Privacy Policy

What we collect

Only what we need to plan your session and deliver your photos:

• Your name, the name you'd like us to use, email address and phone number, when you enquire or book.
• Your session details: the date, the place, who's coming and anything you tell us about the day.
• Your messages to us and the photos or files you send with them.
• The photos we take of you and the people with you, and the favourites you choose.
• Records of what you've paid online. Card payments are handled by Stripe; we never see your full card number.
• How the site is used, as described under “How we measure the site”.
• Our own notes about working with you, like how you like to hear from us, and a record of when your details change.

Why we use it

We don't sell your personal data, and we don't use it for anything you wouldn't expect from the studio you booked. We use it to:

• Reply to your enquiry and plan your session.
• Deliver your gallery, your edited photos and your downloads.
• Take payment for extras you choose.
• Send you messages about your booking, like reminders and “your photos are ready”.
• Unless you turn them off, ask for a review, or send a note a year later.
• See which pages work.
• Keep the records Singapore law requires.

Your consent, and changing your mind

By getting in touch or booking, you agree to our using your personal data for the purposes above. You can withdraw that consent at any time by emailing privacy@framedstories.co. We'll tell you what that means for you (for example, we can't deliver a gallery without an email address). Then we stop within a reasonable time.

We only show your photos in our portfolio, on this site or on social media if you say yes to that separately, in your gallery. You can change your mind there at any time, and we take those photos down.

Your photos are personal data

The photos from your session show you and the people with you, so we treat them as personal data. Your gallery is private unless you choose to make your page public. Each photo loads through a secure link that expires, and galleries never show up in search engines, public or not. We never run face recognition or any other face analysis on them.

If you invite people to your page by email, we use their addresses only to send the invite and to let them in. We never send them anything else. When you remove someone, we delete their address. When your gallery is deleted, theirs go with it.

Visitors to your page see your edited photos and nothing else: we never ask their name or email, and they can't leave notes or hearts. We count visits to your page without storing who the visitor is or where they came from. If someone books with us from your page, we note that it came from a client's page, never which person.

How we count visits to the site

We keep our own cookie (fs_attr) for up to a year. It holds a random number, how you first reached us and how you most recently did (an ad or campaign tag, the site that linked to us, the first page you saw), and how many times you have visited. As you browse, we record which pages you view, how far you scroll and which buttons you use under that random number. We never record your IP address with it. This shows us what works.

When you send an enquiry, ask for a date, create an account or pay online, we keep how you found us with that record. The pages you viewed before on the same browser become linked to it. Page records are deleted after 13 months. After that we keep only daily totals, and they name no one.

If your browser sends Global Privacy Control or Do Not Track, we set no cookie and record none of this.

Messages and enquiries

When you message us about your session, we keep the conversation with your booking, with any photos or files you send. We remove the location and camera details from photos when they arrive. If you reply to one of our emails, the reply reaches your conversation through Cloudflare. We email you when we reply, unless you turn that off in your notification settings.

An enquiry starts a conversation with us. We keep it with your email address, name and what you told us. Our emails about it have a link that opens it, and your account is created only if you use that link. Anyone can type an email address into a form. So until you use a link or reply to one of our emails, the enquiry stays with us and never shows in an account. If you book with the same email, the conversation carries on with your booking.

Who we share it with

Only the services that run the studio for us, each for its own part and nothing else:

• Vercel (hosting this site) and Neon (our database).
• Cloudflare (storing your photos and files, and receiving email replies).
• Clerk (signing in to your account) and Resend (sending our emails).
• Stripe (online payments for extras).
• Telegram (passing your messages to us so we can answer quickly) and Upstash (timing reminder emails).

Data stored outside Singapore

Several of these services keep data outside Singapore, mostly in the United States and the European Union. We only use providers that must protect your personal data to a standard comparable to the PDPA's, by contract and under their own policies.

How long we keep it

An enquiry that doesn't become a booking is deleted 90 days after its last message. We keep your booking and messages while we work together. Payment and booking records are kept for five years, as Singapore's tax rules require.

Your shareable page is free for a month from delivery, and your private gallery for 3 months, or longer while you keep them online with our yearly plan. After that the gallery rests: it goes offline, but we keep the photos for another 12 months. You can still download them, or bring it back. Then we delete them. We email you at least 14 days before we do. Ask us any time and we'll delete your gallery sooner.

When we no longer need personal data for any of these purposes, we delete it or make it anonymous.

Seeing and correcting your data

You can ask us what personal data we hold about you and how it has been used in the past year. You can also ask us to correct anything that's wrong. Email privacy@framedstories.co. We reply within 30 days. If we need longer, we'll tell you why and when to expect it.

Keeping it safe

Only our team can see your bookings, messages and galleries, and every sign-in is protected. If a data breach is likely to cause you significant harm, we'll tell you and the Personal Data Protection Commission, as the PDPA requires.

Data Protection Officer

Send questions, requests or complaints about your personal data to our Data Protection Officer at privacy@framedstories.co. If you're not happy with our answer, you can contact the Personal Data Protection Commission at pdpc.gov.sg.