# Privacy policy

How isodesk handles personal data, under India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules. It says what the platform actually does today.

## In short

- We collect what a studio needs to run its work and what its clients and guests give when they use a gallery, an event page or the client portal.
- We do not sell personal data. We advertise on Google Search; if you came from one of our ads, Google is told whether it led to a studio or a paid plan, never who you are.
- Analytics run on this website and in the studio app, never on client pages, sign-in pages or payment pages, and not at all when your browser sends Global Privacy Control or Do Not Track.
- Card details go to Razorpay, never to us. Selfies for selfie search are deleted as soon as the search ends.
- You can see, correct and delete your data, and complain to our grievance officer or the Data Protection Board of India.

## Who we are, and two roles

isodesk is run by imastudent. \[To be added: legal entity name, registered address and CIN\]

- For accounts on the platform (studio members, crew and people who host events), we decide how the data is used. Under the DPDP Act we are the Data Fiduciary.
- For a studio's clients and guests (their photos, picks, orders, messages and selfies, and the studio's own records about them), the studio decides, and we process the data for it. The studio is the Data Fiduciary and we are its Data Processor. Questions about that data go first to the studio; we help it answer.

## What we collect, and why

| Whose | What | Why |
| --- | --- | --- |
| Studio members and crew | Email address, name, phone number, role; for the team page a title and day rate; a public profile if they make one | To sign in, run the studio, assign crew and send them event details |
| Studios | Business name, address, GSTIN and state; bank details and UPI id for invoices; for store payouts, PAN, a contact person and the settlement bank account | To issue invoices, take payments and pay out store sales |
| Crew payments | UPI id, bank account name and number, IFSC, and a PAN where tax is deducted | To pay crew and record tax deducted |
| Clients and guests | Name, mobile number or email address when they heart, comment, pick, order, reply to an event or search; the address for a shipped order | To deliver the gallery, picks, orders and messages the studio sends them |
| Photos | Photos and comments uploaded by the studio and, when the studio allows, by guests; the camera details stored in the files | To show, sort, sell and deliver the photos |
| Faces | A selfie for selfie search, and face measurements of the gallery's photos | To find a guest's photos, only where the studio switches it on (below) |
| Messages | Emails, WhatsApp messages and text messages sent to clients and crew, and the team chat | To keep the studio and its clients in touch; the studio's log shows recipients masked |
| Devices | A token for each phone or browser that turned notifications on, its platform and a device label | To send the notifications that were asked for |
| Security | Sign-in records, network addresses for rate limits, and one-way hashes of contact details and network addresses used against spam | To keep accounts and public forms safe |
| People who sign in, for referrals | A hashed form of the network you use when you sign in to the website (by email link, Google, phone or passkey), press Get started on an invite link while signed in, set up a studio, or open Billing as a studio owner. It is made with a secret key and kept 180 days after it was last seen. Never the network address itself, and the hash cannot be turned back into it. Private and local network addresses are not recorded | To show our team when the two studios in a referral signed in from the same network, before we confirm free months or a reward. It is a hint for a person to look at, never a reason on its own to refuse |

## Signing in with an email link

- There is no password. We email a link that works once, for 15 minutes. Opening it starts a session.
- We keep only a one-way hash of each session's token. A session ends after 30 days without use, and in any case after 90 days.

## Signing in with Google or a phone number

- Google One Tap: on public pages, if you are not signed in to a studio account, your browser loads Google's sign-in script once the page has settled, so that Google can offer to sign you in. This does not depend on your answer about analytics. It also runs on the sign-in pages, and not in the studio app, the platform admin, client galleries or other pages for clients.
- A cookie for that prompt: when the page asks us for the prompt, we set a cookie holding a random value, which lasts 10 minutes, to check that Google's answer came back to the browser that asked. It is not used for analytics.
- Signing in with Google: Google receives the sign-in request. If you go ahead, Google sends us your Google account id, email address and name, and whether it has verified the email. We use them to sign you in.
- Signing in by phone: if you choose it, your browser or our app sends your number to Firebase Authentication, which is run by Google, to send you a code by text message. This goes for client pages, event pages and private galleries too, and happens before we can tell whether we know the number. Google's reCAPTCHA checks that a person, not a program, is asking. In our app, Google Play Integrity on Android, or a silent notification through Apple's push service on an iPhone, checks that the request comes from our app. Your number stays as a user in our Firebase project.
- A number new to us: we keep a record of it, and set a cookie in that browser, which can be used for 15 minutes, so that an email link opened in the same browser can add it to your account. A number on your account stays there, and can then sign you in.

## Signing in with a passkey

- If you add a passkey, your device or password manager keeps its private key, protected by your fingerprint, face or device PIN. We never receive that key, or your fingerprint or face.
- We keep the passkey's public key, the name you give it, whether it is synced between devices, when you added it and when it was last used, so that we can check it is you when you sign in. You can see and remove your passkeys on your sign-in settings page, and we email you when one is added or removed.
- While you sign in or add a passkey, we set a cookie holding a random value, so that the answer from your device can be matched to the browser that asked. It lasts a few minutes and is deleted when you finish.
- Removing a passkey, or deleting your account, deletes what we keep about it. No outside service takes part in signing in with a passkey.

## Face data and selfie search

Face measurements identify a person, so we treat them with the most care. They are worked out on our own face service: no outside company receives a selfie or a face.

- Selfie search is off unless the studio switches it on for a gallery.
- Before a guest searches, the page tells them that the selfie is used once to find their photos and deleted right after. The guest also gives their name and a phone number or email address.
- The selfie is deleted as soon as the search ends. If a search never finishes, our hourly clean-up deletes the selfie, normally within two hours.
- Face measurements from the gallery's photos are kept with that gallery, and deleted when its closing date passes, when selfie search is switched off, or when the gallery or photo is deleted. A gallery with no closing date keeps them until one of the others happens.
- People in the photos who never search are measured too. The studio switches selfie search on, and is responsible for telling its clients and, through them, their guests.

## Notifications

- Notifications are sent only to a phone or browser where you turned them on. Our app uses Firebase Cloud Messaging, run by Google, which passes through Apple's push service on an iPhone. A browser uses its own maker's push service; what we send it is encrypted, so that service cannot read it.
- A team notification on a locked screen shows fixed wording, with no client's name, place or amount. Open the app to see the details.
- A client's notification shows the studio's name and fixed wording. A reply in a gallery also shows the gallery's title, which the studio chose.
- Notifications by email, WhatsApp or text message, where you choose them, carry the details.
- Notifications in the app are deleted 90 days after they are read, and after 180 days in any case.

## Email and messages

- Emails are sent through Amazon SES. They carry no tracking pixels and no click tracking.
- WhatsApp messages go through Meta's WhatsApp Business Platform, from the studio's own business number or from ours. Text messages to Indian numbers go through MSG91.
- Team chat messages, with their photos and files, are deleted after 180 days.
- Where a studio receives photos by email, we keep the sender's address and name, the subject and the email's security checks. All details stored in the photo files are kept with the original, including any location; no screen shows the place, and adding a photo to a gallery offers to leave those details out. The email itself is deleted once its photos are saved; one that cannot be read is kept for 7 days, and photos left waiting for review are removed after 30 days.

## AI features

- Automatic culling and face matching run on our own servers. Nothing is sent to another company.
- The assistant in the studio app, and the help assistant, send your question and the records it needs to Anthropic (Claude), with OpenAI as a backup when we switch it on. A client's phone number and email address are taken out first; names and notes can be sent. Help conversations are stored with phone numbers, email addresses, UPI ids, card and ID numbers taken out, and stay until you delete them. If you turn one into a ticket, our team sees that conversation up to the moment you send it. A question the help could not answer, or one you mark unhelpful, goes to our team's list with contact details taken out; a name typed in it can remain.
- The chat on a studio's public page sends the visitor's messages to the same AI service, including any name, phone number or email address the visitor gives so the studio can reply. These conversations are deleted after 30 days.
- The writing helper sends the text you ask it to improve to Anthropic, and "Suggest alt text" sends the photo.
- The question box on this website sends your question, and the pages it is answered from, to Anthropic, or to OpenAI when Anthropic is not available. We do not store or log the question or the answer; to limit how many questions one network sends, we keep a scrambled form of your network address and a count, for a few days.
- Where a requested email address name needs a check, Anthropic (Claude), or OpenAI when Anthropic is not available, sees only that name, the person's name and the references on the account, never mail or photos. Choosing an event's type from what a host typed, and picking add-ons from a studio's own catalogue for a quote template, go the same way, with only those words sent.

- [AI and your data](https://isodesk.io/ai): Where each AI feature runs and what it sends: culling and selfie search on our servers; help, chat and card wording as text to Anthropic; AI pictures to Google.

## Payments

- Card, UPI and bank payments are taken by Razorpay on its own checkout. We never see or store card details. We give Razorpay the buyer's name, phone number and email address to fill in the checkout, and keep Razorpay's order and payment ids.
- For store payouts, the studio's business details, PAN, contact person and bank account go to Razorpay, which checks them and pays the studio. We keep the bank account number and PANs encrypted, and show the account number masked.
- Plans are paid on Razorpay's hosted subscription page.

## Analytics, session recordings and bot checks

We use two tools to learn how people use this website and the studio app, so we can find what is confusing or broken and decide what to build next. Both run on this website and in the studio app without asking first. You can turn them off in your browser, as described below.

- PostHog (product analytics): the pages you open (the address without anything after a "?"), the buttons you press (without their text), how long you stay, your browser, operating system, device type and screen size, the site that sent you, and approximate location from your network address, with a random id kept in a cookie and in your browser's storage. For a signed-in studio member, also the member's user id, the studio's id and its plan, and events such as "project created", "quote sent", "gallery published" or "plan upgraded", some with a count or a kind. Never your name, email, phone number, an amount, or what you type. Our PostHog project is in the United States unless we move it to PostHog's European Union region. PostHog keeps events for as long as our plan with it allows (one year on its free plan); we can delete a person's events on request.
- Microsoft Clarity (session recordings and heatmaps): how the page moves as you scroll, click and type, replayed to us so we can see what is hard to use, with your browser, device, screen size and approximate location. Everything typed into a field, numbers and email addresses are hidden in your browser before anything leaves it. In the studio app, photos of clients, a client's contact details, invoices and quotes, a project's payments, store orders and the studio's GSTIN, bank and UPI details are hidden too, and the pages for buying a plan, Razorpay keys, payouts, paying crew, earnings and sign-in settings are never recorded. For a signed-in studio member, the user id and plan. Clarity is run by Microsoft, mostly in the United States. It keeps recordings for 30 days, and click and heatmap data and recordings we save for up to 9 months.
- Neither runs on client galleries, guest event pages, the client portal, invoices, quotes, receipts, payment pages, review links, sign-in pages and codes, studio and photographer pages, the enquiry form on a studio's own website, or the platform admin.
- To turn them off, switch on Global Privacy Control or Do Not Track in your browser: then neither tool loads and no analytics or ad click cookie is set. If you declined analytics on our old cookie banner, that answer is still kept. Ad blockers and privacy extensions that block these tools work too; nothing on the site breaks without them. To have events already sent about you deleted, write to the grievance officer below.
- Google Ads, only when you came from one of our ads on Google Search and your browser does not send Global Privacy Control or Do Not Track: the click's id (from the ad's address) is kept in the iso\_gad cookie for 90 days. If a studio is then made, or a plan paid for, we send Google that click id, what happened, when, and the plan's price before GST, so it can tell which ads work. Never your name, email, phone number or studio name. Google Ads is run by Google.
- Cloudflare Turnstile checks that a person, not a program, is sending public forms (sign-in, enquiries, quotes, reviews, guest uploads and the question box). It looks at your browser and network address for that check only; it is not used for analytics or advertising.

## Cookies

Every cookie below is needed for the page to work, except the analytics cookies and the ad click cookie, which are not set when your browser sends Global Privacy Control or Do Not Track. None is used to show you ads.

| Name | What for | How long |
| --- | --- | --- |
| sp\_session | Keeps you signed in to the studio app | Up to 90 days |
| sp\_gn | Checks a sign-in with Google came back to this browser | 10 minutes |
| sp\_pk | Matches a passkey to the browser that asked | 10 minutes |
| sp\_pp | Lets an email link add a number proved in this browser | 15 minutes |
| sp\_portal | Keeps a client or guest signed in to their page | Up to 90 days |
| sp\_pl | Ties a client's sign-in link to the browser that asked | 20 minutes |
| sp\_preview | Shows studio staff a client's page as that client would see it, read only | 1 hour |
| sp\_portal\_google | Checks a client's sign-in with Google | 10 minutes |
| sp\_v | Remembers a visitor in a gallery | 1 year |
| sp\_pin, sp\_link | Remember that a gallery's PIN was entered | 30 days |
| sp\_person | Keeps a named person signed in to a gallery after a code | 30 days |
| sp\_vn | Hands a visitor from one gallery page to the next | 5 minutes |
| sp\_g\_… | Remembers a guest who replied on an event page | 180 days |
| sp\_k\_… | Carries "Keep my photos" from an event page to the client portal | 1 day |
| gu\_human, send\_human | Remember a passed bot check for uploads | 2 hours |
| send\_browser | Lets only the browser that started sending photos to a studio's address go on with it | 2 days |
| isodesk\_chat | Keeps a visitor's chat on a studio's public page | 30 days |
| sp\_gcal\_state, sp\_ig\_state | Check a studio's link to Google Calendar or Instagram | 15 minutes or less |
| sp\_gsave\_state | Check the link to your Google account when you save photos to Google Drive or Google Photos | 10 minutes or less |
| iso\_ref | Holds the referral code from an invite link, so the invited studio can get its free months once we confirm the invite. Removed once the studio is made | 30 days |
| analytics\_consent | Set only by our old cookie banner: remembers that you declined analytics, which we still respect. We no longer set it | 180 days from when you answered |
| iso\_gad | Only when you came from one of our Google ads: the ad click's id, so Google can tell us whether the ad led to a studio being made or a plan paid for. Nothing about you is in it | 90 days |
| ph\_… (PostHog) | A random id for analytics | One year |
| \_clck (Clarity) | A random id for recordings | One year |
| \_clsk (Clarity) | Joins the pages of one visit into one recording | One day |

## Who else handles data

These companies process data for us, only to provide the service described next to them. Each is on only where we have set it up.

- Amazon Web Services: storage of photos and files, and sending of email (Amazon SES).
- Cloudflare: storage and delivery of photos (R2), making their smaller sizes (Images), studios' own web addresses, receiving photos by email, and bot checks on public forms (Turnstile).
- Razorpay: online payments, subscriptions and payouts to studios.
- Meta: WhatsApp messages, and a studio's Instagram posts when it links its account.
- MSG91: text message reminders and invitations to Indian numbers.
- Google: sign-in with a Google account, Firebase Authentication and reCAPTCHA for signing in by phone, Firebase Cloud Messaging for app notifications, Google Calendar when a studio links it (event names, places, crew and the lead's name and phone), Google Drive and Google Photos when you choose to save photos there (the photos you chose, a folder or album name, and we keep your Google email address and an encrypted access key until you disconnect or 30 days pass without a save), and Google Maps Platform for the place you type and the map pictures of venues and studio addresses (our server asks for these, so Google sees no visitor). When a guest taps Show the map on an event page, the map loads from Google, which then sees that guest's network address.
- Apple: sign-in with Apple, the notifications to an iPhone, and the silent notification that checks our iPhone app when you sign in by phone there.
- Browser makers' push services (such as Google, Mozilla and Apple): encrypted browser notifications they cannot read.
- Anthropic, and OpenAI as a backup: the AI features above.
- PostHog and Microsoft Clarity: analytics and session recordings on this website and in the studio app.

Films on a gallery are links to the studio's own YouTube or Vimeo channel, played from youtube-nocookie.com and with Vimeo's do-not-track setting. Links to CineRentals and Cinema Center, our group companies, carry a city, dates and gear only, never a client's name.

We do not sell personal data. We share it with the police, courts or a regulator only when the law requires it.

## Where data is stored

\[To be added: where the production database and files are hosted\] Some of the companies above, such as Anthropic, Microsoft, PostHog and Google, process data outside India, for example in the United States or the European Union. The DPDP Act allows this except to countries the Government of India restricts, and we will follow any such restriction.

## How long we keep it

| Data | How long |
| --- | --- |
| Selfies | Until the search ends; at most about two hours |
| Face measurements | Until the gallery closes, selfie search is switched off, or the photo or gallery is deleted |
| Galleries and photos | Until the studio deletes them |
| A studio's original photo files after it stops paying or goes over its storage | Deleted 90 days later, after emails to the owner when it starts and on days 45, 60, 83 and 89, unless it pays or gets back under the limit. Files a client paid for, or that an unfinished order needs, are kept, and the smaller web sizes stay. Deleted originals cannot be restored. This starts only when we switch it on. |
| Event pages hosted without a studio | Closed 6 months after the last function; closing deletes the photos, faces, guests' replies and messages |
| Studio chat with visitors | 30 days |
| Team chat | 180 days |
| Notifications in the app | 90 days after reading, 180 days at most |
| The hashed network used to check referrals | 180 days after it was last seen |
| Sign-in links and codes | 15 minutes to use; codes are deleted a day after they expire |
| Help conversations | Until you delete them |
| Invoices, payments and payout records | As long as Indian tax and accounting law requires |
| Accounts, clients and other records | While the account is open, and as below when it is deleted |
| Security records (sign-ins, changes and the hashes used against spam) | At least one year, for security and as the law requires; we do not yet delete them on a schedule |

## Your rights

Under the DPDP Act you have the right to:

- get a summary of the personal data we hold about you and what we do with it, and who we have shared it with;
- have it corrected, completed, updated or erased;
- withdraw consent you gave, as easily as you gave it (for analytics, with Global Privacy Control or Do Not Track in your browser); what was done before stays lawful;
- have a grievance answered;
- nominate someone to use these rights for you if you die or cannot act.

How: clients and guests can see what we hold, and delete their account, on their page under Account. Studio members and crew can delete their account in our app, or write to the grievance officer below. Deleting an account removes your name, email address, phone number, public profile, sign-in methods, passkeys, devices and sessions. Invoices, crew payments and security records stay as the law requires. The only owner of a studio must first make someone else an owner. For data a studio holds about you as its client or guest, ask the studio; we will help it answer.

## Children

- Accounts on the platform are for people aged 18 or over. We do not knowingly let a child create one.
- Studios photograph children, for example in baby and family shoots. The studio collects and shares those photos for its clients, and must have a parent's or guardian's consent.
- A child should not use selfie search; a parent or guardian can search for them.
- We do not track children's behaviour or show them advertising, and analytics never run on client galleries or event pages.

## Keeping data safe

- Sessions, sign-in links and codes are stored only as one-way hashes. Passkeys leave only a public key with us.
- Bank account numbers and PANs are encrypted. Card details never reach us.
- Access inside a studio follows the roles its owner sets.
- If a breach affects your personal data, we will tell you and the Data Protection Board of India, as the DPDP Act requires.

## Changes to this policy

When we change what we collect or why, we update this page and the date at the top.

## Grievance officer

\[To be added: grievance officer name, email address and postal address\]. We acknowledge a complaint within 24 hours and answer it within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India.

## See also

- [AI and your data](https://isodesk.io/ai): Where each AI feature runs and what it sends: culling and selfie search on our servers; help, chat and card wording as text to Anthropic; AI pictures to Google.
- [Terms of service](https://isodesk.io/terms): Draft terms of service for studios using the platform: accounts, plans and GST, photos and rights, the store and payouts, WhatsApp, and acceptable use.
- [Refund policy](https://isodesk.io/refund-policy): Draft refund and cancellation policy for plan fees, and how refunds work for prints and downloads bought from a studio's gallery.

Page: https://isodesk.io/privacy. Updated 08/11/2026.