Privacy Policy

FrameFlow is operated by Island Films X Photos LTD (trading as Island Films), registered in Cyprus under number HE458521 at Sotiraki Markidi 11, Elysia Park Block 10, Flat 402, 8036 Paphos, Cyprus ("we", "us"). We're a small studio and we treat your data the way we'd want ours treated. This policy explains what we collect, why, and what rights you have under the EU General Data Protection Regulation (GDPR).

Two kinds of data, two roles

• Your account and studio details (you, your team, your billing). For this, we are the controller and this policy applies directly.
• Your couples' and clients' data (names, emails, wedding details, contracts, invoices, files you put into FrameFlow). For this, your studio is the controller and we are your processor: we only handle it on your instructions, to run the service. Our Data Processing Addendum sets out those commitments and forms part of our Terms. If you are a couple with a question about your data, please contact the studio you booked; we'll help them answer you.

What we collect

• Account info: your name, email, studio name, and password (hashed by our authentication provider; we never see it).
• Studio data: what you put into FrameFlow, such as clients, leads, jobs, contracts, invoices, files and email templates.
• Signing records: when a couple signs a contract we store the time, their typed name and their IP address, so the studio has evidence of the signature.
• Usage data: aggregated page-view analytics via Vercel Web Analytics. It's cookieless and doesn't identify you or follow you across other websites.
• Error reports: when something breaks, Sentry receives technical details (browser, page, error message) so we can fix it.
• Email: messages you send through FrameFlow are delivered by Resend, which processes their content to deliver them.
• Calendar: if you connect Google Calendar, we read and write events in the calendars you authorise, to keep them in sync. We don't touch other calendars.
• Support messages: anything you send us through the Help button or by email.

Why we use it, and our legal basis

• To provide FrameFlow to you and your team: performance of our contract with you (GDPR Art. 6(1)(b)).
• To keep it secure, fix bugs and prevent abuse (rate limits, error monitoring, audit logs): our legitimate interest in running a reliable, safe service (Art. 6(1)(f)).
• To bill paid plans and keep accounting records: legal obligation (Art. 6(1)(c)) and contract.
• To tell you about important changes to the service, these terms or your account: contract and legitimate interest. We don't send marketing email without your consent, and you can opt out at any time.

We don't sell your data. We don't share it with advertisers. We don't use it to train AI models. If you ask us for support, we may look at your workspace to help you, and we'll tell you when we do.

Subprocessors

These services process personal data on our behalf to run FrameFlow:

• Supabase: Database, file storage and sign-in (EU (Stockholm))
• Vercel: Application hosting and cookieless page analytics (EU / USA)
• Resend: Delivery of email sent from FrameFlow (USA)
• Sentry: Error monitoring, so we can fix bugs (EU (Germany))
• Stripe: Card payments, only if a studio connects Stripe (EU / USA)
• Google: Calendar sync, only if a studio connects Google Calendar (EU / USA)
• Zoho Books: Invoicing studios for paid plans (EU)

We'll update this list before adding a new subprocessor and, for paying studios, give notice by email as described in the DPA.

International transfers

Our database lives in the EU. Some subprocessors above are based in, or may access data from, the USA. Where that happens, the transfer is covered by the EU-US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.

Cookies

We only use cookies that are strictly necessary: the sign-in session cookie that keeps you logged in, and similar security cookies. We don't use advertising or tracking cookies, so there's no cookie banner. Your theme, and whether the app sidebar is collapsed, are remembered in your own browser.

Retention

We keep your data while your workspace is active. You can export your workspace from Settings at any time. Deleting it yourself from Settings removes it immediately and can't be undone. If you ask us to close your account instead, we keep an exported copy available for 60 days in case you change your mind, then delete it. Backups roll off within 90 days. Billing records are kept for as long as Cypriot tax law requires.

Security

Data is encrypted in transit and at rest. Integration tokens (Google Calendar and the like) are encrypted at the application layer with a key we control. Workspace data is isolated at the database level so one studio can never see another studio's records. If we become aware of a personal data breach affecting you, we'll tell you without undue delay.

Your rights

You have the right to access, correct, export, or delete your personal data, to object to or restrict how we use it, and to withdraw any consent you've given. Most of this you can do yourself in Settings; for anything else email hello@stratex.studio and we'll respond within one month.

If you're unhappy with how we've handled your data, you can complain to the Commissioner for Personal Data Protection (Cyprus), or to the data protection authority where you live. We'd appreciate the chance to put it right first.

Children

FrameFlow is for businesses. It's not for anyone under 18.

Changes

If we change this policy materially we'll email you. The "last updated" date above always reflects the current version.

Contact

Questions, or a request about your data? Email hello@stratex.studio.