Legal
Privacy Policy
ShootPick is software for event photographers. This policy explains what we collect, why, and what you can ask us to do with it. It covers shootpick.com, the app at app.shootpick.com, and the galleries and pick screens photographers run on ShootPick.
ShootPick is operated by ND Management Holding B.V. ("we", "us"). Questions go to privacy@shootpick.com.
Two kinds of people
Photographers sign up and run their studio on ShootPick. For their account data, we decide how it is used.
Sitters are the people photographed at an event. Their photos and email address belong to the photographer who ran the event. We store and process them on the photographer's behalf and only to provide the service to that photographer. If you were photographed, the photographer is your first point of contact. You can also write to us and we will pass your request on or help directly.
What we collect from photographers
- Account: your email address. If you sign in with Google, also your name and profile picture from your Google account. We never see your Google password.
- Studio settings: studio name, subdomain, logo, brand colour, reply-to address, Google review link, email sign-off and tether preferences you enter during setup.
- Sign-in records: when you last signed in and which method you used. When you ask for an email sign-in link we keep a short record so we can limit requests to one a minute.
- Billing: when paid plans launch, payments will be handled by our payment provider. We will not store full card numbers.
Support chat and the contact form
When you chat with Catie, our AI assistant, or send the contact form, we keep what you write, the email address you give us, the page you were on and, if you're signed in, your account email, studio name and plan. We use it to answer you and to improve our help. Chat messages are sent to Anthropic, which runs the AI model behind Catie, to write her replies; Anthropic does not use them to train its models. When Catie passes a conversation to a person, or you send the form, it is emailed to our support inbox. Email you send to support@shootpick.com is read by Catie too: she answers general questions herself (each reply says so) and passes account, billing and anything she isn't sure of to a person. We keep support conversations for up to two years; write to privacy@shootpick.com to have yours deleted sooner. The chat also stores the conversation in your browser so it follows you between pages; "Start over" in the chat clears it.
What we process for photographers about sitters
- Photos taken at an event, uploaded from the photographer's computer.
- The sitter's name if the photographer adds it, the email address the sitter types to receive their photo, and which photos they hearted and picked.
- Whether the sitter agreed to hear from the photographer again. This is unticked unless the sitter ticks it.
Galleries are private and hidden from search engines. Photos nobody picked are deleted a week after the event. Picked photos and galleries are deleted when the photographer's plan period ends: 30 days on Free, and 30 days to a year on paid plans, as the photographer chooses.
Google user data
If you choose "Continue with Google", ShootPick asks Google only for the basic openid, email and profile scopes. From those we receive your email address, whether Google has verified it, your name and your profile picture. We use them only to create your account, sign you in, and show your name and picture in the app. We do not ask for access to your Gmail, Drive, Calendar or contacts.
We do not sell Google user data, use it for advertising, share it with anyone except the hosting provider that stores your account, or use it to train AI models. ShootPick's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove ShootPick's access at any time at myaccount.google.com/permissions, and ask us to delete the data as described below.
Why we use it
- To sign you in and keep you signed in.
- To run the service: show photos on the pick screen, deliver picks by email, host galleries, and run the retouch queue.
- To send service email, such as sign-in links and delivery emails. We do not send marketing email without your consent.
- To keep the service secure and fix problems.
Under the EU General Data Protection Regulation (GDPR), our legal bases are: performing our contract with you (running your account and the service), our legitimate interest in keeping the service secure and working, and your consent where we ask for it. For sitters' data, the photographer is the controller and we are their processor.
We do not sell personal information, and we do not use photos to train AI models.
Cookies
The app sets one sign-in cookie that keeps you signed in for up to 14 days. During Google sign-in it also sets a short-lived cookie that lasts ten minutes and proves the sign-in was started by you. If you arrive through a partner's referral link (one ending in ?via= and their name), our affiliate service Rewardful sets cookies that remember which partner sent you for up to 90 days, so we can pay that partner a commission if you subscribe. We use no advertising cookies. Our pages load the Inter font from Google Fonts, which means your browser contacts Google's servers.
If you join our affiliate program, we and Rewardful, which runs it for us, keep your name, email address, payout details and the referrals and commission linked to you, for as long as you're in the program and as long as tax and accounting law requires after that.
Trying ShootPick on your phone
On shootpick.com/try you take and pick photos in your browser, and those photos stay on your phone. When you ask for your pick, we upload that one photo. Either you text us a short code from your phone, and we send the photo back to that number by iMessage through Sendblue, or we send a confirmation link to the email address you give us and send the photo there through Postmark only after you tap it. If you text us anything else, our AI assistant may reply or pass your message to our team. If nobody confirms, the photo is deleted within three days. We keep your first name, number or email, whether you said you're a photographer (and, if you answer them, what you shoot, how often and where), and where you came from (such as a partner's link), and, because you ticked the box asking for it (getting your photos depends on it), we may send you headshot tips and ShootPick news by text and email. We only do that once you've texted us or confirmed your address. Our legal basis is your request to receive the photo and your consent, which you can withdraw at any time by replying STOP, using the unsubscribe link or writing to privacy@shootpick.com. The photo is deleted after 30 days and your details after two years.
Who helps us run ShootPick
| Provider | What for | Where |
|---|---|---|
| Netlify | Hosting the website and app, and storing account, studio and event data | United States |
| "Continue with Google" sign-in and web fonts | United States | |
| Postmark (ActiveCampaign) | Sending sign-in, delivery and support emails | United States |
| Sendblue | Texting your headshot by iMessage when you try ShootPick on your phone | United States |
| Anthropic | The AI model behind Catie, our support chat | United States |
These providers process data only to provide their service to us. Because they are in the United States, your information may be transferred there. We rely on the EU-U.S. Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses otherwise.
How long we keep it
- Account and studio data: for as long as you have an account, then deleted within 30 days of closing it.
- Photos nobody picked: a week after the event. Picked photos, galleries and sitter details: 30 days on Free, or the period the photographer chooses on a paid plan (up to a year).
- Sign-in link records: a few minutes to a day.
Your choices and rights
You can ask to see, correct, export or delete your personal information. Write to privacy@shootpick.com and we will answer within 30 days. You can also object to processing, ask us to restrict it, or withdraw consent you gave. If you are unhappy with our answer, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority where you live. Photographers can edit their studio settings themselves at any time. Sitters can ask the photographer, or us, to delete their photos and email address.
Security
Everything is served over HTTPS. Sign-in links work once and expire after 15 minutes, and sessions are signed so they cannot be forged. Each studio's data is kept separate from every other studio's.
Children
ShootPick is for businesses. Photographers are responsible for getting a parent's or guardian's consent before photographing children at their events.
Changes
If we change this policy in a way that matters, we will update the date above and tell account holders by email before the change takes effect.