Privacy Policy

1. Introduction

Studio Lifesaver LLC ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website, applications, and services (collectively, the "Service").

By using the Service, you consent to the data practices described in this policy. If you do not agree with this Privacy Policy, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password (stored in hashed form), and account role (Studio, Assistant, or both).
• Profile Information: Professional bio, skills, specializations, shooting styles, gear lists, portfolio images, profile photos, hourly/flat rates, and availability.
• Location Data: City, state, and geographic coordinates derived from addresses you provide, used for job matching.
• Tax Documents: IRS Form W-9 or equivalent documents may be optionally uploaded by Assistants. W-9 submission is optional and can be removed at any time. These documents may contain your legal name, address, taxpayer identification number (TIN/SSN), and signature.
• Payment Information: Billing details provided during subscription checkout. Full payment card details are collected and processed directly by Stripe and are never stored on our servers.
• Communications: Messages sent through our in-app messaging system between Studios and Assistants.
• Contract Data: Electronic signatures, contract terms, and audit trail information generated through our e-signature feature.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, actions taken, timestamps, and interaction patterns.
• Device Information: Browser type, operating system, device type, and screen resolution.
• IP Address: Collected for security, rate limiting, and fraud prevention purposes.

2.3 Information from Third Parties

• Google Calendar: If you connect your Google Calendar, we access your calendar availability to enable scheduling features. We do not read or store the content of your calendar events.

3. How We Use Your Information

We use your information for the following purposes:

• Service Operation: To create and manage your account, facilitate job matching between Studios and Assistants, process transactions, and deliver the core functionality of the platform.
• Communications: To send transactional emails (account verification, job notifications, hiring updates, review requests), and, with your consent, marketing communications.
• Matching and Discovery: To match Assistants with relevant job postings based on location, skills, gear, availability, and other profile attributes.
• Security: To detect and prevent fraud, abuse, and unauthorized access. This includes rate limiting, monitoring for suspicious activity, and maintaining audit logs.
• Improvement: To analyze usage patterns, troubleshoot issues, and improve the Service.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or governmental requests.

4. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

4.1 With Other Users

Profile information (name, bio, skills, portfolio, ratings, reviews) is visible to other authenticated users of the platform. Assistants who are hired for a job may have their contact information and tax documents shared with the hiring Studio as necessary for the engagement.

4.2 With Third-Party Service Providers

We share information with the following third-party service providers who process data on our behalf:

4.3 For Legal Reasons

We may disclose your information if required by law, subpoena, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others; investigate fraud; or respond to a legal process.

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change and any choices you may have regarding your information.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: All data is encrypted in transit using TLS/SSL. Sensitive data stored at rest (including tax documents) is encrypted using AES-256 and server-side encryption (SSE-KMS) for W-9 files.
• Password Security: Passwords are hashed using bcrypt and are never stored in plaintext.
• Access Controls: Sensitive files (such as W-9 documents) are stored with time-limited access URLs that expire after a short period. Database access is restricted by IP whitelist.
• Authentication: JWT-based authentication with token expiration and automatic invalidation on password change.
• Rate Limiting: API endpoints are rate-limited to prevent brute force attacks and abuse.
• Input Validation: All user inputs are validated and sanitized to prevent injection attacks and cross-site scripting (XSS).

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

• Account Data: Retained until you request account deletion.
• Tax Documents (W-9): W-9 submission is optional. If provided, documents are retained for the duration required by IRS regulations (generally 4 years after the tax year in which the document was provided), after which they are securely deleted. You may delete your W-9 at any time through your profile settings.
• Contract Records: Retained for 7 years to comply with legal record-keeping requirements.
• Messages: Retained while your account is active. Deleted upon account closure.
• Usage Logs: Retained for up to 12 months for security and analytics purposes.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Portability: Request your data in a portable, machine-readable format.
• Opt-Out: Opt out of marketing communications at any time by updating your notification settings or clicking "unsubscribe" in any marketing email.
• Restrict Processing: Request that we limit the processing of your personal information under certain circumstances.

To exercise any of these rights, contact us at support@gottasecond.com. We will respond within 30 days.

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• The right to know what personal information we collect, use, and disclose.
• The right to request deletion of your personal information.
• The right to correct inaccurate personal information.
• The right to opt out of the "sale" or "sharing" of personal information. Note: We do not sell or share personal information for cross-context behavioral advertising.
• The right to limit the use of sensitive personal information to purposes necessary to provide the Service.
• The right to non-discrimination for exercising your privacy rights.

To exercise your California privacy rights, contact us at support@gottasecond.com or use the "Do Not Sell or Share My Personal Information" link in our website footer. We will verify your identity and respond within 45 days.

9. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and applicable local data protection laws provide you with additional rights.

9.1 Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual Necessity: Processing necessary to provide the Service you requested (account creation, job matching, messaging, payment processing).
• Legitimate Interest: Processing for our legitimate business interests (service improvement, security, fraud prevention), where these interests do not override your fundamental rights.
• Consent: Processing based on your explicit consent (analytics cookies, marketing communications). You may withdraw consent at any time.
• Legal Obligation: Processing required to comply with applicable laws (tax record keeping, law enforcement requests).

9.2 Your GDPR Rights

In addition to the rights listed in Section 7, you have the right to:

• Object to Processing: Object to the processing of your personal data based on legitimate interest.
• Withdraw Consent: Withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing performed before withdrawal.
• Lodge a Complaint: File a complaint with your local data protection supervisory authority if you believe your rights have been violated.

9.3 International Data Transfers

Your data is primarily processed in the United States. For transfers of personal data from the EEA/UK to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms, to ensure adequate protection of your personal data.

9.4 Data Protection Contact

For GDPR-related inquiries, contact us at: privacy@gottasecond.com

9. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will promptly delete it. If you believe a child has provided us with personal information, please contact us immediately.

11. Cookies, Tracking, and Do Not Track

We use the following technologies:

• Local Storage: We store your authentication token in browser local storage to maintain your login session.
• Essential Cookies: Third-party services (Stripe, Google) may set cookies necessary for their functionality.
• Analytics (PostHog): With your consent, we use PostHog for product analytics and session recording to understand how users interact with the Service. PostHog may set cookies to track session activity. Analytics data is used solely to improve the Service and is not shared with advertisers. You may opt out of analytics at any time by declining cookies via our consent banner or updating your preferences.

We do not use advertising cookies or sell data to third-party advertisers.

Do Not Track Signals

Some web browsers transmit "Do Not Track" (DNT) signals to websites. We honor DNT signals. If your browser sends a DNT signal, we will not load non-essential analytics or tracking technologies for your session. You may also manage your cookie preferences through our consent banner displayed on your first visit.

12. International Data Transfers

Our Service is hosted in the United States. If you access the Service from outside the United States, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Service, you consent to this transfer. For transfers from the EEA/UK, see Section 9.3.

13. Communications to Non-Users

Our platform allows registered users to send review requests to email addresses of individuals who may not have a GottaSecond account. If you receive such an email:

• The email is a one-time, transactional communication initiated by a specific GottaSecond user, not bulk marketing.
• We do not add your email to any marketing list, nor do we create an account on your behalf.
• We store the email address solely to track the status of the review request and to prevent duplicate requests.
• You are under no obligation to respond or take any action.
• If you wish to have your email address removed from our records, contact us at support@gottasecond.com and we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or in-app notification. The "Last updated" date at the top of this page indicates the most recent revision. Your continued use of the Service after changes constitutes acceptance of the updated policy.

15. Contact Us

For questions, concerns, or requests related to this Privacy Policy or your personal data, contact us at:

Studio Lifesaver LLC
Email: support@gottasecond.com