capture.rs
FeaturesPricingAppsGuidesFind a photographerContact

Solutions

Client galleriesVideo deliveryCRM for photographersPhotographer websiteInvoices for photographersPixieset alternativePic-Time alternative
Sign in
Create a studio

Privacy Policy

Last updated: October 21, 2026

This policy explains which personal data we process when you use Captures, why, on what legal basis, who we share it with, how long we keep it and what rights you have. We have written it plainly, without legal traps.

Service provider

Iso Studio

Kragujevac, Serbia

Contact: capture.rs/contact

  1. 1. Controller and processor

    For data about studio and team accounts, subscription billing, support and visits to this website, the controller is Iso Studio from Kragujevac (details at the top of the page).

    For data a studio enters or uploads into its account — clients, gallery guests, photos, videos, contracts, invoices — the studio is the controller and we are the processor acting on its instructions, as set out in the “Processing data on behalf of the studio (DPA)” section of the Terms of Service. If you are a client or guest of a studio, please direct requests about your data to that studio first; we will help it fulfil them.

  2. 2. What data we process

    Studio and team accounts:

    • name, email address, studio name and details, password (stored only as a one-way hash), language settings, team role and two-factor authentication data.

    Signing in with Google:

    • name, email address, email verification status and profile picture — see “Data from your Google account”.

    Subscription billing:

    • plan, subscription status and history, and Paddle customer and subscription identifiers. You enter card details directly with Paddle; we never see or store them.

    A studio’s content and business data:

    • photos and videos with metadata (EXIF, including GPS location if the camera records it), documents, signed contracts, invoices, messages, tasks and calendar;
    • client data the studio enters: name, contact details, address, event date and venue, notes, payments.

    Gallery, portal and store guests:

    • email address if the guest enters it (favorites, downloads, orders), comments, photo selections, orders and delivery addresses;
    • an anonymous visit identifier and gallery view statistics;
    • a selfie and face vectors only if the guest uses “Find me” — see “Face recognition”.

    Technical data:

    • IP address, device and browser type, access times and security events (such as failed sign-ins), for security, abuse prevention and troubleshooting.

    Contact form:

    • the name, email, studio name and message you send.

  3. 3. Data from your Google account

    If you choose “Continue with Google”, we request only the basic scopes (openid, email, profile) and receive your name, email address, email verification status and profile picture.

    We use this data only to create your account, sign you in and link it to an existing account with the same email address. We do not request access to your Gmail, contacts, Google Drive or calendar. We do not store Google access or refresh tokens — they are discarded right after sign-in. We do not sell data from your Google account, use it for advertising, or transfer it to third parties except as needed to provide the service or as required by law. Our staff do not access it except with your consent, for security purposes, or as required by law.

    Captures’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

    You can remove the connection in your Google account settings (Security → Third-party apps); after that you sign in with email and password.

  4. 4. Purposes and legal bases

    • Providing the service, your account, support and account-related communication — performance of a contract.
    • Subscription billing and accounting — performance of a contract and legal obligation.
    • Security, abuse prevention, backups and troubleshooting — legitimate interest in protecting you, your clients and the system.
    • Notices about material changes to the service and terms — performance of a contract and legitimate interest.
    • Face recognition — the guest’s explicit consent, after the studio decides to enable the feature.
    • Replying to contact form inquiries — steps at your request before entering a contract, and legitimate interest.

    We do not make decisions based solely on automated processing that have legal effects on you. We do not sell personal data, build advertising profiles, or use studio content to train artificial intelligence models.

  5. 5. Face recognition

    “Find me” helps a guest quickly find the photos they appear in. The feature is off until the studio enables it for a specific gallery.

    • The guest gives explicit consent before sending a selfie and can refuse without losing access to the gallery.
    • The selfie is used for a single search and is not stored.
    • Face vectors from gallery photos are computed on our own servers, are not sent to third parties and are used only within that gallery.
    • The vectors are deleted when the studio turns the feature off or deletes the gallery.
    • The feature cannot be enabled in galleries the studio marks as containing minors.

  6. 6. Cookies and local storage

    We use only cookies that are necessary for the service to work:

    • the sign-in session and sign-in abuse protection;
    • the selected studio and language;
    • access to password-protected galleries and an anonymous gallery visit identifier.

    In your browser’s local storage we keep interface preferences (such as hidden cards and upload progress). We do not use advertising cookies or third-party analytics. On the subscription checkout page, Paddle loads its payment window and uses its own cookies under its privacy policy.

  7. 7. Who we share data with

    We share data only with service providers that help us run Captures (sub-processors), and only as far as necessary:

    • Cloudflare, Inc. — DNS, attack protection and content delivery (website and gallery traffic passes through it);
    • Paddle.com Market Ltd — subscription billing, invoices and taxes (merchant of record for subscriptions);
    • Google LLC — signing in with a Google account, only if you choose it;
    • an email delivery provider — notifications, invitations, gallery links and invoices;
    • a storage provider in the European Union — backups of originals, when we use one;
    • an error-tracking provider (e.g. Sentry) — a technical description of an error when something breaks (page without parameters, browser, app version), without cookies, IP address or the content you enter.

    We may also disclose data to public authorities when the law requires it, and to protect our rights or users’ safety. In a sale or merger of the business, data may pass to the successor under the same obligations as this policy, with prior notice.

  8. 8. Where data is stored and international transfers

    The application, database and gallery previews run on our servers in Serbia. Backups are kept in Serbia or with a storage provider in the European Union. Some providers (Cloudflare, Google, Paddle) may also process data in the United States or the United Kingdom. Such transfers rely on an adequacy decision or standard contractual clauses, in line with the Serbian Law on Personal Data Protection and the GDPR.

  9. 9. How long we keep data

    • A studio’s data and content: while the account is active. After cancellation we delete it within 90 days, and it disappears from backups when their cycle expires.
    • Deleted galleries and files: removed from the live system immediately, and from backups when their cycle expires.
    • Accounting records about subscriptions: as long as accounting law requires.
    • Technical and security logs: up to 12 months.
    • Contact form messages: up to 2 years after the last communication.
    • Face recognition data: as described under “Face recognition”.

  10. 10. How we protect data

    • All traffic is encrypted (HTTPS); sensitive settings and integration keys are stored encrypted.
    • Each studio’s data is also separated at the database level (row-level security), so one studio cannot see another’s data.
    • Passwords are stored as a one-way hash; two-factor authentication is available.
    • Links to photos and videos are signed and time-limited; GPS location from photos is never shown to guests.
    • We make backups and regularly check the integrity of originals.
    • Only a limited number of authorised people have access to production systems.

    No system is completely secure. If a breach occurs that may put your rights at risk, we will notify you and the competent authority within the legal deadline.

  11. 11. Your rights

    Under the Serbian Law on Personal Data Protection and the GDPR you have the right to:

    • access your data and get a copy of it;
    • correct inaccurate data and complete incomplete data;
    • have your data deleted;
    • restrict processing;
    • data portability (export in a machine-readable format);
    • object to processing based on legitimate interest;
    • withdraw consent at any time, without affecting the lawfulness of earlier processing.

    Send your request through the contact form; we reply within 30 days at the latest. You also have the right to lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs) or with the supervisory authority in the EU country where you live.

  12. 12. Minors

    Only adults may open a studio account. Minors may appear in a studio’s galleries; the studio, as controller, is responsible for their data, and galleries with minors cannot use face recognition.

  13. 13. Changes to this policy

    We update this policy when the service, our providers or the law change. We notify studio owners of material changes by email and in the app before they apply. The date of the last change is shown at the top of the page.

  14. 14. Contact

    For any privacy question or to exercise your rights, write to us through the contact form at capture.rs/contact, marked “Privacy”.