Privacy Policy
1. Who controls the data
For your own account data (your email, billing, settings) lemon.gallery is the data controller. For the personal data of your clients that you put into the platform (names, emails, booking and gallery details), you are the controller and we are your processor, acting on your instructions.
2. What we collect
- Account: your name, email, business details, password (hashed), plan and settings.
- Client & business data you enter: contacts, leads, bookings, invoices, contracts, questionnaire answers, gallery access emails.
- Content: photos, videos and files you upload.
- Usage: basic logs and analytics needed to run and secure the service.
- Payments: handled by Stripe; we store payment references and status, never full card numbers.
3. Why we use it (lawful bases)
To provide the service you signed up for (contract), to keep it secure and improve it (legitimate interests), to take payment (contract), and where required by law. We send service emails to run your account; marketing emails to you only with your consent or where permitted, always with an opt-out.
4. Who we share it with (processors)
We use trusted providers strictly to run the service: cloud hosting and Postgres database, S3-compatible file storage, Stripe (payments), an email delivery provider, and — for the text-drafting features — an AI provider or your own on-device AI. We never sell your data or your clients' data, and we don't share it for anyone else's marketing.
5. Photos and AI
Your photographs are never sent to image-generating AI and are never altered by AI. The only AI in the platform drafts text and workflow suggestions, which you review before use. Where you connect your own on-device AI (the desktop worker), that processing happens on your machine.
6. International transfers
Some providers may process data outside your country. Where they do, we rely on appropriate safeguards (such as standard contractual clauses) as required by law.
7. Retention
We keep data while your account is active and for a reasonable period afterwards so you can export it, then delete or anonymise it, except where we must keep records (e.g. tax/payment records) for longer.
8. Your rights
Subject to law, you can access, correct, export or delete your personal data, object to or restrict some processing, and withdraw consent. Your clients should direct such requests to you as their controller; we'll help you fulfil them. Contact privacy@lemon.gallery.
9. Security
We use encryption in transit, hashed passwords, scoped access tokens and least-privilege access. No system is perfectly secure, but we work to protect your data and will notify you of a breach as the law requires.
10. Cookies
We use only the cookies needed to keep you logged in and the service working. We don't use third-party advertising cookies.
11. Changes & contact
We'll post changes here and flag material ones. Questions: privacy@lemon.gallery.