Draft. This page is a starting draft for HM4’s lawyer to review. The bracketed details are still to be filled in. It is not yet in force.

Privacy Policy

Last updated [date]

Who is responsible

HM4 Development ([legal entity name and address], [contact email]) runs HM4 Galleries. For the photos and galleries a studio publishes, the studio decides what is shown and to whom; HM4 processes that content on the studio’s behalf.

What we collect

• Photographers and their staff: name and email from your HM4 account, the studios you belong to, and a record of changes you make (which item, when; not its contents).
• Billing: handled by Stripe. We keep the plan, its status and Stripe’s customer and subscription ids, never card numbers.
• Photos: the files studios upload. We remove camera and location metadata (EXIF, GPS) from every version we show; the original file is kept as uploaded and is never shown publicly.
• Gallery visitors: no account and no tracking cookies. To protect the service we briefly count requests per IP address (rate limiting), and our servers keep standard access logs for [14] days.

Cookies

The console uses one sign-in cookie, strictly necessary to keep you signed in. Gallery pages set none, except the one that remembers you entered a gallery’s password, if it has one.

Who we share it with

Our processors: Cloudflare (network and security), Stripe (payments), and the hosting provider of our servers [name, country]. Email goes through HM4’s own mail service. We do not sell personal data or use it for advertising.

How long we keep it

Account and studio data for as long as the studio exists; photos until the studio deletes them or until [90] days after a cancelled studio goes offline; backups for 14 days after that; billing records as long as tax law requires.

Your rights

You can ask to see, correct, export or delete your personal data, or object to how we use it, at [contact email]. If a photo of you is in a studio’s gallery, contact that studio first; we will help if they do not respond. You may also complain to your data protection authority.