OS
StudioOSLegal & Trust
Back to Home
Sign In →
Version 2026-09-v1Effective September 19, 2026

Privacy Policy & Cookie Disclosure

How StudioOS collects, stores, and safeguards studio, creator, and client information with strictly essential cookies and zero third-party tracking.

Terms of ServicePrivacy PolicyCookie PolicyCancellation & RefundsData ResponsibilityPlatform Security

1. Introduction & Commitment to Privacy

StudioOS operates on a simple, foundational principle: We build professional workflow software for creative studios, not an advertising network. We do not sell your personal data, we do not monetize your clients’ attention, and we do not deploy third-party behavioral tracking pixels (such as Meta Pixel or Google AdSense) on your storefronts or proposals.

This Privacy Policy explains the specific categories of data we collect, why we collect it, how it is secured, and your rights under global privacy frameworks including GDPR, CCPA/CPRA, and India’s Digital Personal Data Protection (DPDP) Act.

2. Dual-Role Privacy Framework (Controller vs. Processor)

Role 1 — When You Are a Studio Owner or Team Member:

StudioOS acts as the Data Controller for your direct account information (your business name, administrator email, hashed password, billing tier, and workspace settings). We use this data strictly to maintain your account, process subscriptions, and communicate essential system notices.

Role 2 — When You Are a Wedding Couple or Studio Client:

If you are a bride, groom, commercial client, or event guest viewing a proposal, invoice, or gallery link, the Studio Owner who shared that link is the Data Controller of your media and personal details. StudioOS acts solely as a neutral Data Processor hosting that content on the studio’s instructions. Any requests to view, modify, or delete your wedding photos should be directed to your photographer.

3. Information We Collect & Why We Collect It

• Account & Profile Credentials: Name, studio brand name, email address, phone number, and securely hashed passwords.
Why we collect it: Necessary to authenticate your studio login, enforce multi-tenant account isolation, and send critical system receipts.
• Studio Storefront, Media & Pricing Formulas: Photographs, cinema embed links, Google Drive folder IDs, packages, and pricing rate cards.
Why we collect it: To render your public client storefront, calculate customized multi-day quotes, and stream cinema reels to couples on your behalf.
• Client, Couple & Crew Rosters: Groom & Bride names, ceremony dates, banquet venues, crew assignments, and contact numbers.
Why we collect it: To power your production calendar, resolve team scheduling conflicts, and generate automated call sheets and proposal documents.
• Financial Ledgers & Invoices: Milestone amounts, retainer schedules, and payment settlement flags.
Why we collect it: To track booking retainers, GST tax calculations, and revenue history. Full card numbers are handled exclusively by PCI-DSS Level 1 payment processors (Razorpay / Stripe); StudioOS never stores raw card credentials.
• Operational Telemetry: Anonymized server logs, browser user-agents, and security timestamps.
Why we collect it: Essential for platform uptime, rate-limiting, and defense against automated DDoS or scraping attacks.

4. Strictly Essential & Functional Cookies Only (Zero Ad Tracking)

StudioOS uses strictly essential functional cookies and secure localStorage tokens. Under GDPR Article 5(3) and international privacy laws, strictly necessary cookies that power core security and authentication do not require an invasive cookie consent banner.

  • `better-auth.session_token`: Maintains your secure login session across `studioos.net` and authorized subdomains.
  • `studioos-theme`: Stores your visual UI preference (Light Mode vs. Dark Mode).
  • `studioos_active_workspace_id`: Remembers which studio workspace you are actively managing.

We do not use marketing cookies, tracking beacons, cross-site profiling cookies, or third-party ad retargeting trackers. For an exhaustive inventory, explore our standalone Cookie Policy & Transparency Disclosure.

5. Sub-Processors & Infrastructure Partners

To deliver global speed, instant caching, and reliable database performance, we share data solely with trusted infrastructure sub-processors bound by strict data protection agreements:

  • Neon Database / PostgreSQL: Encrypted multi-tenant database hosting and automated backups.
  • Cloudflare Inc.: Global CDN, DDoS mitigation, SSL encryption, and R2 media storage.
  • Payment Gateways (Razorpay / Stripe): PCI-DSS compliant direct payment clearing.
  • Transactional Email Dispatchers (Resend / Brevo): Secure delivery of login OTPs and verification tokens.

6. Data Security & Encryption Standards

All data in transit is protected using modern TLS 1.3 encryption. Data at rest is encrypted using AES-256. Database records enforce tenant-level workspace isolation ensuring that no studio can query, access, or view records belonging to any other creative studio.

7. Your Privacy Rights (Access, Export, Correction & Deletion)

You have the right to request a complete machine-readable export of your personal workspace data, request correction of inaccurate profile information, or request permanent deletion of your account.

You can submit requests anytime through our self-serve Privacy & Data Rights Portal, or by contacting our governance team directly at privacy@studioos.net.