Clear about what we collect.
Careful about what we keep.

1. Scope and contact

This Policy applies to Orveil and the related services we make available through orveil.studio. In this Policy, “Orveil,” “we,” “us,” and “our” refer to the operator of the Service. “You” refers to the person or business using the Service.

2. Information we collect

We collect information directly from you, automatically when you use the Service, and from the providers you choose to use with Orveil.

• Account information such as your email address, password hash, profile name, avatar, and account metadata.
• Project and gallery information such as project names, descriptions, uploads, branding assets, delivery copy, collaboration settings, and gallery customization choices.
• Client delivery information such as client email addresses and delivery records when you send galleries through Orveil.
• Billing information for paid plans, such as your subscription tier, billing status, and a payment-provider customer reference. Card details are entered with and processed by our payment provider, Stripe — Orveil does not store full card numbers.
• Usage and device information such as IP address, browser, operating system, session timing, and product interaction events used to run, secure, and improve the Service.
• The date you last used Orveil, recorded on our servers each time you open the app, used to apply the inactive Free account rule in section 5.
• Authentication information from providers such as Google when you choose OAuth sign-in.
• App preferences you set, such as theme, language, accessibility, and layout choices, saved to your account so they follow you to your other devices.
• Your custom gallery domain, if you connect one (Pro and Studio): the domain name and its connection status.
• Contract and payment information from your clients: when a client signs a contract you send, we record their typed name and signature, the time, their IP address, and their browser as evidence of the signature. When a client pays you through Orveil, Stripe processes the payment and we keep its status and Stripe references.
• Client gallery activity: photos your clients favorite, the rating and message they leave as feedback, and anonymous view counts (a random session identifier, not a name or IP address).
• Find Friends: friend requests you send or accept. Other signed-in Orveil users can find you by your profile name and see your name and profile photo.
• Collaboration activity, such as who uploaded, edited, or delivered in a shared project, used for the activity feed and the optional daily summary email.

3. How we use information

• To create and manage accounts.
• To host, process, display, and deliver your galleries and files.
• To send account, security, invite, and delivery-related emails.
• To diagnose bugs, prevent abuse, secure the Service, and enforce our Terms. This includes automatically screening uploaded images for illegal or explicit content (see section 4).
• To run the features you use, such as AI styling, connecting a custom domain, contracts, and client payments.
• To improve the Service using aggregated or de-identified usage patterns.

We do not use your uploaded creative work for advertising or AI training without your separate permission. Our AI features receive only the text you type (and, for gallery styling, the project name), never your photos or videos.

4. How we share information

We do not sell personal information. We share information only when needed to operate the Service, comply with law, or complete a request you initiate.

• With infrastructure and service providers that process it on our behalf:
  • Supabase: database, sign-in, and file storage.
  • Cloudflare R2: storage for your uploaded photos and videos.
  • Vercel: hosting; if you connect a custom domain, Vercel also serves it and issues its security certificate.
  • Google: sign-in when you choose Google; Google Cloud Vision, which receives each uploaded image to screen it for illegal or explicit content; and Google Fonts, which your browser loads for gallery and studio fonts (Google receives your IP address when it does).
  • Stripe: payments for paid plans and for client payments you collect through Orveil.
  • Resend: sending account, delivery, contract, and notification emails.
  • Groq and fal.ai: our AI styling and AI image features, which receive the text you type (and the project name for styling).
  • ipwho.is: looking up the network and approximate location of an IP address, to block abusive traffic and, only with analytics consent, for the visit notifications in section 7.
  • Unsplash: some sample images on our website load from Unsplash, which receives your IP address when they do.
• With your intended recipients when you send a gallery or invite through Orveil.
• When required by law, legal process, or to protect the security, rights, or safety of Orveil, our users, or others.
• In connection with a merger, acquisition, financing, or sale of all or part of the business, subject to appropriate notice where required.

5. Storage, security, and retention

We use reasonable technical and organizational safeguards designed to protect personal information, including encrypted transport, access controls, and managed infrastructure. No service can promise absolute security.

• Account information is retained while your account is active and for a limited period after deletion where needed for security, recovery, or legal obligations.
• Uploaded files and project data are retained until you delete them or your account is deleted, subject to short operational backup windows. When you replace or remove a gallery logo, the old logo file is deleted once no project uses it. From November 15, 2026, one exception applies: in a Free account that has not been used for 90 days, RAW original files are replaced by the JPEG versions Orveil made of them, after an email notice at least 14 days in advance (Terms section 6).
• Usage logs and delivery records are retained only as long as reasonably needed for operations, security, analytics, and legal compliance.

6. Your choices and rights

Depending on where you live, you may have rights to access, correct, export, delete, or restrict certain personal information. You may also object to certain processing or withdraw consent where consent is the basis for processing.

Signed in, you can do two of these yourself at any time from Settings → Account: Download your data saves your account, profile, projects, file details, contracts and their signatures, your clients’ feedback and favorites, and your activity as a machine-readable JSON file plus a readable HTML copy that includes your profile photo, logos, and contract PDFs (your photos and videos download from each project), and Delete account permanently erases it. The export contains only data tied to your account and leaves out passwords, sign-in tokens, and your clients’ IP addresses and devices.

To make a request, email hello@orveil.studio. We may need to verify your identity before we complete a request.

7. Cookies and similar technologies

Orveil uses two kinds of storage on your device.

Essential (always on). Your sign-in session, the signed access token for a password-protected gallery, security and rate-limiting state, and preferences such as theme, language, or tutorial progress (including a cached copy of the interface translation for the language you use). These are required for the service to work and cannot be switched off. We also keep a record of the cookie choice you made (orveil_consent) for 12 months.

Analytics (only with your permission). First-party, cookie-free usage events about how the studio is used when you are signed in, and visit notifications sent to Orveil when someone opens our website or a delivered gallery: the page, referrer, browser, device, screen size, language, IP address, and an approximate location and network provider looked up from that IP address (through Vercel and ipwho.is). These notifications go to Orveil only, not to photographers, and are not stored in our database. Nothing runs until you choose Accept all or enable Analytics under Manage, and our servers refuse to record these events without that choice. We honor the Global Privacy Control browser signal as an opt-out.

Photographers see how many times a delivered gallery was viewed. These counts use a random session identifier, not your name or IP address, and are part of delivering the gallery.

We do not use advertising cookies, cross-site tracking, or sell personal information. You can change your choice at any time via Cookie settings in the site footer or in your account settings; your previous choice is replaced and no further optional data is collected.

8. Children’s privacy

Orveil is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us and we will investigate and take appropriate action.

9. International users

Orveil may be hosted or operated using providers located in the United States. If you access the Service from outside the United States, you understand that your information may be transferred to and processed in the United States and other jurisdictions where our providers operate.

10. Changes to this Policy

We may update this Policy from time to time. If we make a material change, we will update the effective date and provide notice through the Service or by email where appropriate. Your continued use of Orveil after the updated Policy takes effect means the updated Policy applies going forward.