Privacy Policy

1. Who we are

Caloreel is run by Caloreel Ltd, a company registered in England and Wales ("Caloreel", "we", "us"). Our company number and registered office are available on Companies House and on our invoices.

This policy explains how we handle personal data when you visit our website, try or subscribe to Caloreel, contact us, or connect services such as Google. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For any privacy question, email support@caloreel.com with "Privacy" in the subject line.

2. Our two roles

Data protection law gives us different responsibilities depending on whose data it is.

When we are the controller

We decide how and why personal data is used, and we are responsible for it, when it relates to:

• photographers and studios who use Caloreel, and their team members (account, profile and billing data);
• visitors to our marketing website;
• people who contact us, sign up for news or report abuse;
• our own security, fraud prevention and legal compliance.

When we are a processor

Photographers use Caloreel to manage their clients: galleries, the CRM, bookings, contracts, invoices, emails and the print store. For that client data, the photographer is the controller and we act on their instructions as their processor, under our Data Processing Agreement.

Are you a client of a photographer? If you've received a gallery, booking link, contract or invoice through Caloreel, the photographer decides how your data is used. Please contact them first with questions or requests about your data. If you can't reach them, email us and we'll pass your request on.

3. The personal data we collect

As a controller, we collect:

• Account details: your name, email address, studio name, profile photo (if you sign in with Google) and the role you hold in a studio.
• Billing details: your plan, billing address, VAT number if you give one, invoices and payment history. Card details are collected and held by Stripe; we only see limited information such as the card brand, last four digits and expiry date.
• Usage and device data: sign-in times, IP address, browser and device type, pages and features used, and error logs. We use this to keep Caloreel secure and working well.
• Communications: messages you send us, support conversations and feedback.
• Google account data: only if you choose to connect Google (see section 5).
• Store and payout set-up: whether your Stripe account is connected and its status. Stripe holds your identity verification and bank details, not us.
• Website data: when you visit our marketing site, our hosting and security provider processes your IP address and request details to deliver the page and protect against attacks. We measure visits with privacy-friendly, cookie-free analytics that report totals, not individual visitors.
• Marketing preferences: whether you've asked to receive or stop receiving product news.
• Abuse reports: details you give us when you report content, and information about the content reported.

Most of this comes directly from you. Some comes from your use of Caloreel, from Google if you connect it, and from Stripe about the status of your payments.

4. How we use your data and our lawful bases

Where we rely on legitimate interests, we've weighed our interests against your rights. You can ask us for more detail, and you can object (see section 10). Every marketing email has an unsubscribe link.

We don't sell personal data, we don't use it for advertising, and we don't make decisions about you based solely on automated processing that have legal or similarly significant effects. We don't use photos, client data or Google data to train artificial intelligence models.

5. Google user data

You can sign in with Google and, separately, connect Google Calendar and Gmail. Each connection asks for your permission on a Google screen, and you choose which account to connect.

• Google sign-in gives us your name, email address and profile photo so we can create and secure your account.
• Google Calendar lets us list your calendars, read when you're busy so booking pages only offer free times, and create, update and remove the events Caloreel makes for your bookings, including guest emails and Google Meet links.
• Gmail lets us read messages so we can show conversations with your clients on their client cards, and send emails you write in Caloreel from your own address so they appear in your Gmail Sent folder. We only store the full content of messages in conversations matched to your clients, and we encrypt that content at rest with an additional layer of application-level encryption.

Limited Use. Caloreel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements. In particular:

• we only use Google user data to provide and improve the user-facing features described above;
• we don't use or transfer it for advertising, including retargeting, personalised or interest-based ads, and we don't sell it;
• we don't transfer it to anyone else except as necessary to provide those features, for security purposes, to comply with the law, or as part of a merger, acquisition or sale of assets with your prior consent;
• no person at Caloreel reads it unless you've given us permission to look at specific messages or data (for example to help with a support request), it's necessary for security purposes such as investigating abuse, or it's required by law.

You can disconnect Google at any time in your Caloreel settings or from your Google account's security settings. When you disconnect, we stop syncing and delete our access tokens. Emails already shown on client cards remain part of your client records until you delete them, ask us to remove them, or close your account.

6. Who we share data with

We use a small number of trusted providers (sub-processors) to run Caloreel. Each is bound by a contract that requires it to protect personal data and use it only to provide its service to us.

Prodigi and WHCC only receive what they need to fulfil an order, such as the image file, product details and the buyer's delivery name and address. Stripe also acts as an independent controller for some purposes, such as fraud prevention and meeting its own legal obligations.

We may also share personal data:

• with professional advisers, such as lawyers, accountants and insurers, under a duty of confidentiality;
• with law enforcement, regulators or other authorities where the law requires it, or to report illegal content (see our Acceptable Use Policy);
• with a buyer or successor if we sell or reorganise all or part of our business, in which case we'll tell you and this policy will continue to apply.

We'll update the list above before we add or replace a sub-processor. Customers receive notice as described in our Data Processing Agreement.

7. International transfers

Your files, including photos and video, are stored in Cloudflare R2 in an EU-jurisdiction bucket. Some of our providers process data outside the UK, for example in the US.

When personal data leaves the UK, we make sure it's protected by one of the safeguards UK law recognises:

• adequacy regulations, which cover the European Economic Area and, for US organisations certified to it, the UK Extension to the EU-US Data Privacy Framework;
• the International Data Transfer Agreement (IDTA) approved under UK law; or
• the UK Addendum to the European Commission's standard contractual clauses.

You can ask us for more information about the safeguard used for a particular provider.

8. How long we keep data

We keep personal data only as long as we need it for the purposes in this policy.

Client data held for photographers is kept and deleted according to the photographer's instructions and our Data Processing Agreement.

9. How we protect data

We encrypt data in transit and at rest, limit staff access to what each role needs, require multi-factor authentication for staff access to our systems, and log important actions. Sign-in uses single-use, short-lived email links or Google, so there are no Caloreel passwords to steal. Our Security page explains our approach in more detail.

No system is perfectly secure. If a personal data breach affects you and is likely to result in a high risk to your rights, we'll tell you without undue delay.

10. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you and receive a copy;
• rectification of inaccurate or incomplete data;
• erasure of your data in certain circumstances;
• restrict how we use your data in certain circumstances;
• data portability, to receive data you gave us in a reusable format;
• object to processing based on legitimate interests, and to object at any time to direct marketing;
• withdraw consent at any time where we rely on consent, without affecting processing before you withdrew it;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects.

To use any of these rights, email support@caloreel.com with "Privacy" in the subject line. We may need to confirm your identity. We'll respond within one month, which the law allows us to extend by up to two further months for complex requests; if we do, we'll tell you why. There's normally no charge.

If your request is about client data a photographer holds in Caloreel, we'll refer it to that photographer and help them respond.

11. Cookies

Our website doesn't use advertising or cross-site tracking cookies. The Caloreel app and client galleries use cookies that are needed to sign in, unlock galleries and keep a basket. Our Cookie Policy lists them.

12. Children

Caloreel is for businesses and isn't directed at children. You must be 18 or over to create an account, and we don't knowingly collect personal data from children as a controller.

Photographers may upload photos of children, for example from family sessions. That is client data the photographer controls, and they are responsible for having the right permissions from parents or guardians.

13. Complaints

If you're unhappy with how we've handled your personal data, please tell us first at support@caloreel.com with "Privacy complaint" in the subject line. We'll acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint (opens in a new tab) or on 0303 123 1113.

14. Changes to this policy

We'll update this policy when our practices or the law change, and show the date at the top of the page. If we make significant changes, we'll tell customers by email or in the app before they take effect. If we ever want to use Google user data in a new way, we'll ask for your consent first.

15. Contact

Email support@caloreel.com with "Privacy" in the subject line. Caloreel Ltd is registered in England and Wales; our company number and registered office are available on Companies House and on our invoices.