Privacy Policy

Information we collect

• Account information — your email, password (stored hashed by our auth provider), and any display name or profile details you add.
• Your content — photos, video, album/tag organization, portfolio text, and other material you upload or create.
• Client & booking information — when your clients book or message you, we process the name, email, phone, and notes they provide, and any proofing favorites or comments they leave on your galleries. Where SMS is enabled, messages between you and a client may be relayed as text messages through our SMS provider (Twilio) using a platform-owned phone number; message content passes through Twilio to be delivered.
• Payment information — payments are processed by Stripe. We do not store full card numbers; we keep limited records (e.g. payment status, Stripe identifiers, deposit/purchase amounts).
• Connected services — if you connect Google (Calendar/Photos), Microsoft 365/Outlook, Dropbox, or Instagram, we process the data needed for that feature (e.g. calendar busy times, photos you choose to import, your latest Instagram posts). OAuth tokens are stored encrypted and never shared.
• Usage & technical data — basic logs, request metadata, and aggregate counts of activity (e.g. downloads, emails) used to operate and protect the Service.

How we use information

We use information to:

• provide and operate the Service (host and serve your galleries, run bookings, etc.);
• process payments and payouts through Stripe;
• send transactional email (booking notifications, client messages, account email);
• maintain security, prevent abuse, and enforce our Terms;
• improve and support the Service.

We do not sell your personal information or your clients' personal information.

Your content stays yours

You own the content you upload. Showpiece is multi-tenant by design: your content is yours, enforced at the database level, and the operator cannot read your private galleries through the app. Content only becomes accessible to others when you choose to share it — via a share link, a published portfolio, or a booking/proofing interaction you enable.

Service providers (sub-processors)

We rely on these providers to run the Service; each processes data only to provide its function:

• Supabase — authentication and database.
• Cloudflare R2 — file storage for your photos and video.
• Vercel — application hosting and content delivery.
• Stripe — payment processing and creator payouts.
• Resend — transactional email delivery.
• Google — optional Calendar sync and Photos import (only if you connect them).
• Microsoft — optional Outlook/Microsoft 365 calendar sync (only if you connect it).
• Dropbox — optional photo import (only if you use it).
• Meta (Instagram) — optional Instagram feed on your portfolio (only if you connect it).
• Twilio — SMS delivery for booking notifications, reminders, and client message threads.
• Prodigi — print fulfillment. When a client orders a print, we share the order details needed to produce and ship it (the photo, product, quantity, and the client's name and shipping address) with the print lab.

Google user data

If you choose to connect Google, Showpiece accesses a limited set of Google user data only to provide the specific feature you enable:

• Google Calendar (scope https://www.googleapis.com/auth/calendar.events) — we read your calendar events' busy times so booked or blocked times don't show as available, and we create or delete calendar events when you confirm or cancel a booking.
• Google Photos (scope https://www.googleapis.com/auth/photospicker.mediaitems.readonly) — using Google's Photos Picker, we access only the specific photos you select and import them into your Showpiece library. We do not access your wider Google Photos library.

With whom we share, transfer, or disclose Google user data. We do not sell, rent, or share Google user data with third parties, and we do not use it for advertising. The only parties that ever process this data are our infrastructure sub-processors, acting solely on our behalf to operate the feature you enabled: photos you import are stored in your file storage (Cloudflare R2); your Google OAuth tokens are stored encrypted in our database (Supabase); and processing runs on our application host (Vercel). We do not use Google user data to develop, improve, or train generalized artificial-intelligence or machine-learning models. We disclose Google user data only when required by law or to protect the rights, property, or safety of Showpiece, our users, or the public.

Limited Use. Showpiece's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Retention & revocation. Google OAuth tokens are stored encrypted and are used only to provide the connected feature. You can revoke access at any time by disconnecting Google in Showpiece or via your Google Account permissions; when you disconnect or delete your account, we delete the stored tokens. Photos you imported remain your content in your library until you delete them.

Microsoft user data

If you choose to connect Microsoft 365 / Outlook, Showpiece accesses your calendar via Microsoft Graph (permissions Calendars.ReadWrite and offline_access) only to provide calendar sync:

• Busy times — we read your calendar's busy/free windows so times you are already committed don't show as bookable on your booking page. We use start/end times only and do not store your events.
• Booking events — we create a calendar event when you confirm a booking and remove it if the booking is cancelled or rescheduled.

We do not access your email, files, or contacts; we do not sell, rent, or share Microsoft user data, use it for advertising, or use it to train AI models. Your Microsoft tokens are stored encrypted. Disconnecting Microsoft in Showpiece (or removing Showpiece under your Microsoft account's app permissions at account.live.com/consent/Manage) immediately deletes the stored tokens; deleting your account does the same.

Instagram user data

If you choose to connect Instagram (a professional account, via Meta's official Instagram API), Showpiece accesses only:

• Your basic profile — your Instagram username and account ID, so we can label and link the feed on your portfolio.
• Your own published media — the images, captions, and post links of your recent Instagram posts, used solely to display a “Latest on Instagram” section on your own public portfolio page. We cache this list briefly so your portfolio loads fast without repeated API calls.

We do not access your followers, messages, comments, insights, or anyone else's Instagram data; we do not post to your account; we do not sell, rent, or share Instagram data with third parties, use it for advertising, or use it to develop or train artificial-intelligence models. Your Instagram access token is stored encrypted and is used only to provide this feature.

Data deletion. You can remove this data at any time: click “Disconnect Instagram” in Portfolio settings — this immediately and permanently deletes your stored access token and cached post list. Deleting your Showpiece account removes the same data. You can also revoke Showpiece's access from within Instagram (Settings → Website permissions → Apps and websites). For help, email support@showpiece.studio.

SMS / text messaging

Where SMS is enabled, we send text messages only for appointment logistics — booking confirmations, reminders, booking updates, and replies in your booking conversation — and only to clients who gave express consent by checking an unchecked-by-default opt-in box when providing their phone number. We never send marketing or promotional text messages. Message frequency varies with booking activity; message and data rates may apply. Reply STOP to any message to opt out immediately, or HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with, or sold to, any third parties. Phone numbers and SMS consent are used solely to deliver the messages described here, via our SMS delivery provider (Twilio) acting on our behalf.

Cookies & sessions

We use strictly necessary cookies to keep you signed in and to remember your active workspace. Anonymous gallery viewers may have a random identifier stored in their browser to support proofing (favorites/comments). We do not use advertising cookies.

Data retention & deletion

We keep your information while your account is active. You can delete albums, galleries, and content at any time. You can delete your account yourself in Account settings → Delete account, which removes your content, connected- service tokens, and personal data; or contact us and we'll do it for you. Limited records may be retained where required (e.g. for tax, accounting, or legal obligations related to payments).

Security

We use industry-standard measures, including encryption in transit, encryption of stored OAuth tokens, row-level access controls, and signed, expiring URLs for file delivery. No system is perfectly secure, but we work to protect your data.

Children

The Service is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

We may update this policy; we'll revise the “last updated” date and, for material changes, provide notice.

Contact

Questions or requests: support@showpiece.studio.