Privacy Policy

Who is responsible for what

For your studio account (name, email, sign-in and billing details) and for enquiries made through our own website, Aurora Studios is the data controller. For the photos and client details a studio delivers through its galleries, the studio is the controller and Aurora Studios acts as its processor, handling the data only to host and deliver it. A client or guest who wants access to, or deletion of, their photos should contact the studio that shared them; we will help the studio act on that request.

What we collect

To set up and run a studio’s website we collect:

• Studio account data: name, email, studio and domain details, a hashed password, and optional two-factor sign-in settings.
• Content the studio uploads: photos and the gallery details around them (titles, sections, favourites and picks made by clients).
• Technical and security data: sign-in activity, and IP addresses in security and activity logs (for example gallery unlocks, downloads and login attempts), used to keep accounts secure and to limit abuse.
• Messages you send us through the contact form or by email.

Client galleries: passwords and public galleries

Each gallery is isolated to its own studio, and by default a gallery is protected by a password. A studio can choose to switch an individual gallery to public mode, which removes the password so that anyone who has the link can view it. Public galleries are still private in other respects: they are not listed anywhere, photos are still delivered through expiring links, and they still expire and are deleted on the schedule below. Where a password is used, login attempts are rate-limited to protect against guessing. For that, the gallery page sets one strictly necessary, first-party device cookie (aura_gd: a random identifier with no personal data) that is used only to count failed password attempts from that browser, in 10-minute windows; it expires after one hour and is used for nothing else.

Favourites and the “picking as” cookie

When a guest hearts photos in a client gallery, we set one strictly necessary cookie in their browser for that gallery (a random, signed identifier; it contains no personal data) so their picks stay separate from other people’s and are still there when they return. It lasts up to 180 days and is used for nothing else. A guest may also type an optional display name (for example “Bride”) so the photographer knows whose picks they are; the name is stored with the picks, shown only to the studio, and can be removed by saving an empty name. The photographer may set a limit on how many photos each guest can pick. Picks, the identifier and the name are deleted together with the gallery when it is permanently deleted (after its expiry plus the retention period below, 30 days by default); deleting the cookie in the browser simply starts a new, empty list.

How photos are delivered

Photos are not published at a permanent public web address. They are served through short-lived, signed links that expire automatically, so an old link does not stay usable forever.

Location and camera metadata (EXIF)

Photos are uploaded directly from the browser to private storage. Shortly after the upload (normally within minutes), our processing step rewrites the stored original without its EXIF, XMP and other embedded metadata, which includes GPS location and camera details. Only what is needed to display the photo correctly is kept: its colour profile and its rotation. JPEG, PNG, TIFF and WebP files are cleaned without lowering their quality; other formats (such as HEIC) are converted to high-quality JPEG. Whenever we have to convert a file instead of only cleaning it (for example HEIC, or a JPEG we cannot clean without re-encoding), we also keep the file exactly as you uploaded it, including its metadata, in private storage, so that you never lose your original. Your clients never receive this copy and no link to it is ever created for them; you can download it from your studio, it counts toward your storage, and it is deleted when you delete the photo or the gallery. The smaller web versions used in galleries (thumbnails and previews) are created without metadata. Two limits apply: until processing finishes, the file as uploaded, including any metadata, sits in private storage; and if a file cannot be decoded, we keep the unprocessed file for up to 7 days before deleting it, so that it is not lost because of a technical fault. This is a privacy measure, not a guarantee against every possible form of identification from the picture itself.

We don’t sell your data

We never sell or rent your data or your clients’ data, and we do not use it for advertising. We share it only with the service providers listed below, to run the service.

Service providers (sub-processors)

We use the following providers to run the service. Each handles data only on our instructions and for the stated purpose.

• Vercel: application hosting and delivery. Our server functions run in Frankfurt, Germany (fra1); static content is served from Vercel’s global network.
• Supabase: managed PostgreSQL database for accounts, galleries and photo records.
• Cloudflare: R2 object storage for the photo files, plus DNS and custom-domain connection for studio websites.
• Upstash (QStash): a message queue that triggers photo processing. Messages carry internal identifiers, not the photos themselves.
• Resend: delivery of transactional email (for example gallery notifications, expiry reminders and password resets).
• Google Fonts: some studio themes load typefaces from Google, which means a visitor’s IP address and browser details are sent to Google when the page loads.

Where data is processed

Our application servers run in Frankfurt, Germany. The database, file storage, queue and email providers above process data according to the regions configured on our accounts with them, and some of them, like Vercel’s delivery network, operate globally. Where personal data is transferred outside Israel or the EEA, we rely on the safeguards offered by those providers. To learn where your studio’s data is held, email hello@aurorastudios.app.

How long we keep data

We keep data only as long as it is needed:

• Client galleries: a gallery expires 365 days after creation by default (the studio can change or extend this). The studio is emailed reminders 30, 7 and 1 days before expiry. After expiry there is a 30-day grace period during which the studio can extend the gallery. After that, every photo, thumbnail and gallery record is permanently deleted.
• Galleries deleted by the studio: held for 30 days so they can be restored, then permanently deleted.
• Photos moved to the review bin: 30 days, then permanently deleted.
• Uploads that fail processing: up to 7 days. Unfinished uploads: cleaned up within about a day.
• Activity and security logs (these include IP addresses and email addresses): routine activity 30 days; security events such as sign-in and suspension events 90 days.
• Sessions: studio sign-in 12 hours; gallery access 6 hours. For each studio sign-in we keep the browser name, operating system and last-active time (no IP-based location, no full browser string) so you can recognise your devices in Account and sign one out. Two-step recovery codes are stored only as one-way hashes, until used or replaced.
• Studio account data: while the account is active, and deleted on request or when the account is closed.
• Backups: database backups held by our database provider may keep deleted data for a limited period after deletion (we aim for no more than 30 days) before they are overwritten.

Cookies

We use only cookies that are needed to run the service or to remember your display choices. We do not use advertising or analytics cookies, so there is no cookie banner. The cookies are:

• aura_studio: keeps a photographer signed in. 12 hours. Secure, HttpOnly.
• aura_2fa and aura_2fa_enroll: short-lived steps of two-factor sign-in and setup. 5 and 10 minutes. HttpOnly.
• aura_g_<gallery id>: remembers that a visitor unlocked a password-protected gallery or download. 6 hours. HttpOnly.
• aura_lang: remembers the language you chose (English or Hebrew) on public pages and in client galleries. First-party, holds only the language code, identifies no one. 1 year. SameSite=Lax.
• aura_gp_<gallery id>: the signed random identifier that keeps a guest’s favourite picks in one gallery separate from other people’s (see “Favourites and the ‘picking as’ cookie” above). Contains no personal data. Up to 180 days. HttpOnly.
• aura_gd: counts failed gallery-password attempts from one browser (see “Client galleries: passwords and public galleries” above). Strictly necessary, first-party, random identifier with no personal data. 1 hour. HttpOnly.
• aura_studio_lang, aura_studio_theme and aura_studio2_density: remember language, light/dark theme and layout density in the studio panel. 1 year each.

Your rights and how to exercise them

You may ask to see, correct, export or delete the personal data we hold about you, and you may object to certain uses of it. Email hello@aurorastudios.app. For studio account data we respond within 30 days. If you are a client or guest of a studio, please start with that studio; we will support it. Studios can also download their galleries themselves, and on closing an account we can provide an export of the studio’s photos before everything is deleted.

Security

Studios are isolated from one another in our database and in file storage, media is delivered only through signed links, sign-in attempts are rate-limited, and studio accounts can use two-factor authentication. If a security incident affects personal data, we will notify the affected studio without undue delay so it can meet its own obligations.

Contact us

Questions about your data or this policy? Email us at hello@aurorastudios.app and we’ll get back to you within one business day.