Privacy Policy

Depending on how you use Rooted Sessions, we may collect the following types of information.

Account Information. When you create an account, we may collect information such as your name, business name, email address, phone number, password, and other information necessary to create and maintain your account.

Client Information. Photographers using Rooted Sessions may enter information about their own clients into the platform. This may include names, email addresses, phone numbers, addresses, event details, questionnaires, contracts, invoices, session information, timelines, preferences, and other information the photographer chooses to collect.

Mobile Phone Numbers for Text Messaging. When you book a session or send an inquiry, you may be asked to provide your mobile phone number and to agree to receive text messages about your session. If you agree, the photographer you are working with may use that number to send and receive text messages about your session — such as booking confirmations, appointment reminders, session location and timing details, and planning questions — through Rooted Sessions. Message frequency varies, and message and data rates may apply from your mobile carrier. You can reply STOP to any message to stop receiving texts, or HELP for help.

Payment Information. Payments processed through Rooted Sessions may be handled by third-party payment providers, including Stripe. Rooted Sessions does not directly store complete credit card or debit card numbers. Payment providers may collect and process payment information according to their own privacy policies and terms.

Content You Provide. We may collect information, files, documents, images, questionnaires, forms, notes, and other content that you or your clients upload, submit, or otherwise provide through the Service.

Gallery and Website Content. This includes uploaded photographs and videos; file information such as filenames, sizes, and available capture dates; gallery titles, sections, covers, access settings, and expiry dates; and photographer branding, biographies, portfolio photographs, and guide links. Event planning records may include information about other people, such as wedding party members, vendors, and emergency contacts.

Usage and Technical Information. We may automatically collect certain information about how the Service is accessed and used, including IP address, browser type, device information, operating system, pages or features accessed, and general usage information.

We use information collected through Rooted Sessions to:

• Provide, operate, and maintain the Service
• Create and manage user accounts
• Facilitate bookings, contracts, questionnaires, invoices, payments, and client communication
• Provide client portals and other features requested by photographers
• Send transactional communications, such as account notifications, booking updates, and — where a client has given consent — text messages about their session
• Send and receive text messages on behalf of photographers who have enabled texting, using the mobile numbers clients provided with their consent
• Improve the functionality, security, and performance of the Service
• Troubleshoot technical issues
• Detect, prevent, and address fraud, abuse, or security incidents
• Comply with legal obligations
• Communicate with users about the Service and important account-related matters

We do not sell personal information. We also do not use client information submitted by photographers for our own independent marketing purposes.

Rooted Sessions is designed to allow photographers and businesses to manage their own client relationships.

If a photographer enters information about a client into Rooted Sessions, the photographer generally determines what information is collected and how that information is used. In these circumstances, Rooted Sessions acts as a service provider or data processor on behalf of the photographer or business.

Questions about why a photographer collected your information, who can see their gallery, or requests to remove a photograph should generally be directed to that photographer first. You may also contact us, even if you have never created an account. We will explain when the photographer's involvement is needed and assist with requests as required by applicable law.

We may process this information only as necessary to provide the Service, fulfill our contractual obligations, maintain security, comply with the law, or as otherwise permitted by applicable law.

We may share information with trusted third-party service providers that help us operate Rooted Sessions. These providers may assist with services such as:

• Payment processing
• Cloud hosting and data storage
• Email and communications
• Text message (SMS) delivery
• Authentication and account management
• Analytics and error monitoring
• Customer support
• Security and fraud prevention
• AI-assisted document reading and drafting, when those features are used

These providers are permitted to access information only as reasonably necessary to provide services to us and are expected to handle information in accordance with applicable privacy and security requirements.

Services used include Lovable Cloud for managed application services, storage, authentication, and email; Stripe for payments and payouts; Quo or Twilio for texting, depending on the configured connection; and Lovable's AI service for AI-assisted features, including tasks configured to use Google Gemini or Anthropic Claude models. Each receives the information needed for the relevant feature. Connected services and linked or embedded content, such as Pinterest boards or externally hosted guides, may also process information under their own privacy policies when you use them.

We may also disclose information when required by law, legal process, court order, or governmental request, or when reasonably necessary to protect the rights, safety, security, or property of Root & Return, our users, or others.

If Root & Return is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, information may be transferred as part of that transaction, subject to applicable law.

Rooted Sessions uses Stripe for photographer subscriptions, client payments, and connected photographer payment accounts. Stripe may collect payment details and information needed to verify a connected account and provide payouts. We retain payment-related records such as invoice amounts, payment status, transaction references, and subscription status, but do not store full payment card numbers. Stripe's handling of personal information is governed by its own privacy practices and policies.

Rooted Sessions uses browser storage and similar technologies to keep users signed in, remember preferences and drafts, and support features such as gallery access and favourites. Hosting and service providers may also process technical information needed for security, delivery, and service operation.

You may be able to control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service.

We retain personal information for as long as reasonably necessary to provide the Service, maintain user accounts, fulfill contractual obligations, resolve disputes, comply with legal obligations, enforce our agreements, and protect our legitimate business interests.

Payment trouble or subscription cancellation does not delete a photographer's photographs, videos, or studio records. We retain these originals for at least 12 months after paid access ends, unless the photographer explicitly requests deletion. Shared galleries remain viewable and downloadable for at least 90 days after paid access ends, subject to the photographer's publication, password, expiry and download settings. Account records and gallery originals can be exported from Account Settings without a paid subscription. This is retention of existing data, not a separate backup service or continued access to other paid features. Gallery expiry does not itself delete its files, and data is not automatically destroyed when the minimum retention period ends.

Before any platform-initiated removal of retained photographs after that protection period, we will give the photographer at least 30 days' notice by email. Subscription lapse alone does not currently trigger automatic removal. This notice rule does not postpone an owner's explicit deletion request or override legally required removal of unlawful material.

When you request account deletion in Account Settings, your account and new access to shared photographer pages are hidden. You have 30 days to sign in and cancel the deletion request. After that window, permanent cleanup removes uploaded files and removable account and studio records; cleanup runs daily and large accounts or unsuccessful attempts may require additional runs. Explicit deletion follows this recovery window rather than the subscription-lapse protection periods; restore the account within that window if you need to export retained content. Restoring an account does not restart a cancelled subscription. Records controlled by another photographer, such as their agreement with you, may remain subject to their obligations and your applicable privacy rights.

Previously issued temporary media links may work until they expire, and copies already downloaded by viewers cannot be recalled. Removal from the active Service may not immediately remove provider backup copies, security logs, or records required for legal, accounting, or dispute-resolution purposes, including earned affiliate payment records. Such retained information remains subject to applicable protections and provider retention terms; we do not promise a 90-day provider backup or backup-erasure deadline.

We take reasonable administrative, technical, and organizational measures designed to protect personal information from unauthorized access, disclosure, alteration, or destruction.

However, no method of transmitting or storing information electronically is completely secure. We cannot guarantee absolute security of information transmitted to or stored through the Service.

Depending on where you live, you may have certain rights regarding your personal information, including the right to:

• Request access to personal information we maintain about you
• Request correction of inaccurate information
• Request deletion of certain personal information
• Request information about how your personal information is collected and used
• Object to or restrict certain processing
• Request a copy of certain personal information in a portable format
• Withdraw consent where processing is based on consent

Some rights may be subject to exceptions or limitations under applicable law.

If you are a client of a photographer using Rooted Sessions, certain information may be controlled by that photographer. In those cases, we may direct your request to the applicable photographer or ask you to contact them directly.

To exercise privacy rights that apply to information controlled by Root & Return, please contact us using the information below.

Accounts are intended for adults aged 18 or older; a parent or guardian may book on behalf of a minor. Children may appear in family photographs or in event information provided by a photographer or client. That is different from a child creating an account or submitting information directly to us.

If you believe a child under 13 has provided personal information directly to us, or you have a concern about a child's information or photograph, please contact us. We will review the request and involve the photographer where appropriate.

Rooted Sessions may be accessed by users located in different countries. If you access the Service from outside the United States, your information may be transferred to, stored, or processed in the United States or other locations where Root & Return or its service providers operate.

International processing remains subject to applicable data protection requirements. Where the law requires a transfer mechanism or additional safeguards, those requirements apply; using the Service does not waive your privacy rights.

Rooted Sessions may contain links to third-party websites, services, or integrations. We are not responsible for the privacy practices, content, or security of third-party services.

We encourage you to review the privacy policies of any third-party services you choose to use.

We may update this Privacy Policy from time to time to reflect changes to Rooted Sessions, our practices, or applicable legal requirements.

When we make material changes, we may provide notice through the Service, by email, or by updating the “Last Updated” date at the top of this Privacy Policy.

Where a change requires your consent under applicable law, we will seek that consent rather than treating continued use alone as consent.

When you book a session or send an inquiry through a photographer's booking page, you will see a notice asking whether you agree to receive text messages about your session. Your consent is recorded when you check that box, along with the time and the phone number you provided, so there is a record of your agreement.

Text messages are used for session-related communication only: booking confirmations, appointment reminders, session location and timing details, and planning questions between you and your photographer. They are not marketing messages, and photographers are not permitted to use the texting feature to send promotional or unsolicited messages.

You can opt out at any time by replying STOP to any text message, or reply HELP for assistance. Phone numbers, message content, and delivery information are processed by the photographer's connected texting provider, such as Quo, and telecommunications providers as needed to deliver messages. We do not sell mobile numbers or share SMS consent records with third parties for their own marketing. Message frequency varies, and message and data rates may apply. Withdrawing texting consent does not cancel your booking.

The photographer chooses the content and sharing settings of a gallery. We record when the gallery is first opened successfully and may notify the photographer. Favourites are associated with a browser identifier stored on your device; submitted comments include the author name and comment text. We also process access checks and requests to deliver or download media. These features do not require collecting a visitor email address or recording a separate view history for every photograph.

A shared link may be forwarded to other people. Passwords and other available access controls reduce access but cannot prevent an authorised viewer from copying or sharing content. Photographer websites and photographs deliberately selected for a public portfolio may be visible without an account.

If you appear in a photograph or a planning record, you can contact the photographer or us about access, correction, or removal, without having a Rooted Sessions account. We may request proportionate information to verify your identity and locate the relevant record, while protecting other people's information.

When a photographer chooses an AI-assisted import or drafting feature, relevant uploaded documents, text, and selected context are sent to the AI service needed to perform that task. This may include contracts, questionnaires, collection details, location guides, and client or event information contained in those materials. Import results and review drafts are stored so the photographer can review them before saving them into their studio or session records.

AI-generated results may be incomplete or inaccurate. Photographers are responsible for reviewing extracted information, contract fields, and drafted messages before using or sending them, and for having permission to submit the underlying information. Using ordinary booking or gallery viewing features does not require using an AI-assisted import.

Where applicable, California residents may have rights to know about the categories, sources, purposes, and recipients of personal information; access, correct, or delete it; and receive equal treatment when exercising their rights. We do not sell personal information. An authorised agent may submit a request subject to appropriate verification.

Where EU or UK data protection law applies, processing may be based on performing a contract, legitimate interests such as service security and operation, legal obligations, or consent for activities that require it. Your rights may include access, correction, deletion, portability, restriction, objection, and withdrawal of consent without affecting earlier lawful processing. You may also lodge a complaint with your local data protection authority.

These rights depend on applicable law and may be limited by the rights of others and legal retention requirements. Contact us using the details below to submit a request or ask which rights apply.

If you have questions about this Privacy Policy or our privacy practices, please contact:

Root & Return Co
Rooted Sessions
Email: rooted.sessions.crm@gmail.com