Privacy Policy

1. What information do we collect?

Information you provide

• Account and profile. Email address, password (stored by our authentication provider using secure hashing), display name, and optional profile photo. If you use Google sign-in, we receive profile details Google shares with us (for example, name, email, profile picture).
• Photographer business data. Information you enter about clients and sessions (for example, names, email addresses, phone numbers, notes, scheduling, workflow status, and messages you draft or send through connected tools).
• Booking submissions (end clients).When someone books through a user's public booking page, we collect the information submitted in that flow (for example, name, email, phone, notes, and selected time or session details).
• Galleries. Images and related metadata you upload; optional passcodes or access controls you configure; and technical tokens (for example, signed cookies) used to remember authorized gallery access for visitors.
• Waitlist. Email address you submit on our waitlist form.
• Feedback and support. Information you send when you contact us or use in-app feedback.
• Billing (subscriptions). Subscription status and identifiers (for example, Stripe customer and subscription IDs). Payment methods are collected by Stripe; we do not store full payment card numbers on our servers.

Information collected automatically

We and our providers may collect device and usage information such as IP address, browser type, general location derived from IP, pages or screens viewed, referring URLs, and timestamps. We use this for security, debugging, rate limiting, product improvement, and aggregated analytics.

2. How we use information

We use personal information to:

• Provide, operate, maintain, and secure the Services (including authentication, hosting, storage, and backups)
• Process subscriptions and payments through Stripe
• Enable integrations you connect (for example, Google Calendar or Gmail features)
• Provide AI-assisted features when you use them (via Anthropic)
• Send transactional or service-related messages and deliver feedback emails (including via Resend where applicable)
• Measure product usage and improve the Services (including PostHog when enabled)
• Comply with law, enforce our Terms of Service, and protect rights and safety

3. Legal bases (reference for certain regions)

If applicable law requires a "legal basis," we rely on performance of a contract with you, our legitimate interests (for example, securing and improving the Services, provided those interests are not overridden by your rights), your consent where required (for example, certain cookies or marketing where we ask for it), and compliance with legal obligations.

4. When we share information

We disclose personal information to:

• Supabase — authentication, database, and file storage for the Services
• Google — when you sign in with Google or connect Google Calendar or Gmail features
• Stripe — payment processing and subscription management for Bokeh plans
• Anthropic — processing inputs and generating outputs for AI-assisted features you use
• Resend — delivering certain emails (for example, feedback notifications)
• PostHog — product analytics when our app is configured with analytics keys; may use cookies or similar technologies
• Professional advisors and authorities — lawyers, auditors, or government entities when required or advisable
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards

We do not sell your personal information for money. Some laws treat certain disclosures of personal information for targeted advertising or analytics as "sharing" or "selling." We use PostHog for product analytics, not to run third-party ad networks on our site. Depending on how PostHog is configured and your jurisdiction, you may have rights to opt out of certain processing—see U.S. state privacy notices.

5. Cookies and similar technologies

We use cookies and similar technologies for authentication and session management, security, remembering preferences, gallery access tokens where applicable, and (when enabled) analytics through PostHog. We do not use cookies to run behavioral advertising across unrelated third-party sites. You can control cookies through your browser settings; blocking some cookies may affect functionality.

6. AI-based features

When you use AI-assisted features, we send relevant content to Anthropic to generate suggestions (for example, email drafts). Do not submit information you are not permitted to share with an AI provider. Outputs may be imperfect; review before sending to clients. Anthropic processes information under its terms and policies as well as our agreements.

7. Google sign-in and connections

You may sign in with Google or connect Google services for calendar or email features. Google receives and processes information under its policies. The information we receive depends on your Google settings and permissions. If we add other social or OAuth providers in the future, we will update this Policy.

8. Retention

We retain personal information for as long as your account is active, as needed to provide the Services, and as necessary to comply with legal obligations, resolve disputes, enforce agreements, and maintain backups and business records (for example, billing records associated with Stripe). Retention periods may vary based on data type and legal requirements. When we no longer need personal information, we delete or de-identify it, subject to technical limitations (for example, residual copies in backups until rotation).

9. Security

We implement technical and organizational measures designed to protect personal information. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

10. Children

The Services are not directed to children under 18 (or the age of majority in your jurisdiction), and we do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us at contact@mail.bokehbooking.com and we will take appropriate steps.

11. Your privacy rights

Depending on your location, you may have rights to access, correct, delete, or port your personal information, and to object to or restrict certain processing. You may withdraw consent where processing is based on consent. To exercise rights, email contact@mail.bokehbooking.com. We may need to verify your request. Authorized agents may submit requests where permitted by law, with proof of authorization.

If you are an end client of a photographer using Bokeh (for example, you booked a session or viewed a gallery), that photographer may control much of your information. We can assist with requests that relate to information we process on our systems; some requests may need to be directed to the photographer.

12. Do-Not-Track

There is no consistent industry standard for DNT signals. We do not respond to DNT signals at this time. California law requires us to disclose that we do not respond to DNT signals.

13. U.S. state privacy notices

Depending on your state of residence, you may have additional rights regarding personal information (for example, access, correction, deletion, opt-out of certain "sales," "sharing," or targeted advertising, and appeal rights). Categories of information we collect are described in Section 1. We disclose information to service providers under contracts that limit their use of the information.

We do not knowingly "sell" personal information for money. We use PostHog for product analytics; depending on your state's definitions, certain analytics disclosures may be treated as "sharing" or targeted advertising. You may contact us to exercise opt-out or other rights available in your state.

If we decline to take action on a request, you may appeal by emailing contact@mail.bokehbooking.comwith "Privacy appeal" in the subject line, where applicable law provides an appeal right.

California "Shine the Light"

California residents may request certain information about disclosure of personal information for direct marketing purposes under California Civil Code § 1798.83. We do not disclose personal information to third parties for their direct marketing purposes as described in that statute.

14. Changes to this Policy

We may update this Policy from time to time. We will post the updated Policy and change the "Last updated" date. If changes are material, we may provide additional notice.

15. Contact

Email: contact@mail.bokehbooking.com

16. Requests to access, update, or delete

To request access, correction, or deletion of personal information we process, email contact@mail.bokehbooking.com. We will respond in accordance with applicable law. Closing your account may not delete all historical records immediately (for example, billing records we must retain).