At Sujan Studio ("we", "us", or "our"), we are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services, use our mobile applications (including our iOS app), or visit our website, SujanStudio.com, in compliance with the Australian Privacy Act 1988 (Cth) ("Privacy Act"), the General Data Protection Regulation ("GDPR") in the European Union/EEA, and other relevant data protection laws.
1. Information We Collect
A. Personal Information
This may include your name, email address, phone number, postal address, and any other information you provide when booking our services, signing up for our platform, or contacting us.
B. Images and Recordings
As a photography and videography studio, we collect and store images, video recordings, and related metadata of individuals as part of our services. We will always obtain your consent when required by law before capturing or using identifiable images/videos.
C. Website Usage Data
We may automatically collect information about your interaction with our website, such as your IP address, browser type, device identifiers, referring/exit pages, pages viewed, and timestamps.
D. Location Information
Where you use our booking, shoot planning or delivery features, we collect location information. This includes coarse location (such as the suburb or city derived from your IP address or approximate location services) and, where you grant permission, precise location (a latitude and longitude accurate to three or more decimal places) used to record a shoot location, match you with a nearby photographer, or tag delivered work. Precise location is only collected with your device permission and you can withdraw it at any time in your device settings.
E. Identifiers, Purchases and Device Information
We collect account-level identifiers (such as your user ID, screen name or customer number) and device-level identifiers (such as a device ID or advertising identifier) to keep you signed in, secure your account and detect fraud. We also keep a record of your purchases and purchase history, including bookings, add-ons and subscriptions.
F. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to collect information about your use of our website for analytics, functionality, and advertising purposes. For more details, see our Cookie Policy.
2. How We Use Your Information
We may use your information to:
- Provide, operate, and improve our services (including photography & videography bookings and content delivery)
- Communicate with you about your bookings, account, or our services
- Process payments (via Stripe and other secure processors)
- Send you marketing communications (where permitted by law, and with your consent where required)
- Analyze website usage to improve user experience and our services
- Comply with our legal and regulatory obligations
- Protect our rights, users, and property
- Respond to your inquiries and provide customer support
3. Legal Bases for Processing (EU/EEA Users)
We process your personal data only where we have a lawful basis to do so, including:
- Contract: To provide our services or perform a contract with you
- Consent: Where you have given your explicit consent (e.g., marketing, use of cookies, or sensitive photos)
- Legal obligation: Where required by law (e.g., tax, AML/CTF compliance)
- Legitimate interests: For operational purposes that do not override your rights (e.g., analytics, service improvement, fraud prevention)
4. How We Disclose Your Information
We may share your information with:
- Service providers and partners (such as Stripe for payment processing, cloud hosting, analytics providers, email/SMS tools) who help us operate and improve our business. These providers are contractually bound to safeguard your data. Section 5 names every one of them, what each can access, and where it runs.
- Legal and regulatory authorities when required to comply with the law or respond to valid requests.
- Potential buyers or investors in the event of a merger, acquisition, restructuring, or business sale (subject to confidentiality protections).
- Other users, where your information (such as images or testimonials) is shared publicly with your consent.
We will not sell or rent your personal information to third parties for their marketing purposes.
5. Where Your Data Is Stored and Who Processes It
Every image you or your clients upload is written to Amazon S3 in the Asia Pacific (Sydney) region and stays there. There is no cross-region replication and no offshore backup copy of client images. Running the platform takes more than storage — delivery, payments, email and diagnostics — and some of those services run overseas. This section names all of them, what each can access, and where it runs.
5.1. Primary storage
| Detail | Value |
|---|---|
| Provider | Amazon Web Services |
| Service | Amazon S3 |
| Region | ap-southeast-2 |
| Location | Sydney, Australia |
| Replicated to | No other region |
| Access | Private bucket, signed URLs only |
Original files, derivatives and thumbnails are all held in this bucket.
5.2. Two tiers: what holds photos, and what does not
The distinction that matters is not which country a company is headquartered in. It is which systems can actually see your images.
- Tier 1 — image storage, Australia only. Original files, derivatives and thumbnails are written to a private Amazon S3 bucket in Sydney (ap-southeast-2). No cross-region replication, no offshore backup copies.
- Tier 2 — supporting services, mixed regions. Delivery, billing, email and diagnostics. Most of these never touch image data at all — they handle addresses, payment tokens and page events. The exception is our content delivery network, which caches delivered images at edge locations worldwide so galleries load quickly. Those cached copies expire; the originals never leave Sydney.
5.3. Subprocessors
Every third party that processes data on our behalf, what we use it for, what it can access, and where it runs:
| Service | Purpose | Data it can access | Region |
|---|---|---|---|
| Amazon S3 | Image and file storage | Client images, galleries, file metadata | Sydney, Australia |
| Cloudflare | Content delivery and gallery loading | Images in transit and cached at edge nodes; cached copies expire and originals never leave Sydney | Global edge network |
| Stripe | Payments and payouts | Name, email, billing address, transaction records. Card numbers go directly to Stripe — we never hold them | United States |
| Ventra IP | Transactional and marketing email | Recipient name and email address, message contents, gallery links, subscription status, open and click events | Australia |
| PostHog | Error tracking and product analytics | Error traces, page events, account ID, IP address | United States |
| Google Analytics and Google Tag Manager | Marketing site analytics and advertising measurement | Page views, referrer, approximate location. Marketing pages only — not inside client galleries | United States |
| Sujan Studio analytics | In-house usage reporting | Gallery views, downloads, account activity | Sydney, Australia |
We publish this list rather than supplying it on request. Changes to it are announced at least 30 days before they take effect.
5.4. International transfers
As the table shows, some of your information is processed or stored outside Australia, including in the United States, and our content delivery network caches gallery images at edge locations worldwide. Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with Australian Privacy Principle 8, and where we transfer data outside the EEA we implement the safeguards required by law (for example, Standard Contractual Clauses or adequacy decisions).
6. Data Retention
We retain your personal information only as long as necessary for the purposes described in this Privacy Policy, or as required by law (e.g., for tax or regulatory reasons). When no longer needed, we securely delete or anonymize your data.
7. Your Rights and Choices
Depending on where you reside, you may have the following rights:
- Access: Request access to the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete data.
- Deletion: Request erasure of your data (subject to certain exceptions, such as legal requirements).
- Restriction: Request restriction or object to our processing of your data in certain circumstances.
- Data Portability: Request to receive your data in a machine-readable format and transfer it to another provider.
- Withdraw Consent: Where we rely on your consent, you may withdraw it at any time (e.g., for marketing, cookies, or use of images).
- Lodge a Complaint: In the EU/EEA, you have the right to complain to your local data protection authority. In Australia, you may contact the OAIC.
To exercise your rights, please contact us using the details below.
8. Children's Privacy
We do not knowingly collect or process personal information from children under the age of 16 without parental consent. If you believe we have collected such data, please contact us so we can delete it.
9. Security
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, loss, misuse, or alteration. All payment information is processed securely via PCI DSS-certified providers (e.g., Stripe).
Despite our efforts, no online platform is 100% secure; please take care with your information.
10. Cookies & Tracking Technologies
We use cookies and similar technologies to personalize your experience, analyze usage, and provide targeted advertising. For details on the types of cookies used, your choices, and how to manage them, please see our Cookie Policy.
11. Links to Other Websites
Our website may contain links to third-party sites or services not controlled by us. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party websites you visit.
12. Changes to This Privacy Policy
We may update our Privacy Policy from time to time. Any changes will be posted on this page with the updated "Last updated" date. If changes are significant, we will provide a more prominent notice (such as email notification).
13. Our Mobile Apps and App Store Data Disclosure
This Privacy Policy covers the Sujan Studio mobile applications, including our iOS app, as well as our website. The table below mirrors the App Privacy declaration we file with Apple on the App Store. It lists every category of data our apps collect, whether it is linked to your identity, and why we collect it. We do not use any of this data to track you across apps and websites owned by other companies, and we do not use it for third-party advertising.
| Data type | What it covers | Why we collect it | Linked to you |
|---|---|---|---|
| Name | First and last name | App functionality, bookings, deliveries and support | Yes |
| Email address | Your email address, including in hashed form | Account access, transactional email, support | Yes |
| Phone number | Your phone number, including in hashed form | Booking confirmations and shoot-day contact | Yes |
| Physical address | Home, billing, mailing and shoot addresses | Billing, travel planning and delivery of physical items | Yes |
| Other contact information | Any other way you ask us to reach you outside the app | Support and shoot coordination | Yes |
| Payment information | Form of payment and transaction records held by Stripe on our behalf | Processing bookings, deposits, refunds and payouts | Yes |
| Precise location | Latitude and longitude accurate to three or more decimal places | Shoot locations, nearby photographer matching, geotagging. Device permission required | Yes |
| Coarse location | Approximate location, such as suburb or city | Showing relevant coverage, pricing and travel fees | Yes |
| Photos or videos | Images and video you upload or that are delivered to you | The core service: capture, editing, galleries and delivery | Yes |
| Customer support content | Anything you send us in a support request | Answering and resolving your request | Yes |
| Other user content | Briefs, shot lists, notes, reviews and other content you create | Running your booking and improving delivery | Yes |
| Browsing history | Content you viewed that is not part of the app | Understanding how people arrive at and move through our service | Yes |
| Search history | Searches you perform in the app | Returning relevant results and improving search | Yes |
| User ID | Account ID, screen name or customer number | Signing you in, securing your account, linking your work to you | Yes |
| Device ID | Device-level identifier, including the advertising identifier | Session security, fraud prevention and diagnostics | Yes |
| Purchases | Your purchase history and purchase tendencies | Billing, receipts, and understanding what customers book | Yes |
| Product interaction | App launches, taps, screen views and other in-app activity | Analytics and improving the product | Yes |
| Other usage data | Any other data about your activity in the app | Analytics and improving the product | Yes |
| Crash data | Crash logs | Finding and fixing faults | Yes |
| Performance data | Launch time, hang rate and energy use | Finding and fixing faults | Yes |
| Other diagnostic data | Any other technical diagnostics | Finding and fixing faults | Yes |
| Other data | Any data type not listed above that you choose to provide | Whatever you provided it for, as described in this policy | Yes |
"Linked to you" means the data is associated with your account. We do not collect credit information, other financial information, the contents of your emails or text messages, audio recordings, gameplay content, advertising data, environment scanning data, or body, hand or head movement data.
13.1. Tracking
We do not track you, as Apple defines tracking. We do not link the data collected in our apps with third-party data for advertising or advertising measurement, and we do not share it with data brokers.
13.2. Device permissions
Our iOS app asks for access to your camera, photo library, location and notifications. Each is optional, each is requested at the point it is first needed with an explanation of why, and each can be revoked at any time in iOS Settings. Revoking a permission disables the feature that relies on it but does not close your account.
13.3. Deleting your account
You can request deletion of your account and the personal information associated with it from within the app, or by contacting us using the details below. We will delete or de-identify your data except where we are required to keep records by law, such as for tax and financial reporting.
14. Contact Us
If you have any questions about this Privacy Policy, wish to exercise your rights, or have a privacy concern or complaint, please contact us at: