Privacy Policy

Introduction

Capture and Motion LLC ("we", "us" or "our") takes your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our photo event delivery platform (the "Services").

Please read this Policy together with our Terms of Service and, where applicable, our Data Processing Agreement.

Who We Serve:

• Photographers: Event photographers who use our platform to upload and share photos
• Guests: Individuals who receive event photos via SMS or email
• Website Visitors: Anyone browsing our public website

Definitions

"Personal Information" means any information that identifies, relates to, describes, or could reasonably be linked to you, including name, email address, phone number, photos, and device identifiers.

"Photographer" means a business or individual who creates an account to use our Services for uploading and delivering event photos.

"Guest" means an individual who receives event photos through our Services, typically via SMS or email link provided by a Photographer.

1. Information We Collect

1.1 From Photographers

When you create a Photographer account, we collect:

1.2 From Guests

When you receive photos through our Services, we collect:

SMS Gallery Delivery Opt-In

When you request event photos via SMS:

1. Opt-In Point: You provide your phone number through a web form or mobile application at the event
2. Consent Language: The form clearly states that you agree to receive SMS from khrome with your gallery link
3. Required Disclosures: Message frequency, data rates, opt-out instructions, and privacy policy link
4. Confirmation Message: Upon opt-in, you receive a confirmation with the gallery link
5. Consent Tracking: Your consent is recorded with timestamp and IP address for TCPA compliance

Important Notes:

• SMS messages originate from khrome and are delivered on behalf of the photographer's studio
• This is a transactional message (gallery delivery), not marketing
• You may opt out at any time by replying STOP
• Limited messages per event (not recurring marketing)

1.3 From Website Visitors

When you browse our website, we automatically collect:

• Technical Data: IP address, browser type, operating system, referring website
• Usage Data: Pages visited, time spent, click patterns
• Cookie Data: See Cookie Policy section below

1.4 Information We Do NOT Collect

• Social Security Numbers
• Government ID numbers
• Financial account information (handled by Stripe)
• Health information
• Precise geolocation (we collect approximate location via IP address only)

2. How We Collect Information

We collect information through:

• Direct Collection: Information you provide when signing up, uploading content, or contacting support
• Automatic Collection: Cookies, log files, and similar technologies when you use our Services
• Third Parties: Analytics providers (Microsoft Clarity), payment processors (Stripe)
• Photographers: Guests' contact information is provided to us by Photographers who collected it at their events

3. How We Use Your Information

3.1 Legal Basis for Processing

We process your Personal Information based on:

• Contract Performance: To provide the Services you signed up for
• Consent: For optional features like marketing communications
• Legitimate Interest: For fraud prevention, security, product improvement
• Legal Obligations: To comply with tax, accounting, and regulatory requirements

3.2 Specific Uses

For Photographers:

• Provide access to the platform
• Process subscription payments
• Send service-related notifications
• Provide customer support
• Send marketing communications (with consent - opt-out anytime)
• Improve our Services
• Prevent fraud and ensure security

For Guests:

• Deliver event photos via SMS or email
• Provide access to online galleries
• Enable photo browsing, downloading, and sharing

For Website Visitors:

• Display website content
• Analyze website traffic to improve user experience
• Prevent abuse and ensure security

4. How We Share Your Information

We do NOT sell your Personal Information. We share information only as described below:

4.1 Service Providers

We use the following third-party services to operate our platform:

All service providers are contractually obligated to use data only for providing services to us, maintain appropriate security measures, and not disclose data to third parties.

4.2 Photographers & Guests

• Guests' contact information (email/phone) is shared with the Photographer who sent them photos
• Photos are accessible to all Guests who have the gallery link

4.3 Legal Requirements

We may disclose your information if required by law, such as responding to subpoenas, court orders, protecting our legal rights, investigating fraud, or complying with regulatory obligations.

4.4 Business Transfers

If we are acquired, merge with another company, or sell assets, your information may be transferred. We will notify you via email or prominent website notice of any such change.

4.5 With Your Consent

We may share your information for other purposes with your explicit consent.

5. International Data Transfers

Our Services are hosted in the United States. If you access our Services from outside the US, your information will be transferred to, stored, and processed in the United States.

For EU/UK Users:

• We comply with GDPR requirements for international data transfers
• We use Standard Contractual Clauses (SCCs) approved by the European Commission
• Enterprise customers can request our Data Processing Agreement

6. Data Retention

Photographer Extensions: Photographers can request one 2-year extension for galleries (max 4 years total). Guests can request deletion anytime, which overrides Photographer settings.

Automatic Deletion: After retention periods, data is permanently deleted from our systems.

7. Your Privacy Rights

7.1 Rights for All Users

You have the right to:

• Access: Request a copy of the Personal Information we hold about you
• Rectify: Correct inaccurate or incomplete information
• Delete: Request deletion of your Personal Information (subject to legal retention requirements)
• Export: Receive your data in a portable format
• Opt-Out: Unsubscribe from marketing emails or SMS messages
• Withdraw Consent: Revoke consent for optional processing

7.2 GDPR Rights (EU/UK Users)

In addition to the above, you have:

• Right to Restriction: Limit how we process your data
• Right to Object: Object to processing based on legitimate interests
• Right to Complain: Lodge a complaint with your local Data Protection Authority

7.3 CCPA Rights (California Residents)

See California Privacy Rights section below.

7.4 How to Exercise Your Rights

Email: privacy@khro.me Response Time: 30 days (we may extend to 60 days for complex requests)

We will verify your identity before processing requests.

8. Security Measures

We implement industry-standard security measures:

Technical Safeguards:

• Encryption in Transit: TLS 1.3 for all data
• Encryption at Rest: AES-256 for stored data
• Access Controls: Role-based access with multi-factor authentication
• Audit Logging: All data access is logged
• Vulnerability Management: Regular security scans

Organizational Safeguards:

• Confidentiality agreements with staff and contractors
• Security awareness training
• Data minimization
• Regular security audits

While we take reasonable measures, no internet transmission is 100% secure. You use our Services at your own risk.

9. Children's Privacy

Our Services are not directed to children under 13. We do not knowingly collect Personal Information from children under 13 without parental consent.

Event photos may include children. Photographers are responsible for obtaining parental consent. Parents/guardians should contact Photographers directly to request photo removal.

If you believe we have collected information from a child under 13 without consent, contact privacy@khro.me.

10. Cookies & Tracking

10.1 Types of Cookies

We Do NOT Use: Advertising cookies, third-party ad networks, or cross-site tracking.

10.2 How to Manage Cookies

Use your browser's cookie settings. We honor Do Not Track browser settings.

Disabling cookies may affect site functionality.

10.3 Product Analytics (Studio Users)

To understand which features Photographers use and where they get stuck, the signed-in studio app (the dashboard, projects, uploads, delivery and settings screens) may use PostHog, a product analytics service.

Who it covers: Photographers and their studio team members, only while signed in to the studio app.

Who it never covers: Guests. Product analytics is never loaded on gallery, showcase, share, download or find-my-photos pages, on kiosk or viewing-station screens, on our public website or legal pages, or in the Mac app. Guest galleries use only our own first-party statistics, which the Photographer controls.

What is collected:

• Which screens are viewed and which buttons and controls are clicked, with all on-screen text hidden
• Session replays of the studio app with every text field, all on-screen text, and all photos and videos masked
• A small set of named actions (for example "project created", "upload finished", "delivery sent"), recorded as counts and internal IDs only
• An internal account ID, your studio's internal ID and its plan

What is not collected: your name, email address, photos, project or gallery names, or any information about your Guests. Requests are sent through our own domain and are not linked to your login cookies.

How to opt out: turn off Share usage analytics in Settings → Data. The choice applies to that browser. If your browser sends a Do Not Track signal, product analytics stays off automatically.

10.4 Website and Gallery Analytics (Google Analytics)

We use Google Analytics on our website, in the studio app, and on Guest gallery pages to count visits in aggregate: how many people view a page, roughly where they are, and what kind of device they use.

On Guest gallery pages (gallery, showcase, share, download and find-my-photos pages), Google Analytics only receives the general type of page, such as "a showcase gallery". It never receives the access code, link token or anything else in the link that opens a specific gallery, the gallery's title, or any query string. It is not used to identify Guests.

What is turned off: Google Signals and advertising personalisation. Google Analytics does not store IP addresses.

How to opt out: send a Do Not Track signal from your browser, and Google Analytics will not load. Photographers can also turn it off in Settings → Data (the same Share usage analytics switch). You can also use Google's browser add-on at tools.google.com/dlpage/gaoptout.

11. Third-Party Links

Our Services may contain links to photographers' websites, social media platforms, or third-party services. We are not responsible for their privacy practices.

12. California Privacy Rights (CCPA)

This section applies to California residents only.

12.1 Categories Collected

We Do NOT Sell Personal Information.

12.2 Your CCPA Rights

1. Right to Know: Request disclosure of data collected and shared
2. Right to Delete: Request deletion (subject to exceptions)
3. Right to Opt-Out of Sales: We don't sell data
4. Right to Non-Discrimination: We won't discriminate for exercising rights

12.3 How to Exercise CCPA Rights

Email: privacy@khro.me Response Time: 45 days (may extend to 90 days for complex requests)

We will verify your identity before processing requests. You may designate an authorized agent with written authorization.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or new features.

Material Changes: We will notify you via email or prominent website notice at least 30 days before changes take effect.

Minor Changes: We will update the "Last Updated" date at the bottom of this page.

Continued use after changes take effect means you accept the updated policy.

14. Contact Us

For Privacy Questions:

• Email: privacy@khro.me

For GDPR Inquiries (EU/UK Users):

• Email: dpo@khro.me

For General Support:

• Email: support@khro.me