certificate of completion that shows the client’s own signing evidence to anyone it is shared with: their name and signature, how they confirmed their identity (with the email address the code went to, partly hidden), the full browser description they signed with, and, for each recorded step, the time, network address, approximate location, browser and operating system, the first characters of the device pseudonym, screen size, time zone, and language. For the studio’s countersignature, it shows only the member’s name and email. The public page for checking a copy never shows an email or network address.
A sent contract and its signing evidence are kept for as long as the studio’s account exists, and are permanently deleted with it (see Downloading and deleting your account).
Instagram posting
A studio can connect its own Instagram professional account and post photographs from its collections. We keep the connected account’s Instagram ID, username, and account type, and the access token Instagram gives us. The token is stored encrypted, is never shown, and is deleted when the studio disconnects the account, when the account’s owner removes Alita Gallery’s access on Instagram, or when the studio’s account is deleted.
To post, web-size copies of the chosen photographs are made: by the studio’s browser for a post made now, or by Alita Gallery at the chosen time for a scheduled post. We keep those copies only until Instagram has fetched them: they are deleted as soon as the post is published, and within an hour in any case. Until a scheduled post is made or canceled, we keep its caption, which photographs it uses and how each is cropped, and its date and time; no copy of the photographs is made before then. For each post we keep a record in the studio’s account of its caption, the number of photographs, whether it was published, and its link on Instagram. The studio can remove a record, and all of them are deleted with the studio’s account. A published post is public on Instagram and is governed by Meta’s own terms and privacy policy.
If the owner of an Instagram account asks Meta to have the data Alita Gallery holds about that account deleted, we delete its access token and remove its username and post links from studios’ records.
Find my photos
Find my photos is an optional face-matching search that a studio can turn on for one of its collections or event galleries, so that visitors can find the photographs they appear in. It is off unless the studio turns it on. It is not offered for events that take place in, or to visitors in, Illinois, Texas, Washington, the city of Portland (Oregon), the European Union, the European Economic Area, the United Kingdom, or Switzerland, and a couple’s own event galleries do not offer it.
When a studio turns it on, we send a web-size copy of each photograph in that gallery, never the original, to Amazon Web Services (Amazon Rekognition). Amazon detects the faces in it and keeps a face index for that gallery alone: numbers describing the geometry of each face, which some laws treat as biometric information. We keep only Amazon’s reference numbers for the faces in each photograph, so that they can be deleted with it. The face index is used only to let visitors to that gallery find the photographs they appear in. It is never used to identify anyone by name, shared with another studio or gallery, sold, or used to train or improve any system, by us or by Amazon.
A visitor searches only after reading how it works, confirming they are 18 or older and that the photo is of themselves, and agreeing. Their selfie or chosen photo is made smaller in their own browser, sent to Amazon Rekognition once to be compared with that gallery’s face index, and is not stored, by us or by Amazon. The search shows only photographs the visitor could already see in that gallery. We keep a record that the visitor agreed (the gallery, the time, the version of the wording they agreed to, and a one-way code made from their network address, never the address itself or any image) for five years, or until the studio’s account is deleted if that is sooner, to show that consent was given.
Retention and destruction. A gallery’s face index is permanently deleted, at Amazon and in our records, at the earliest of: the end of the period the studio chose when turning it on (30, 90, or 180 days, and never more than a year); the studio turning it off; the collection or event being moved to the trash, deleted, or set so that guests see only their own photographs; or the studio’s account being deleted. A photograph’s faces are deleted when the photograph is deleted. Deletion at Amazon happens straight away, and if Amazon is briefly unavailable it is retried until Amazon confirms it. Our records of which faces belong to which photograph are left out of our daily database backups. Deleted records can remain in our database provider’s recovery history for up to 30 days.
The studio that turns on Find my photos decides to use it and is responsible for telling the people in its photographs and for any consent the law requires from them. Anyone who would rather not be included can ask the studio to turn it off or to remove the photographs they appear in, or contact us at the address below.
Studios’ marketing emails
A studio can invite people to receive its marketing emails: with a box beside the email field when they save favorites, download, or buy from its store, which is never ticked for them; with a sign-up form on its galleries; or on its own sign-up page. A studio can also add people who, it confirms, agreed to receive its emails.
For each subscriber we keep, for that studio only: their email address and any name they give, stored encrypted; where they signed up; and a record of each time they subscribed or unsubscribed, with the date and the exact words they agreed to. We send the studio’s emails on its behalf and keep a record of which emails went to each subscriber. If the studio’s emails are tracked, they contain a small image and links that let our email provider tell us whether an email was delivered, opened, or clicked, or bounced.
Every marketing email has a link to unsubscribe, and the unsubscribe button in mail apps also works. After unsubscribing, a person gets no more marketing emails from that studio. Emails about their own galleries, orders, and bookings still reach them. They can also ask the studio, or us, to remove them completely.
The studio decides who it emails and is responsible for having their consent. Subscribers are deleted with the studio’s account. We never use a studio’s subscribers for our own marketing or share them with another studio.
Retention and deletion
We keep account and gallery information while it is needed to provide the service, meet legal obligations, resolve disputes, and protect the service. A deleted collection is taken offline immediately and can be restored for 30 days before its files and client records are permanently removed. When a trial or paid plan ends and a studio holds more than the Free plan’s storage, its client galleries go offline after 14 days, and 44 days after the plan ended its collections, event galleries, and photographs are permanently deleted, together with the favorites, downloads, and guest details attached to them, unless the studio fits within Free or chooses a plan first (see the Terms of Service). The studio’s account and its client, quote, invoice, and contract records are kept. When photographs are permanently deleted, their encrypted backup copies are kept for up to 30 more days, so that a mistake can be put right, and are then deleted. A studio can contact us to request access to, correction of, or deletion of personal information. Some records may be retained when the law or security of the service requires it.
If you send us feedback from the workspace, we keep your message, the page you were on, the app version and your browser type for up to a year, to fix problems and improve Alita Gallery. Screenshots you attach are emailed to us and not stored.
Downloading and deleting your account
The owner of a studio or events account can download everything it holds at any time, from Your data in the workspace: one data file with the account’s records (such as clients, jobs, quotes, invoices and payments, contracts and their signatures, questionnaires and answers, inquiries, emails to and from clients, tasks, sessions, events, and gallery visitors’ favorites, notes, and downloads), and every original photograph, as ZIP files made while they download. We do not keep copies of these files.
The owner can also delete the account there. It goes offline at once, and the owner can cancel the deletion for 14 days. After that, its photographs, galleries, records, and settings are permanently deleted from our database and storage, and any subscription to Alita Gallery is canceled; payments already made are not refunded. A studio’s own Stripe account, which it uses to take its clients’ payments, belongs to the studio and is not affected. We keep only a record that an account was deleted and when, without its name, address, or contact details. We email the owner when the deletion is requested, the day before it takes effect, and when it is complete. Deleted database records can remain in our database provider’s recovery history, and in our encrypted daily database backups, for up to 30 days, and the encrypted backup copies of the account’s photographs are deleted 30 days after the account is deleted.
Sign-in accounts are held by Clerk, our authentication provider, and are not removed when a studio or events account is deleted, so the person can still sign in later. To delete a sign-in account too, contact us at the address below.
Security
Alita Gallery uses HTTPS, tenant isolation, access controls, signed links, rate limits, and encryption at rest. Photographs are stored with keys separated by studio, and their backup copies are encrypted by us, with separate keys per studio, before they leave our main storage. No online service can promise absolute security, so studios should use strong account security and share gallery passwords and links carefully.
Your choices
Studios control whether a gallery is published, password protected, downloadable, or set to expire. Gallery visitors can ask the studio that shared a gallery to correct or remove their email, favorites, hidden photos, or download activity. Anyone may contact us about a privacy request using the address below.
Children
Alita Gallery is not directed to children under 13, and children may not create studio accounts. A studio is responsible for obtaining any permission required before uploading or sharing photographs of minors. Find my photos may only be used by visitors who confirm they are 18 or older.
Changes to this policy
We may update this policy as the service changes. We will post the revised date here and provide additional notice when a change materially affects how we use personal information.
Contact
Questions about privacy or this policy can be sent to hello@alitagallery.com.