Clear about what we collect.
Careful about what we keep.

1. Scope and contact

This Policy applies to Orveil and the related services we make available through orveil.studio. In this Policy, “Orveil,” “we,” “us,” and “our” refer to the operator of the Service. “You” refers to the person or business using the Service.

2. Information we collect

We collect information directly from you, automatically when you use the Service, and from the providers you choose to use with Orveil.

• Account information such as your email address, password hash, profile name, avatar, and account metadata.
• Project and gallery information such as project names, descriptions, uploads, branding assets, delivery copy, collaboration settings, and gallery customization choices.
• Client delivery information such as client email addresses and delivery records when you send galleries through Orveil.
• Billing information for paid plans, such as your subscription tier, billing status, and a payment-provider customer reference. Card details are entered with and processed by our payment provider, Stripe. Orveil does not store full card numbers.
• Usage and device information such as IP address, browser, operating system, session timing, and product interaction events used to run, secure, and improve the Service.
• The date you last used Orveil, recorded on our servers each time you open the app, used to apply the inactive Free account rule in section 5.
• Authentication information from providers such as Google when you choose OAuth sign-in.
• App preferences you set, such as theme, language, accessibility, and layout choices, saved to your account so they follow you to your other devices.
• Your custom gallery domain, if you connect one (Pro and Studio): the domain name and its connection status.
• Contract and payment information from your clients: when a client signs a contract you send, we record their typed name and signature, the time, their IP address, and their browser as evidence of the signature. When a client pays you through Orveil, Stripe processes the payment and we keep its status and Stripe references.
• Client gallery activity: photos your clients favorite, the rating and message they leave as feedback, and anonymous view counts. Galleries keep a random ID on the visitor's device (orveil_gsid) so favorites and view counts work; it is not a name or IP address.
• Reviews you choose to write about Orveil: the rating, the text, the name, work type and website you give, and whether we may publish it.
• Automatic photo analysis for Smart Cull (such as sharpness, exposure and duplicates), done on our own servers.
• Find Friends: friend requests you send or accept. Other signed-in Orveil users can find you by your profile name and see your name and profile photo.
• Collaboration activity, such as who uploaded, edited, or delivered in a shared project, used for the activity feed and the optional daily summary email.

3. How we use information

• To create and manage accounts.
• To host, process, display, and deliver your galleries and files.
• To send account, security, billing, storage, invite, delivery and contract emails, plus optional activity and product news emails that you can turn off with the link in each email or in Settings.
• To diagnose bugs, prevent abuse, secure the Service, and enforce our Terms. This includes automatically checking uploaded photos for sexually explicit content (see section 4).
• To run the features you use, such as AI styling, connecting a custom domain, contracts, and client payments.
• To improve the Service using aggregated or de-identified usage patterns.

We do not use your uploaded creative work for advertising or AI training without your separate permission. Our AI features receive only the text you type (and, for gallery styling, the project name), never your photos or videos. If you use an AI cover image, that image is hosted by fal.ai, so people who view the gallery load it from fal.ai, which receives their IP address.

4. How we share information

We do not sell personal information. We share information only when needed to operate the Service, comply with law, or complete a request you initiate.

• With infrastructure and service providers that process it on our behalf:
  • Supabase: database, sign-in, and file storage.
  • Cloudflare R2: storage for your uploaded photos and videos.
  • Vercel: hosting; if you connect a custom domain, Vercel also serves it and issues its security certificate.
  • Google: sign-in when you choose Google; Google Cloud Vision, which receives each uploaded photo to check it for sexually explicit content (flagged uploads are logged and may be blocked or removed); and Google Fonts, which your browser loads on our website, in the studio and in galleries (Google receives your IP address when it does).
  • Stripe: payments for paid plans and for client payments you collect through Orveil.
  • Resend: sending account, delivery, contract, and notification emails.
  • Groq and fal.ai: our AI styling and AI image features, which receive the text you type (and the project name for styling).
  • ipwho.is: looking up the network and approximate location of an IP address, to block abusive traffic and, only with analytics consent, for the visit notifications in section 7.
  • Unsplash: some sample images on our website load from Unsplash, which receives your IP address when they do.
• With your intended recipients when you send a gallery or invite through Orveil.
• When required by law, legal process, or to protect the security, rights, or safety of Orveil, our users, or others.
• In connection with a merger, acquisition, financing, or sale of all or part of the business, subject to appropriate notice where required.

5. Storage, security, and retention

We use reasonable technical and organizational safeguards designed to protect personal information, including encrypted transport, access controls, and managed infrastructure. No service can promise absolute security.

• Account information is retained while your account is active. When you delete your account, we erase it right away; copies may remain in our providers' backups for a short time.
• Uploaded files and project data are retained until you delete them or your account is deleted, subject to short operational backup windows. When you replace or remove a gallery logo, the old logo file is deleted once no project uses it. From November 15, 2026, one exception applies: in a Free account that has not been used for 90 days, RAW original files are replaced by the JPEG versions Orveil made of them, after an email notice at least 14 days in advance (Terms section 6).
• Orveil app for Mac. Photos and videos you keep in the Orveil Library stay on your computer (in your Pictures folder) and are not uploaded to us. For each one we store its name, size, type, any edits you make, and a small preview image, so your projects can be shown on your other devices. When you sync a project or deliver it, its photos and videos are uploaded and handled like any other upload. The app also keeps, on your computer only, a list of imports in progress (so an interrupted import can resume) and your window size and position.
• Usage events, delivery records and rate limit records are kept until you delete your account, unless we remove them sooner.

6. Your choices and rights

Depending on where you live, you may have rights to access, correct, export, delete, or restrict certain personal information. You may also object to certain processing or withdraw consent where consent is the basis for processing.

Signed in, you can do two of these yourself at any time from Settings → Account: Download your data saves your account, profile, projects, file details, contracts and their signatures, your clients’ feedback and favorites, and your activity as a machine-readable JSON file plus a readable HTML copy that includes your profile photo, logos, and contract PDFs (your photos and videos download from each project), and Delete account permanently erases it. The export contains only data tied to your account and leaves out passwords, sign-in tokens, and your clients’ IP addresses and devices.

To make a request, email hello@orveil.studio. We may need to verify your identity before we complete a request.

7. Cookies and similar technologies

Orveil uses two kinds of storage on your device.

Essential (always on). Your sign-in session, the signed access token for a password-protected gallery, security and rate-limiting state, and preferences such as theme, language, or tutorial progress (including a cached copy of the interface translation for the language you use). These are required for the service to work and cannot be switched off. We also keep a record of the cookie choice you made (orveil_consent) for 12 months.

Analytics (only with your permission). First-party, cookie-free usage events about how the studio is used when you are signed in, and visit notifications sent to Orveil when someone opens our website or a delivered gallery: the page, referrer, browser, device, screen size, language, IP address, and an approximate location and network provider looked up from that IP address (through Vercel and ipwho.is). These notifications go to Orveil only, not to photographers. We do not store them in our database, except a short counter keyed to the IP address that we use to stop abuse. Nothing runs until you choose Accept all or enable Analytics under Manage, and our servers refuse to record these events without that choice. We honor the Global Privacy Control browser signal as an opt-out.

Photographers see how many times a delivered gallery was viewed. These counts use the random ID that the gallery keeps on your device (orveil_gsid, which also remembers your favorites), not your name or IP address, and are part of delivering the gallery.

We do not use advertising cookies, cross-site tracking, or sell personal information. You can change your choice at any time via Cookie settings in the site footer or in your account settings; your previous choice is replaced and no further optional data is collected.

8. Children’s privacy

Orveil is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us and we will investigate and take appropriate action.

9. International users

Orveil may be hosted or operated using providers located in the United States. If you access the Service from outside the United States, you understand that your information may be transferred to and processed in the United States and other jurisdictions where our providers operate.

10. Changes to this Policy

We may update this Policy from time to time. If we make a material change, we will update the date at the top of this Policy and provide notice through the Service or by email where appropriate. Your continued use of Orveil after the updated Policy takes effect means the updated Policy applies going forward.