Privacy policy for clients
You were photographed by a photographer who uses FrameDrop. This page says what data about you exists because of that, who is responsible for it, and what you can do about it. It is written for the person in the photos. Photographers have their own policy.
Last updated: 27 September 2026 (the version of 25 September). This policy is issued by Magic Image Solutions LLC, a Delaware limited liability company (8 The Green, Suite A, Dover, DE 19901) (“FrameDrop”, “we”), which operates FrameDrop and Magic Gallery. Contact: framedroppro@gmail.com. [EU representative under GDPR Art. 27: name and address to be appointed.] [UK representative: to be appointed.]
1. Who is responsible for what
Two parties handle your data, in different roles.
| Data | Who decides why and how (controller) | Who acts on instructions (processor) |
|---|---|---|
| The photos of you, the name, email or phone number you gave the photographer, your delivery | The photographer, who took the photos and delivers them to you | FrameDrop, which stores and delivers them on the photographer's instructions |
| What you do on this site (opening a gallery, buying), your orders and payments, emails this site sends you, the technical logs of the site | FrameDrop | Our service providers (section 6) |
| Payment card details | Stripe, as an independent controller for fraud and payments | — |
For anything about the photos themselves, or about being photographed, the photographer is the first person to ask. We help you reach them and we act on your deletion request ourselves (section 8) whoever you send it to. If your photographer closes their FrameDrop account, FrameDrop takes their place as the controller of the sessions you paid for and received (section 8).
2. What we hold about you
- Photos. The photos the photographer delivered to you, a reduced watermarked preview of each, and the album's cover. They carry the camera's metadata (time, camera settings); location is not embedded by the camera link.
- Contact. The email address or phone number you typed at the sale or on this site, your first name if you gave it, the language your phone was set to, and your country as inferred from the photographer's location at the sale.
- Orders. What you bought, when, the price, currency and the last four digits of the card, the Stripe payment identifier, and the delivery links shown to you. Your full card number never reaches us.
- Your choices. Which photos from your photoshoot you chose and which you didn't: the choices you made in person at the shoot, on the photographer's phone, and the ones you make on this site.
- Site logs. When a gallery link was opened, from what kind of device and browser, the IP address for up to 30 days, and which downloads were taken. We use a cookie-free page; the only value stored in your browser is the gallery's own state, so the page remembers which photos you picked.
- Page counts. What happens on gallery pages, counted as daily totals per gallery: pages opened (and whether on a phone, a tablet or a computer), photos opened, photos put in the cart, checkout steps, downloads, and time on the page and how far down it was read, in broad ranges. Nothing in these totals identifies you or your device, and nothing is stored in your browser to make them.
- Emails. Whether a delivery or gallery email was sent, delivered, opened or bounced, and whether you unsubscribed.
We do not build a profile of you, we do not track you across other sites, and we do not buy data about you.
3. Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Showing you your gallery and delivering the files you received or bought | Performance of the contract with you (the purchase) and, for the photographer's delivery, the photographer's legal basis, which is normally the contract between you and the photographer or the photographer's legitimate interest in delivering what was sold |
| Taking payment, issuing receipts, keeping tax and accounting records | Contract; legal obligation |
| Sending the delivery email and the “your gallery is online” email | Contract |
| Follow-up emails from the photographer about your photos (a few, with an unsubscribe link) | Legitimate interest of the photographer in offering the rest of your photos, balanced by the one-click unsubscribe; consent where the law where you live requires it |
| Keeping the site secure, preventing fraud and abuse, and fixing errors | Legitimate interest |
| Licensing the photos from your photoshoot, and your choices, to other companies for AI training, only if you said yes (section 5) | Consent, which you can withdraw at any time |
| Improving how galleries work, using aggregated statistics that do not identify you | Legitimate interest |
| Answering you when you write to us; handling a complaint or a legal claim | Legitimate interest; legal obligation |
We do not use your data for advertising, we do not sell it except as licensing you have said yes to (section 5), and we do not share it for anyone else's marketing. If that ever changes, we will ask you first.
4. Face data
The photographer's app can group the day's photos by face so they can find yours quickly on the spot. This runs entirely on the photographer's phone using the face-detection features built into iOS. The numbers it produces are kept on that phone only, are deleted when the photos are deleted from the phone, and are never uploaded to us, never linked to your name, and never used to recognise you anywhere else. The photographer can switch grouping off, and must do so where the law requires your written consent for it (for example Illinois, Texas and Washington in the United States, and the EU where consent is not in place). We do not create or hold biometric identifiers of you.
5. Your photos are licensed only if you say yes
Your photos are used to show and deliver them to you, and, if you buy them, to make what you bought. They are not used to train models, not licensed to third parties and not used in advertising, unless you say yes to the Data Licensing Agreement by ticking the separate, unticked box on your gallery's first page. Saying no changes nothing about your gallery. Merchandise showing you is offered only to you.
If you say yes, it covers your photoshoot: the photos of you from it, and your choices, meaning which photos you chose and which you didn't, both in person at the shoot and on this site. It never includes your name, email, phone number, payment details, precise location or any measurement of your face. In return, we keep your gallery online free for 1 year. You can withdraw at any time on your gallery's page: your photos go into no new licence after that, and companies that already hold them must delete them within 30 days; the free hosting stays.
6. Who we share data with
Only service providers acting on our instructions, under contracts that bind them to protect it, plus the photographer for their own delivery.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and the site's server functions | United States |
| Cloudflare | Serving this site (Pages) and storing photos and previews (R2) | Global network; storage in the United States and EU |
| Hetzner | Rendering previews and watermarked images | Germany |
| Stripe | Payments, receipts, fraud prevention | United States and EU |
| Resend | Sending the emails described above | United States |
| Apple | The photographer's app runs on iPhone; AirDrop deliveries go device to device and do not pass through us | — |
| GeoNames | Naming a gallery after the place it was shot: our server sends the approximate location of the shift, never a photo or a name | Switzerland |
We may also disclose data when the law requires it, to protect someone's safety, or to a successor if our business is sold, who takes it under this policy.
7. International transfers
FrameDrop is in the United States and some providers are there too. For people in the EU, EEA, UK and Switzerland we transfer data under the European Commission's Standard Contractual Clauses (and the UK Addendum) with each provider, and, where a provider is certified, under the EU-U.S. Data Privacy Framework. You can ask us for a copy of the clauses we rely on.
8. How long we keep it, and deleting
- Galleries and photos: a gallery stays online for the period in section 2 of the Terms, the period you paid to keep it, or any period we expressly agreed with you (such as the free year under the Data Licensing Agreement). When that ends the gallery goes offline, but we keep its photos and previews so that it can come back, until you ask us to delete them (below) or the photographer closes their FrameDrop account. The photographer cannot delete a gallery once it is online. A session you paid for and received is not deleted when the photographer closes their account: it stays for you on the same terms, without the photographer's name, until you ask us to delete it.
- Your contact details: as long as the gallery exists or until you unsubscribe and ask for deletion.
- Order records: as long as tax law requires (up to 10 years depending on the country), without your email address once you ask for deletion.
- Site logs: 30 days. Page counts: kept as totals, which identify no one. Email logs: 12 months.
- Backups: roll off within 14 days of a deletion.
To delete everything: reply DELETE to any email from the photographer, use the delete button on the unsubscribe page, or write to framedroppro@gmail.com. It is done within 24 hours and cannot be undone; the photographer's phone is told to delete its copies too.
9. Your rights
Depending on where you live you can ask to see the data we hold about you, correct it, receive a copy in a portable form, have it deleted, restrict or object to how it is used, and withdraw a consent you gave. Write to framedroppro@gmail.com; we answer within one month (EU) or 45 days (US), and we may ask you to confirm you own the email address concerned. We will not treat you differently for exercising a right. If you are in the EU, EEA or UK you may complain to your data protection authority. If you are in California or another US state with a privacy law: we do not sell or share your personal information for cross-context advertising, we do not use it for profiling with legal effects, and you may appeal a decision on a request by replying to our answer.
10. Children
This site does not create accounts and is not directed at children. A parent or guardian may receive and buy a child's photos and may exercise the child's rights above. If you believe a child's data was collected in a way that needs a parent's consent and none was given, write to us and we will delete it.
11. Security
Photos are served through links that expire within an hour and are refreshed each time the page opens; downloads through links that expire in seven days. Data is encrypted in transit and at rest with our providers; access inside FrameDrop is limited to what running the service needs. No method is perfectly secure. If a breach affects you and the law requires it, we will tell you and the authority without undue delay.
12. Changes and contact
If this policy changes in a way that matters, the date at the top changes and the change is described here. Questions, requests and complaints: framedroppro@gmail.com, Magic Image Solutions LLC, a Delaware limited liability company (8 The Green, Suite A, Dover, DE 19901).