Privacy Policy

1. Who we are

Studioperator (“we”, “us”) is based at Indravati Colony, Raipur, Chhattisgarh 492001, India. This policy explains how we handle personal data when you visit our website, sign up for or use the Studioperator app, or interact with a page a studio has published using it — a client portal, gallery, invitation, or enquiry form. It is written to meet India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000 and its rules.

2. Two roles: ours and the studio’s

For studio accounts (owners and team members who sign in), we decide how the data is used, so we are the data fiduciary.

For a studio’s own clients and contacts — leads, couples, guests, crew, vendors — the studio decides what to collect and why. The studio is the data fiduciary and we are its data processor: we store and process that data only to provide the service to the studio, under the studio’s instructions and our Terms of Service. If you are a studio’s client and want to access, correct or delete your data, please contact the studio first; we will help them respond.

3. What we collect

Studio accounts

• Name, email address, phone number (if given), studio name and role.
• Your password, stored only as a one-way hash (bcrypt). If you sign in with Google, we receive your Google account ID, name, email and whether the email is verified — never your Google password.
• Billing details for your subscription, such as GSTIN and billing address. Card or UPI details are handled by the payment provider and do not reach us.

Data a studio stores in the app

• Enquiries and clients: names, phone numbers, email addresses, event dates and venues, notes and activity history.
• Quotations, invoices, payments, expenses, payouts and other financial records, including GST details.
• Team and crew members: names, contact details, roles and payout records.
• Uploaded files: photos, videos, PDFs, letterheads and similar.

Visitors to pages a studio publishes

• Enquiry forms: whatever the form asks — usually name, phone, email, event details.
• Invitations: RSVP replies — name, attendance and any details the form asks for.
• Galleries: a visit count, and the photos you mark as favourite, tied to a random ID in a cookie rather than to your name.
• Client portal: access is protected by a link and PIN; we do not create an account for you.
• Face search: see section 5.

Our website

• Demo requests and feedback: the name, studio, phone, email and message you send us.
• Technical data our hosting provider records for security and reliability, such as IP address, browser type and request times.

4. How we use it

• To provide the service: sign you in, store and display your studio’s records, publish the pages you choose to publish, and calculate storage use.
• To bill your subscription and keep records required by tax law.
• To keep the service secure: prevent abuse, investigate incidents and keep each studio’s data isolated from every other studio’s.
• To contact you about your account, service changes, and demo requests or feedback you sent.
• To meet legal obligations.

We do not sell personal data, use a studio’s client data to market to those clients, show advertising, or train AI models on your content.

5. Gallery face search (biometric data)

A studio can turn on “Find my photos” for a gallery. When it does:

• The gallery’s photographs are sent to Amazon Rekognition, which creates face templates (numerical descriptions of faces). These are stored in a collection belonging to that gallery alone, so one event’s guests are never matched against another’s. They never enter our database.
• A guest who chooses to use it is told what happens before the camera opens. Their selfie is reduced in size on their device, sent once for matching, and then discarded. It is never saved by us or added to the collection.
• Deleting the gallery, or turning face search off, deletes that gallery’s face collection.

The studio is responsible for having a lawful basis — normally the consent of the people photographed — to use face search on its photographs. Anyone who does not want to be found this way can ask the studio to turn it off or remove specific photos.

6. Cookies and local storage

We use no advertising or cross-site tracking cookies.

7. Who we share it with

We share personal data only with:

• Service providers that run parts of the service for us (listed below), bound by contract to use it only for that purpose.
• The studio whose page or account the data belongs to.
• Authorities, when required by law or to protect rights, safety and the security of the service.
• A successor, if Studioperator is merged or sold — with this policy continuing to apply.

Some of these providers store data outside India. We transfer data only to countries not restricted by the Government of India under the DPDP Act, and rely on our providers’ contractual and security commitments.

8. How long we keep it

• Studio data is kept while the account is active. A studio can delete records and files at any time.
• After an account is closed, we delete the studio’s data within 45 days, except where we must keep it longer — for example invoices and billing records, which Indian tax law requires us to keep for up to 8 years.
• Backups are overwritten on a rolling cycle and are not used to restore deleted data except after an incident.
• Face collections are deleted with their gallery; selfies are never kept.

9. Security

Data travels over HTTPS. Passwords are hashed. Each studio’s records are isolated, and access within a studio follows the roles the owner assigns. No system is perfectly secure; if a breach affects your personal data we will notify you and the Data Protection Board of India as the law requires.

10. Your rights

Under the DPDP Act and similar laws, you can:

• Ask what personal data we hold about you and how it is used.
• Ask us to correct, complete, update or erase it.
• Withdraw consent you gave, without affecting what was done before.
• Nominate someone to exercise these rights if you die or become unable to.
• Raise a grievance with us, and then with the Data Protection Board of India.

Write to studioperatorsupport@gmail.com. We will reply within 30 days. If your data was added by a studio, we may pass your request to that studio.

11. Children

Studio accounts are for adults (18+). Photographs in a studio’s galleries may show children; the studio is responsible for obtaining a parent or guardian’s consent where required, including before using face search.

12. Changes to this policy

We will post any change here with a new effective date, and email account owners before a significant change takes effect.

13. Contact and Grievance Officer

Studioperator
Indravati Colony, Raipur, Chhattisgarh 492001, India
Email: studioperatorsupport@gmail.com

Send privacy requests and grievances to the email above. We acknowledge grievances within 24 hours and resolve them within 15 days.