Privacy policy

1

Who we are

PopStudio is operated by System Advance Limited, a company incorporated in New Zealand. We serve customers in New Zealand and Australia.

PopStudio is software that event organisers use to run a pop-up photo station: a real photographer with a real camera tethered to a laptop. Guests scan a QR sign, check in on their phone, get a five-character code, have their photo taken, and receive a link to their photos by email about a minute later.

This policy covers both sides of that: the organisations who hold PopStudio accounts, and the guests whose photographs pass through it.

2

What we collect from customers

When your organisation creates an account we collect:

• Your name and email address.
• Your organisation name, industry and country.
• An optional description of what you want to use PopStudio for.
• A password hash — a one-way scramble. We never store your actual password and cannot recover it for you.
• Event settings you configure: event names, dates, retention period, your overlay.
• Basic operational logs needed to run and secure the service.

For this information, we are the agency under the Privacy Act 2020. We use it to give you an account, verify you, run your events, send receipts and cap warnings, and answer your support requests.

3

What we collect from guests

When a guest checks in at an event, PopStudio holds:

• Their name.
• Their email address, so the photos can be sent to them.
• The five-character code issued at check-in, which is how photos are joined to a guest.
• The photographs taken of them at that event.
• Timestamps: when they checked in, when the photos were taken, when they were delivered.

That is the whole list. We do not ask for a phone number, an address, a date of birth, an age, a gender, or anything else. We do not ask for anyone else's contact details. We do not buy data about guests, and we do not enrich or append anything to what a guest typed in.

4

We do not collect biometric information

Photographs are images. We treat them as images: we develop them, resize them, put them behind a link for the guest, and delete them on schedule. Nothing analyses the face in them.

The way a guest gets their photos is deliberately boring — the guest checks in, gets a five-character code, and the operator types that code before shooting. A human matching a code, not a machine matching a face. This is a design decision, and it is one we are not planning to revisit.

We also do not permit customers to run face recognition against PopStudio output. That is in our acceptable use terms.

5

How we use information

We use guest information for exactly one thing: delivering the guest's photos and running the event the organisation asked us to run. That means matching the code to the person, developing and storing the photographs, emailing the link, serving the photo page, and deleting everything on schedule.

We use customer information to operate your account: authentication, verification, billing, event administration, support, security, and service notices.

We do not sell personal information. We do not share it with advertisers. We do not use guest photographs or guest details to train machine-learning models, ours or anyone else's. We do not use guest photographs in marketing without separate written permission from the customer who owns them.

6

Our role: agent for the organisation running the event

This matters for three practical reasons.

• Who to ask. If you are a guest and you want to know why a photo was taken, or you want it corrected or removed, the organisation that ran the event is the place to start — although you can also just delete your photos yourself, see below.
• Who tells you what. The organisation is responsible for its own privacy statement and for the notice it gives you at the event.
• Offshore storage. Because we hold the information solely as the organisation's agent, and our sub-processors hold it solely as ours, storing it on infrastructure outside New Zealand is not a disclosure under information privacy principle 12. The information stays with the organisation as its holder. We still hold our sub-processors to protective standards, as described below.

Where an organisation is covered by the Australian Privacy Act 1988, the same structure applies: they are the APP entity, and we act for them.

7

Sub-processors we use

We keep this list short on purpose. Every name here is a company we could not run without.

That is the entire list. There are no advertising networks, no analytics providers, no session recorders, no marketing pixels and no data brokers in PopStudio. If that ever changes we will update this page and email account holders before it takes effect.

8

Where data is stored, and international transfers

PopStudio runs on Cloudflare's global network. Data is held in Cloudflare's D1 database and R2 object storage, and may be stored on or served from servers outside New Zealand and Australia. Current storage region configuration: [storage region setting to be confirmed].

As explained above, because we hold guest information solely as the customer organisation's agent, and Cloudflare holds it solely as ours, this arrangement is not an IPP 12 disclosure — the organisation remains the holder throughout.

That does not get us off the hook for looking after it. We only use sub-processors who are contractually bound to protect personal information, to process it only on our instructions, to keep it secure, and not to use it for their own purposes. For Australian customers, we take reasonable steps consistent with APP 8 in choosing and contracting with them.

9

Retention and automated deletion

Photographs delete themselves. The default retention period is 30 days from the event. The organisation running the event can set it to 7, 30, 90 or 365 days instead, depending on their plan and their own policy.

An automated job runs daily and purges everything past its retention date: the stored image objects, and the guest records that go with them. It is not a flag in a database that hides the photo. The objects are removed.

Customer account records are kept while the account is open. When you close your account we delete your events, guests and photographs through the same purge process. We keep financial and tax records for as long as New Zealand law requires us to, and minimal security logs for a short period so we can investigate abuse.

10

Guests: deleting your own photos

Every guest photo page has a delete button. You do not need to email anybody, prove who you are, or wait for an organiser to get back to you.

• Open the link that was emailed to you.
• Scroll to the bottom and choose to delete your photos.
• Confirm.

It is immediate and it is permanent. The stored image objects are removed. We cannot restore them, and neither can the organiser. If you want to keep a copy, download it first.

Deleting your photos does not delete any copy the photographer kept on their own camera card or laptop — that is theirs and outside PopStudio. Ask them directly about that.

There is a fuller walkthrough written for guests on our guest help page.

11

Your rights under the Privacy Act 2020 and the Australian Privacy Principles

In New Zealand, the Privacy Act 2020 gives you the right to ask for access to personal information held about you, and the right to request correction of it. In Australia, the Australian Privacy Principles give you equivalent access and correction rights under APP 12 and APP 13.

How to use them with PopStudio:

• If you hold a PopStudio account (a customer), email privacy@popstudioapp.com. We are the agency for your account information and we will respond directly. New Zealand law gives us 20 working days; we aim to be much faster than that.
• If you are a guest, the organisation that ran the event is the holder of your information, so start with them. If you cannot reach them, or you are not sure who they are, email us anyway — we will help you identify the right organisation and pass the request on, and we will tell you what we did.

We will ask you to verify your identity before we release personal information, because handing it to the wrong person is its own privacy breach. There is no charge for a request.

12

How we protect information

• Everything travels over HTTPS. Photo links are served over TLS.
• Passwords are stored as one-way hashes, never in readable form.
• Guest photo pages are reached through unguessable links rather than public URLs, and are scoped to that guest's own photographs.
• Access to production data is limited to the people who need it to operate the service, and is used for operating and supporting the service — not for browsing.
• Storage and database access run through scoped credentials rather than shared logins.
• Retention limits are enforced by an automated daily purge rather than by anyone remembering to do it.

No system is perfectly secure, and we will not claim otherwise. What we can say is that the surface is deliberately small: few sub-processors, little data collected, and a short life for everything we hold.

13

If something goes wrong: breach notification

If we become aware of a privacy breach affecting information in PopStudio, we will:

• Tell the affected customer organisation without undue delay, and aim to do so within 72 hours of becoming aware, with what we know at that point rather than waiting for a complete picture.
• Help them assess whether it is a notifiable privacy breach — one likely to cause serious harm — and support the notifications they need to make.
• Where we are the agency, for example for customer account information, notify the Office of the Privacy Commissioner and the affected people ourselves, as the Privacy Act 2020 requires.
• Meet the Notifiable Data Breaches scheme obligations under the Australian Privacy Act where they apply.
• Write up what happened and what we changed.

14

Cookies, analytics and tracking

Plainly: PopStudio sets a single essential session cookie, and runs no tracking of any kind.

• The cookie is named ps_session. It is set only when you sign in to a PopStudio account. It is HttpOnly, Secure and SameSite=Lax, and it expires after 30 days. Its only job is keeping you signed in.
• No analytics. No Google Analytics, no product analytics, no heatmaps, no session recording.
• No advertising. No ad pixels, no retargeting tags, no conversion trackers, no third-party fonts or scripts phoning home.
• Guests browsing their own photo page are not given a tracking cookie at all.

That is also why the site loads as fast as it does. There is nothing on it that is watching you.

15

Children's information

PopStudio accounts are for adults. You must be at least 18 to hold one.

Children do get photographed at events — that is the reality of church youth nights, school events and family fun days — so we will be plain about what the platform does and does not do about it.

That means the organisation running the event is responsible for obtaining whatever parental or guardian consent its own policies and the applicable law require, before anyone is photographed. This is set out in the Terms of Service. It is their obligation, not ours, and nothing in the product substitutes for it.

What we do is narrower. No guest is photographed unless they choose to check in and present their code. Nothing biometric is collected. Photos are delivered only to the address that guest entered, and are never published in a public gallery. Everything deletes itself at the end of the retention period the organisation set.

If you are a parent and you want your child's photos gone, you can use the delete button on the photo page yourself. It works immediately, and you do not need anyone's permission. If you do not have the link, ask the organisation that ran the event, or email us at privacy@popstudioapp.com and we will pass the request to them and help them action it.

16

Complaints

Start with us. Email privacy@popstudioapp.com with what happened. We will acknowledge it quickly and give you a substantive answer, and if we got something wrong we will say so.

If you are not satisfied, you can complain to the regulator.

• New Zealand — Office of the Privacy Commissioner. privacy.org.nz. They can investigate complaints about how an agency handled your personal information.
• Australia — Office of the Australian Information Commissioner. oaic.gov.au. The OAIC generally asks you to raise it with the organisation first.

Remember that for guest information the organisation that ran the event is the holder, so a complaint about how photographs at an event were collected usually belongs with them. We will not hide behind that — tell us and we will help you work out who to talk to.

17

How to contact us, and when this applies from

Privacy questions, access requests, correction requests and complaints: privacy@popstudioapp.com. Anything else: hello@popstudioapp.com.

Effective date: 31 July 2026. If we make a material change to this policy we will post it here and email account holders before it takes effect.