SessionFlow

Legal

Privacy Policy

Last updated 11 September 2026

SessionFlow LLC ("SessionFlow," "we," "us," or "our") provides workflow technology for professional photography sessions. This Privacy Policy explains how SessionFlow collects, uses, stores, discloses, and protects personal information through our websites, desktop application, accounts, participant registration and gallery experiences, support channels, and related services.

1. Scope and Roles

Photographers and photography businesses use SessionFlow to run sessions and decide why participant information is collected and how it is used for their photography services. SessionFlow processes participant and session information to provide those workflows.

SessionFlow also determines certain purposes for processing information needed to administer SessionFlow itself, including account management, billing, security, fraud prevention, support, infrastructure, product analytics, legal compliance, and service improvement.

The legal characterization of these roles may vary by activity and jurisdiction. Nothing in this Policy is intended to eliminate responsibilities that applicable law places on either SessionFlow or the photographer.

2. Information We Collect

Depending on how SessionFlow is used, we may collect or process the following categories.

Account and Identity Information

Name, email address, authentication information, account identifiers, business or studio information, and information from supported sign-in providers such as Google.

Participant and Session Information

Participant names, email addresses, phone numbers where provided, schedules, notes, custom fields, session relationships, consent choices, consent timestamps and versions, gallery settings, and related workflow information.

Photographs, Files, and Image Metadata

Photographs and image derivatives where cloud features are enabled, gallery variants, uploaded originals where enabled, export archives, support attachments, filenames, paths, labels, ratings, participant assignments, EXIF or other asset metadata, and image-processing state.

Face-Detection Metadata

Current Paid Beta does not perform facial recognition, person identification, or biometric identity matching. Certain on-device functions may detect whether a face is present and store display-space face bounding coordinates for crop or avatar presentation. These functions do not identify the person or compare the face to a known identity.

Billing and Commerce Information

Subscription plan, invoice and payment status, purchase totals, Stripe identifiers, connected-account information for enabled participant commerce, and related transaction metadata. Complete payment-card data is handled through Stripe-hosted payment interfaces and is not stored directly by SessionFlow.

Communications and Support Information

Emails and messages sent through SessionFlow, sender and recipient information, delivery status, customer-authored support descriptions and feature requests, support attachments, and related support records.

Technical, Device, Log, and Analytics Information

Application version, device identifiers, operating-system and app context, IP address where collected, user agent, performance information, event and telemetry data, errors, stack traces, session/account identifiers, filenames in some logs, request and structured operational events, and other information used to operate, secure, diagnose, and improve the Service.

Integration Information

Information received through integrations you choose to use, such as Google OAuth sign-in information. SessionFlow does not currently use the Google Calendar API. Calendar subscription features are generated by SessionFlow through ICS feeds.

3. How We Use Information

We use personal information to:

  • create and administer accounts;

  • register and manage photography sessions and participants;

  • associate photographs and workflow records with the correct session or participant;

  • provide galleries, selections, retouch workflows, exports, and image delivery;

  • send authentication, session, gallery, delivery, billing, and other operational communications;

  • process subscriptions and, where enabled, participant purchases;

  • provide customer support and respond to privacy requests;

  • secure the Service, prevent abuse, investigate incidents, and enforce our agreements;

  • diagnose errors and measure performance;

  • improve and develop SessionFlow; and

  • comply with legal, tax, accounting, and regulatory obligations.

We do not sell participant personal information for money. We do not use participant information for targeted advertising.

4. Participant Consent and Promotional Use

The current participant Join flow separates necessary session processing from optional promotional use.

Required session consent covers the information and photographs reasonably necessary to manage the session, communicate about it, provide the gallery, and deliver images.

Promotional use is a separate optional choice. Declining optional promotional permission does not prevent an otherwise eligible adult participant from joining the session or receiving images.

During Paid Beta, the optional promotional permission is intended to grant rights to the named photographer only. It does not automatically grant promotional rights to an unnamed client, sponsor, or SessionFlow.

5. Communications and Tracking

SessionFlow uses AWS SES for operational and photographer-authored application emails. SessionFlow may use an open-tracking pixel in SES messages, which can record the opening request's IP address and user agent. SessionFlow does not currently rewrite SES links for click tracking.

SessionFlow also uses Customer.io for limited lifecycle communications such as Founding Photographer welcome and waitlist confirmations. Customer.io open and link-click tracking are currently enabled for those messages.

SessionFlow's built-in participant templates are designed primarily for session operations. Photographers may customize messages and are responsible for any consent or legal requirements that apply to their custom content. SessionFlow records and enforces opt-out status in the product. During the current Paid Beta, an opt-out may suppress all SessionFlow messages to that address rather than separating marketing and operational categories.

No SMS provider or SMS messaging workflow is currently active for Paid Beta.

6. How We Disclose Information

We may disclose personal information to:

  • the photographer or photography business running the session;

  • authorized team members or client administrators where the photographer has enabled those roles;

  • a person who has a valid gallery link where the photographer has configured an open or shareable gallery;

  • service providers that host, process, secure, deliver, analyze, or support the Service;

  • payment providers and connected accounts where needed to process subscriptions or participant purchases;

  • professional advisers, insurers, auditors, or transaction counterparties where reasonably necessary; and

  • government authorities or other parties when required by law, legal process, or to protect rights, safety, and security.

Photographers and their clients may retain copies of photographs and participant information outside SessionFlow. Their independent practices are governed by their own obligations and are not controlled by SessionFlow.

7. Current Service Providers and Infrastructure

SessionFlow currently uses service providers that may receive personal information as necessary to perform their functions. Current providers include:

  • Cloudflare, including Durable Objects with SQLite storage, D1, R2, Workers, Workers KV, Queues, Cloudflare for SaaS, Workers Logs, and related services, for workflow and control-plane data, authentication support, synchronization, object storage, application delivery, logging, custom domains, and supporting infrastructure;

  • Cloudflare Workers AI for limited internal support functions, such as generating titles for photographer-authored issue reports and feature requests. This workflow is intended for support text and does not send participant photographs or structured participant records to the AI model;

  • Amazon Web Services, including SES, Lambda, SQS, and EventBridge, for operational email and application workflows;

  • Google Cloud and BigQuery for telemetry and supporting infrastructure;

  • Sentry for error diagnosis;

  • Axiom for logs and observability;

  • PostHog for selected product analytics;

  • Customer.io for limited lifecycle messaging and related profile data;

  • Stripe for subscription billing and enabled participant commerce;

  • Google for OAuth authentication where used;

  • Linear for support and product-feedback workflows, including photographer-authored reports, feature requests, and attachments; and

  • Syncthing-related infrastructure for device discovery and encrypted file-transfer workflows.

Providers and technical architecture may change as SessionFlow evolves. We will update this Policy when a change materially affects how personal information is handled.

8. Data Location and Cross-Border Processing

SessionFlow is a United States company. Core production database and object-storage infrastructure is currently configured in Cloudflare's Eastern North America region. Supporting infrastructure is primarily configured in United States regions where available, including AWS us-east-1 for certain operational services.

Other service providers may process information in the United States or other jurisdictions where they operate.

If you are in Canada, including Ontario, your information may be transferred to, stored in, or processed in the United States or another jurisdiction where a SessionFlow service provider operates. Information processed in another country may be subject to that country's laws and lawful access requests. SessionFlow remains responsible for personal information under its control and uses service providers to perform functions on its behalf.

SessionFlow does not currently market the Paid Beta for UK or EEA production use. Additional terms, regional architecture, or data-processing agreements may be required before broader international expansion.

9. Local and Offline Storage

SessionFlow is a local-first desktop application. Participant and session records, workflow state, filenames and paths, metadata, settings, previews, caches, logs, and other application data may be stored on the photographer's device. The photographer's original session folders and image files may also remain in photographer-selected locations on that device or connected storage.

SessionFlow does not currently add separate application-level encryption to every local database, cache, preview, or side database. Local information therefore also depends on the security of the photographer's device, account, filesystem, and operating-system protections such as disk encryption.

Logging out clears active authentication state and certain caches, but it does not comprehensively erase all local session files, previews, logs, side databases, or photographer-selected image folders. A retired local database generation may be retained temporarily for recovery. Uninstalling the application does not currently guarantee removal of all Application Support data or photographer-selected session folders.

Photographers are responsible for securing their devices and local storage and for managing copies of participant information they retain outside SessionFlow's cloud systems.

10. Security

SessionFlow uses administrative, technical, and organizational safeguards appropriate to the nature of the Service and the information processed.

Core cloud storage uses provider-managed encryption at rest, including Cloudflare Durable Objects storage, D1, R2, and Workers KV. Public internet communications use encrypted protocols such as HTTPS or TLS. Certain local-network and device-to-device features use authenticated and encrypted application or file-transfer protocols.

Production administrative access is restricted to authorized SessionFlow development or operations personnel on a need-to-know basis. SessionFlow does not currently maintain one unified privileged-access audit log across every provider.

Local data also depends on the security of the photographer's device, filesystem, and operating-system protections.

No method of transmission, storage, or software operation is completely secure, and SessionFlow cannot guarantee absolute security.

11. Data Retention

SessionFlow retains information for as long as reasonably necessary for the purposes described in this Policy, to provide the Service, to satisfy legal or financial obligations, to resolve disputes, and to protect the Service.

Active Accounts and Sessions

Current Paid Beta session, participant, gallery, and related cloud records do not have a general automatic 180-day expiration. They can remain until the photographer or SessionFlow deletes them, subject to the rules below. Photographers should not rely on SessionFlow as permanent archival storage.

Trials, Cancellation, and Billing Lock

Starting or ending a trial, canceling a subscription, or entering a billing lock does not itself immediately delete underlying session or participant data. SessionFlow may maintain data to support account recovery, export, dispute handling, legal obligations, and orderly deletion. During Paid Beta, some retention and deletion steps are manual rather than fully automated.

Local Data

Local session files, caches, previews, and photographer-selected folders may remain on the photographer's device until the photographer removes them. Certain local logs and recovery data use shorter internal retention windows, but local source files are not automatically deleted by SessionFlow when an account is canceled.

Backups and Recovery Copies

Cloudflare currently provides a 30-day point-in-time recovery window for SessionFlow's Durable Objects SQLite storage and D1 database.

SessionFlow may also maintain limited migration or schema-change database exports in private storage for recovery and operational purposes. These copies may be retained outside the provider's 30-day point-in-time recovery window.

Cloudflare R2 object storage is not currently backed up through a separate SessionFlow backup process.

A deletion from live systems therefore may not immediately remove information from point-in-time recovery data or separately retained migration or recovery copies.

Legal, Billing, and Security Records

SessionFlow may retain billing, tax, consent, security, fraud-prevention, support, and legal records for longer periods where reasonably necessary or required by law.

12. Deletion and Privacy Requests

You may request access to, correction of, or deletion of personal information associated with you, subject to applicable law and reasonable identity verification.

Because SessionFlow is used by independent photographers, a participant request may require coordination with the photographer who controls the underlying session relationship. SessionFlow may refer or coordinate a request with that photographer where appropriate.

Deletion from SessionFlow does not necessarily delete copies independently retained by a photographer, client, recipient of an open-gallery link, or another party outside SessionFlow's control.

Deletion also may not immediately remove information from existing recovery copies, security logs, financial records, or local photographer-controlled devices. SessionFlow will handle residual copies according to applicable law, provider recovery cycles, legitimate retention needs, and this Policy.

Submit privacy requests to privacy@sessionflow.com.

13. Your Privacy Rights

Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or information about how personal information is used or disclosed.

We will verify and respond to requests in the manner and within the time required by applicable law. We will not discriminate against a person for exercising a privacy right that applies to them.

For Canadian users, including Ontario users, SessionFlow will handle requests in accordance with applicable Canadian privacy law, including PIPEDA where it applies. Consent for secondary purposes, such as promotional use, is treated separately from consent needed to provide the underlying session service.

14. Privacy Officer

SessionFlow has designated a privacy lead for Paid Beta.

Privacy Officer: Jason Bryant
Email: privacy@sessionflow.com

Questions or complaints about SessionFlow's privacy practices may be directed to the Privacy Officer. You may also have the right to contact the privacy regulator in your jurisdiction.

15. Security Incidents

If SessionFlow identifies a security incident involving personal information, we will investigate, take reasonable mitigation steps, and provide notices to affected individuals or authorities when required by applicable law.

16. Children and Minors

SessionFlow's current Paid Beta participant workflow is intended for participants 18 years of age or older. Photographer and business account holders must also be 18 or older.

SessionFlow does not currently provide a guardian-consent workflow for known minor participants. Photographers must not knowingly use the current Paid Beta participant workflow for a person under 18. SessionFlow intends to evaluate a dedicated guardian-consent and child-privacy workflow before intentionally supporting minor participants.

17. Changes to This Policy

We may update this Policy as SessionFlow evolves. If a change materially affects how we handle personal information, we will provide notice or request renewed consent where required by applicable law.

18. Contact

Privacy: privacy@sessionflow.com
Legal: legal@sessionflow.com
General support: support@sessionflow.com