Privacy Policy

1. Two kinds of information

Studios' own information: the details of the photographers and staff who use Apture (names, emails, sign-in and billing details). For this, Apture Studios LLC is responsible (the "controller").

Clients' information: the details studios keep about their clients and website visitors (names, contact details, sessions, messages, forms, contracts, gallery visits). For this, each studio is responsible and Apture handles it on the studio's behalf (the "processor"), under the Data Processing Agreement. If you're a studio's client, contact the studio first about your information; we'll help them respond.

2. What we collect about studios

Account details: name, email, password (stored only as a secure hash), two-step sign-in setup, studio name and settings.

Billing: your plan and payment status. Card details are handled by Stripe; we never see or store full card numbers.

Activity: sign-ins, important changes in your studio (the activity log), IP addresses and browser type for security, and error reports.

What you send us: support requests and ideas.

3. How we use it

To run your studio and provide the service you signed up for; to bill you; to keep accounts and data secure and prevent abuse; to support you; to tell you about your account, billing, and important changes to Apture; and to improve Apture. We don't sell personal information, don't share it for advertising, and don't use tracking or advertising cookies.

4. Cookies

We only use cookies needed for Apture to work: keeping you signed in, remembering a client's access to a gallery or portal, and a few preferences (like light or dark mode). There are no advertising or analytics cookies.

5. Who helps us

We use the services below to run Apture. They only get what they need for their part, and are bound to protect it:

Vercel Inc.: Hosting and running the app (United States).

Neon Inc.: Database (United States (AWS, us-east-2)).

Cloudflare, Inc.: Photo and file storage (R2), DNS, bot protection (Turnstile) (United States, with global delivery).

Stripe, Inc.: Apture subscription billing; studios' client payments through their own Stripe accounts (United States).

Resend (Plus Five Five, Inc.): Sending email and reporting delivery (United States).

Functional Software, Inc. (Sentry): Error reports (with secret links masked) (United States).

DocuSign, Inc. / Dropbox, Inc. (Dropbox Sign): Contract signing, only for studios that turn it on (United States).

OpenStreetMap Foundation (Nominatim): Place search when a studio adds a map location (no personal data sent) (United Kingdom / European Union).

Google LLC (Google Fonts): Web fonts, loaded by the visitor's browser (United States).

We may also share information if the law requires it, to protect people's safety or our rights, or as part of a sale or reorganization of our business (and would tell you).

6. Where it's stored

Apture's data is stored and processed in the United States. If you're outside the United States, your information is transferred there; where the law requires it, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. How long we keep it

Studio data is kept while the studio's account is open. When a studio is deleted, its records and photos are removed 30 days after the request, apart from billing records we must keep by law. Database backups hold deleted data only until they roll off (a limited number of days). A studio's activity log and email log stay with the studio until it's deleted; records of incoming webhooks are kept for up to 90 days; sign-in attempt counters for a day.

8. Security

Each studio's data is kept separate from every other studio's in the app and in the database. Connections are encrypted, passwords are hashed, two-step sign-in is available, access by our staff is limited, logged and time-limited, and secret links (portals, galleries, forms) are masked in error reports. No system is perfectly secure; if a breach affects your information, we'll tell you without undue delay.

9. Your rights

Depending on where you live (for example under the GDPR in Europe or the CCPA in California), you may have the right to access, correct, download, or delete your personal information, to object to or restrict some uses of it, and to complain to a data protection authority. Studios can download and delete their data themselves from Your data. For anything else, email us and we'll respond within the time the law requires. We won't treat you differently for using these rights.

10. Children

Apture is for businesses and isn't meant for children. Studios may keep information about clients of any age (for example family sessions) as part of their own records, as controllers of that information.

11. Changes and contact

We'll post changes here and tell studio owners about important ones. Questions or requests: support@aptureapp.com, or Apture Studios LLC, Texas, United States.