Privacy Policy

1. Who we are

ProofRoom is a product operated by Dylan Odom, a company registered in Malta under company number MT24294511. Our registered address is 1. Belfior Court, St. Louis Street, Msida, MSD1465, Malta. For privacy questions, contact legal@sunsetblvd.app.

ProofRoom is a proofing and delivery service for professional photographers. Photographers hold an account with us and are our customers. Their clients receive access to galleries through private links and do not need an account.

2. Our role: controller and processor

We act as controller for photographer account data — registration, sign-in, security, support and, when paid plans launch, subscription records.

For the content a photographer uploads and the client details they enter, the photographer decides what is collected and why. We process that material on their instructions to operate the service, which makes us their processor. Photographers are responsible for having the rights and permissions needed for the photographs and personal data they place in ProofRoom, including any model or client consent.

3. Data we process

• Account and workspace data: name, email address, password (stored hashed by our authentication provider), workspace settings, time zone, currency, plan and usage counters.
• Security records: sign-in events, active sessions and devices, two-factor authentication enrolment, email-change and password-change requests, and rate-limit counters.
• Client information entered by photographers: optional client name and email, and optional saved client records used for the Client Portal.
• Uploaded photographs and files: original proof images, browser-generated previews and web renditions, final delivery files, generated download archives, watermark and logo images, and associated file names, sizes and timestamps.
• Gallery activity: selections, client comments and notes, submissions, download records, share-link and PIN unlock events, expiry and retention dates.
• Email records: transactional messages we send on a photographer's behalf or to their account, with delivery status such as accepted, queued or failed.
• Support requests: the category and message you send through the in-app Help form, your account email, and the page you were on.
• Technical data required to serve requests, such as IP address and request metadata processed by our hosting and email providers as part of normal operation and abuse prevention.

ProofRoom does not run advertising, marketing trackers or third-party analytics, and does not build profiles of visitors. We use only cookies and browser storage that are strictly necessary to sign you in, keep your session, remember your appearance preference and remember a gallery sort choice on your own device. Because we use no non-essential cookies, no cookie consent banner is shown.

4. Why we process it, and our lawful bases

• To provide the service you asked for — accounts, galleries, selections, deliveries and downloads. Lawful basis: performance of a contract.
• To send transactional emails such as verification, password reset, security alerts, gallery notifications and delivery notices. Lawful basis: performance of a contract, and legitimate interests in securing accounts.
• To keep the service secure and prevent abuse — rate limits, PIN throttling, session control and audit records. Lawful basis: legitimate interests, and legal obligation where security incidents must be reported.
• To operate plans, storage limits and, when paid plans launch, subscriptions and invoicing. Lawful basis: performance of a contract and legal obligation for tax and accounting records.
• To answer support requests. Lawful basis: performance of a contract and legitimate interests in supporting our users.

5. Service providers and international transfers

We keep the number of providers small. Each acts under a contract that limits them to processing data on our instructions.

• Lovable — application hosting, database, authentication, file storage and transactional email delivery for the ProofRoom service.
• Google — only when you choose to sign in with Google. It confirms your identity and shares your email address with us; we do not receive your password.
• Paddle — when paid plans launch, Paddle will act as merchant of record and will process payment and billing data. We will receive subscription status, plan, renewal dates and limited billing metadata, not full card details.

Some providers may process data outside the European Economic Area. Where that happens, transfers rely on the European Commission's standard contractual clauses or another valid transfer mechanism.

6. Retention and deletion

• Account data is kept while the account exists. When an account is deleted, its workspace data and files are deleted, except where we must keep limited records for legal or accounting reasons.
• Proof and delivery files follow the expiry and retention settings a photographer chooses for each project, and are removed when those periods end or when the photographer deletes them.
• Generated download archives are temporary and are regenerated or removed when a gallery's contents, order or file names change.
• Security and email-delivery records are kept for a limited period for troubleshooting and abuse prevention.
• Support requests are kept while needed to resolve the issue and for a reasonable period afterwards.

Deletion is permanent. ProofRoom is not a backup service and we do not promise that deleted files can be recovered. Photographers should keep their own originals.

7. Your rights

If the GDPR or comparable law applies to you, you may request access to your personal data, correction, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time. Much of this can be done directly in your account settings.

If you are a client of a photographer and want your data corrected or removed from a gallery, contact the photographer who sent you the link, since they decide what is stored. If you cannot reach them, write to legal@sunsetblvd.app and we will help where we can.

We respond to requests within the time limits the law sets. You also have the right to lodge a complaint with a supervisory authority — in Malta, the Office of the Information and Data Protection Commissioner — or with the authority where you live or work.

8. Security

Access to galleries relies on unguessable private links, with optional PIN protection, expiry dates and access revocation. Data is stored with row-level access rules so a photographer's records are reachable only by that account and, through a valid link, by their clients. Accounts support two-factor authentication, session revocation and re-authentication for sensitive changes. Data is encrypted in transit.

No online service can be guaranteed completely secure. We take reasonable technical and organisational measures, but cannot promise absolute security.

9. Children

ProofRoom accounts are for professional and business use and are not intended for children. We do not knowingly create accounts for anyone under 16.

10. Changes and contact

We will update this policy when the service changes, and will revise the dates above. Material changes will be communicated to account holders by email or in the application.

Privacy and legal: legal@sunsetblvd.app · Support: support@sunsetblvd.app