Privacy Policy

Last updated 5 October 2026

Short version: we hold the data needed to run your studio software. We don't sell it. Your clients' details belong to you — we process them on your behalf. Some features do send a copy of a photograph to an AI provider — writing alt text, checking whether an image has been stolen, and the paid AI editing tool — and section 5 says exactly which, exactly when, and what we refuse to let them do with it.

1. Who controls the data

For your own account data (your email, billing, settings) lemon.gallery is the data controller. For the personal data of your clients that you put into the platform (names, emails, booking and gallery details), you are the controller and we are your processor, acting on your instructions.

2. What we collect

Account: your name, email, business details, password (hashed), plan and settings, when you last signed in and used the app, and, if you accepted cookies, how you first found us (see the Cookie Policy).
Client & business data you enter: contacts, leads, bookings, invoices, contracts, questionnaire answers, gallery access emails.
Content: photos, videos and files you upload.
Contract signatures: when someone signs a contract we record the signing name, the time, their IP address and their browser, and we print those into the signed PDF. That trail is what makes the signature worth anything if it's ever disputed, so it can't be switched off — but you should tell the person signing, because it's their personal data too.
Voice recordings: if you dictate instead of typing, the audio goes to a transcription model and comes back as text. We don't keep the recording — see section 5.
People the platform finds for you: if you turn on the outreach prospector, it searches the public web and builds a list of potential clients — real, named people who have never contacted you. For each one it stores a name, and where it found them: company, role, an email address, a website and the URL of the page it used as evidence. That data comes from public sources, not from the person, so if they ask, tell them it came from lemon.gallery's prospector on your instruction — and delete them if they'd rather not be on your list. You are the controller for that list.
Journalists PR Desk matches for you: when you ask PR Desk to find people for a brief, it searches the public web for journalists who have recently written about that subject. For each one it stores their name, outlet, beat and region, the title and link of a piece they published, and an editorial address only if their outlet prints it publicly. It never stores a private address. They belong to that brief, and deleting the brief deletes them. You are the controller for that list; if someone asks, tell them it came from lemon.gallery's PR Desk on your instruction.
Usage: basic logs and analytics needed to run and secure the service.
Payments: handled by Stripe; we store payment references and status, never full card numbers.
Instagram, if you connect it: LemonChat (DM & comment automation) and Social Publishing are opt-in. Connecting either sends us your Instagram professional account's id, username and an encrypted access token. From then on, as people message or comment, we store the sender's Instagram-scoped id, their username or name where Instagram gives us one, and the content of what they sent, so you can see and reply to it from lemon.gallery. If you also connect Social Publishing, posts you schedule and their engagement stats (likes, comments, reach) pass through the same connection. Disconnecting the account — in Settings or from Instagram itself — deletes the stored token and every conversation record filed against it immediately; see Instagram Data Deletion for how someone who messaged a studio, rather than the studio itself, can ask for the same.
Google, if you connect it: each connection is opt-in and asks only for what it uses. Calendar sync reads your calendar and adds and updates the shoots you book. Insights reads your Google Analytics and Search Console reports (read-only) to chart your site's traffic. Sending from Gmail lets us send the emails you write to your clients from your own address; it can send, and it can't read your inbox. Google Business Profile lets us publish the posts you schedule to your business locations and show and answer your reviews. Google Meet notes reads the records of your Meet calls and, only if you turn on Gemini's notes, the notes Meet saved to your Drive, so they're filed on the right client; the notes are summarised by AI (see section 5). We store your Google account email and encrypted access tokens. Disconnecting, or removing lemon.gallery in your Google Account's security settings, stops all of it.
TikTok, Pinterest, LinkedIn, Facebook Pages and Threads, if you connect them: connecting sends us that account's id, name (and, for TikTok, your nickname and profile picture, shown so you know which account you're posting to) and an encrypted access token. We use it only to publish the posts you schedule, with the settings you choose for each one (on TikTok: who can see it, whether comments are on, and any branded content disclosure), and, where the network offers it, to read back their stats. Disconnecting deletes the stored token.

3. Why we use it (lawful bases)

To provide the service you signed up for (contract), to keep it secure and improve it (legitimate interests), to take payment (contract), and where required by law.

Service emails — password resets, receipts, "your gallery is ready", plan and security notices — go out because we need them to run your account, so they don't depend on consent and you can't unsubscribe from them while the account is open. Our own marketing (product news, offers, tips) is different: we only send it if you asked for it, or under the soft opt-in where you're an existing customer and it's about something close to what you already bought. Every one of those has a one-click unsubscribe, and unsubscribing sticks.

When you email or text your clients through the platform — campaigns, automations, SMS reminders — we are only the pipe. Getting consent, honouring an unsubscribe or a STOP, and keeping to UK marketing rules is your responsibility as the controller, not ours. We give you the unsubscribe machinery; using it properly is on you.

4. Who we share it with (processors)

We use a small set of named providers, strictly to run the service:

Neon — the Postgres database. Hosted in the UK (AWS London).
Cloudflare R2 — photos, videos and files.
Stripe — payments and subscriptions.
Resend — email delivery.
OpenRouter — the AI features, routing to models from Google, Anthropic and OpenAI. See section 5.
Prodigi — print fulfilment. Gets a client's name and delivery address, and only when there's a real print order to make.
Twilio — SMS, only if you switch it on.
Google — four separate things, each only if it applies: calendar sync (if you connect your Google Calendar), Cloud Vision (only if you turn on image-theft monitoring), the Distance Matrix API, which receives a booking address so we can estimate travel time to a shoot, and, if you connect a Google Ads account and approve conversion uploads, Google's Data Manager API, which receives enquiry and booking events with your client's email address and phone number, each scrambled (SHA-256 hashed) before it leaves us.
Meta — only if you connect LemonChat, Social Publishing or a Meta ad account. Messages, comments and, for Social Publishing, the posts and insights you access all pass through Meta's API to make that connection work. With a Meta ad account connected and conversion sending switched on, enquiry and booking events with your client's hashed email address and phone number go to Meta's Conversions API.
TikTok, Pinterest and LinkedIn — only if you connect them: the posts you schedule, with their photos and settings, go to that network to be published.
The hosting provider that runs the application itself.

lemon.gallery's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features you connected it for. We don't sell it, use it for advertising, or use it to develop, improve or train generalised AI or machine-learning models, and no person at lemon.gallery reads it unless you ask us to for support, it's needed for security, or the law requires it.

Our Data Processing Agreement carries the canonical, up-to-date list of sub-processors — if the two ever disagree, the DPA is the one to trust. We never sell your data or your clients' data, and we don't share it for anyone else's marketing.

5. Photos and AI

Some AI features work on words only. Some genuinely send a copy of a photograph to an AI provider. Here is the whole list, honestly:

Drafting text — emails, captions, proposals, workflow suggestions. This sends your words and the surrounding workflow context (things like a client's name, a shoot type, a date) to OpenRouter. No photograph is involved.
Alt text and image descriptions — this does send the photograph. We make a downsized copy, 768 pixels on its longest edge and without the watermark, and send that to a vision model so it can actually see the shot it's describing. The copy is made for the request and isn't stored.
Image-theft monitoring — off unless you turn it on. It sends a copy of the photograph to Google Cloud Vision to search the web for other places that image appears. We ask Google for web detection and nothing else: no face detection, no face recognition, no face matching — not here, not anywhere else in the product. There is no face-recognition feature in lemon.gallery.
AI photo editing — a paid, opt-in feature you or your client have to actively choose. It sends the photograph to an AI model, which returns an altered copy. Two hard rules: the original is never overwritten (the edit lands as a new file beside it), and no edited image reaches a client until a human has looked at it and approved it.
Voice dictation — if you talk instead of typing, the audio recording is sent to a transcription model, turned into text, and dropped. We don't store the recording; the transcript is what you then correct and use.

No photograph is sent anywhere on this list unless you use the feature that needs it.

On training: every AI request we send is marked to refuse the use of your data for training models. That instruction is contractual, and we choose providers who accept it — but we can't personally audit a model vendor's data centre, so we'll describe it as what it is: a refusal we make on your behalf and enforce through contracts, not a guarantee we can independently verify.

Two things we will say plainly about your photographs. We do not train AI models on them, and we do not knowingly let anyone else do so — by default we mark them not to be used for AI training. The exception is a task you have asked for that needs AI to do it: if you send a photo for AI editing, or turn on a feature that reads your images, we take that as your agreement for that task, and we don't apply the no-AI marker to those files.

Where our own team edits for you (lemonHelp), the work is done in the professional software the industry runs on — Adobe's — so your files pass through Adobe applications and their cloud while the work is being done, on Adobe's terms.

Where you connect your own on-device AI (the desktop worker), that processing happens on your machine and nothing leaves it.

6. International transfers

Your database sits in the UK — Neon runs it on AWS London — but Neon is a US company, and its engineers can reach that infrastructure to support it. Stripe, Resend, OpenRouter, Prodigi, Cloudflare and Google all operate internationally, so data reaching them may be processed outside the UK.

Where personal data leaves the UK we rely on the safeguards UK law actually recognises — an adequacy decision where one covers the country, otherwise the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses. Note that the EU's standard contractual clauses on their own are not a valid UK transfer mechanism; the Addendum is what makes them work here.

7. How long we keep it

While your account is open we keep your data so the software works. After that:

30 days after you close the account we still hold your clients' data, so if you email privacy@lemon.gallery in that time we can send you an export. You can't sign in to fetch it yourself, because closing ends the login, so the easiest route is to export before you close. After 30 days we delete the galleries, uploaded files, contacts, leads, bookings and messages.
7 years for invoices, payments and refunds. UK tax law requires it, so this survives account closure and survives a deletion request.
Around 35 days for encrypted backups, which age out on a rolling cycle. Deleted data can persist in a backup until the last one containing it expires.
12 months for security and audit logs — sign-ins, contract events, access records — because that's what an investigation needs to be useful.

8. Your rights

Subject to law, you can access, correct, export or delete your personal data, object to or restrict some processing, and withdraw consent. Two of those you can do yourself, right now, in Settings → Your data: download everything we hold on your studio as a JSON file, or close your account.

Be clear about what closing the account does and doesn't do. It cancels your subscription, takes your galleries offline and erases your name, email, logins and saved keys. It does not erase your clients. Their contacts, leads, bookings, messages, contracts and photographs stay in the database, and your galleries are unpublished rather than deleted, until the retention periods in section 7 run out. So if a client has asked you to erase them, delete that client before you close the account — once it's closed you no longer have the tools to do it, and you'll have to email us instead.

Your clients should direct their requests to you as their controller; we'll help you fulfil them. Contact privacy@lemon.gallery.

If you think we've handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk (0303 123 1113). You don't have to come to us first — we'd like the chance to fix it, but it's your right to go straight to them.

9. Automated decisions

Nothing here decides anything about you by machine alone. The AI features draft, suggest, score and describe; a person reads the result and chooses what to do with it. There is no solely automated decision-making or profiling that produces a legal or similarly significant effect on anyone.

10. Children

Family, newborn and school photography are core to what this platform is for, so galleries routinely contain identifiable children. You have to be 18 or over to hold a lemon.gallery account, and we don't knowingly collect personal data directly from children — children don't sign up here, their parents and their photographer do.

Where a child appears in a studio's gallery, contacts or booking records, the studio is the controller for that data, and it's the studio's job to have the parent or guardian's permission for photographing them, storing the images and sharing the gallery. If you're a parent and you believe a child's data is on the platform without that permission, email privacy@lemon.gallery and we'll put you in touch with the studio responsible and act on it.

11. Security

We use encryption in transit, hashed passwords, scoped access tokens and least-privilege access. No system is perfectly secure, but we work to protect your data and will notify you of a breach as the law requires.

12. Cookies

Essential cookies are always on — they keep you logged in and the service working. We don't ask permission for those because the site can't run without them.

Analytics and advertising cookies only run if you accept them. That covers Google Analytics and Google Tag Manager (which tell us how people find and use the site) and, on our ad landing pages, the Meta Pixel and Google Ads conversion tag. Nothing in that list loads until you choose “Accept all” on the cookie banner, and choosing “Essential only” keeps them off for good.

Photographers on the platform can connect their own Google Tag Manager container or ad pixels to their public site and galleries; those wait for the same consent.

Changed your mind? — the banner comes back and you can pick again. Your choice is kept in one cookie shared by every lemon.gallery address, so changing it on one changes it on all of them (on a photographer's own domain it covers that site only), and clearing site data resets it too. The "Cookie settings" link at the foot of our home and feature pages, and of the galleries and studio pages we host, does the same thing. The full list, including the non-cookie browser storage we use, is in the Cookie Policy.

13. Changes & contact

lemon.gallery is operated by LemonLens LTD (company number 15638629), registered office at 769b Fulham Road, London, United Kingdom, SW6 5HA.

We'll post changes here and flag material ones. Questions: privacy@lemon.gallery.