Privacy Policy

This Privacy Policy explains how Zaiya ("Zaiya," "we," "our," or "us") collects, uses, shares, and protects personal information when you use zaiya.studio, the Zaiya application, public gallery links, the Atrium for clients and planners, forms, proposals, invoices, and related services (together, the "Service").

Summary. Zaiya collects account information, studio workspace content, client and planner records, gallery and file metadata, billing records, support messages, and basic usage data so we can provide and secure the Service. We do not sell personal information. We use trusted service providers such as Supabase, Stripe, Resend, Cloudflare, Vercel, and, when enabled by you, Google.

This policy is provided for transparency and is not legal advice. If you have questions, contact us at hello@zaiya.studio.

1. What Zaiya Is

Zaiya is a studio workspace for luxury wedding photographers. The Service helps photographers manage clients, planners, galleries, proposals, contracts, invoices, payments, files, communication, and workflow automations.

2. Controller And Processor Roles

For information about your own Zaiya account, subscription, and use of the Service, Zaiya generally acts as the controller. For personal information you upload about your clients, planners, vendors, collaborators, and wedding guests, you generally act as the controller and Zaiya acts as your processor or service provider.

You are responsible for giving your own clients and collaborators any privacy notices and consent requests required for your photography business. Zaiya processes that data to provide the Service to you.

3. Information We Collect

3.1 Account And Workspace Information

• Name, email address, authentication credentials, and user ID
• Workspace name, studio profile, business details, and preferences
• Subscription, plan, usage, and account status

3.2 Studio Content You Add

• Client, planner, vendor, and collaborator records
• Event details, timelines, notes, moodboards, files, and messages
• Gallery records, image metadata, favorites, and access settings
• Proposals, packages, invoices, payments, and contract content
• Blog posts, forms, public pages, and other content you publish

3.3 Atrium And Public Link Data

When clients, planners, or guests use the Zaiya Atrium, gallery share link, proposal, invoice, contract, public studio profile, or form, we may process the information they submit, the records they access, timestamps, IP address, browser user-agent, and audit information needed to provide the requested experience. Public studio profile inquiries are saved in the studio's workspace and relayed to the studio's private contact address so the studio can respond.

3.4 Payments

We use Stripe for subscription billing and, when enabled, studio-owned invoice payments. Stripe processes card and bank payment information. Zaiya does not store raw card numbers.

3.5 Integrations

If you connect Google, Stripe, Gmail, Calendar, gallery hosts, or other integrations, we process the tokens, identifiers, settings, and content needed to provide those integrations. Google API data is used only to provide user-facing features you request and is not used to train generalized AI models.

When a studio owner or administrator connects Gmail, Zaiya requests permission to send email and identify the connected Google account. We use the account email address, encrypted authorization tokens, granted permissions, and token expiry to maintain that connection. We send the recipients, subject, message content, and attachments you choose in Zaiya to Google to deliver client communication and the workflow emails you enable. We retain the outgoing messages and delivery identifiers in your studio's email history and delivery records. Zaiya does not request access to read your Gmail inbox, import mailbox history, or read incoming replies through this connection. Google Calendar uses a separate connection and its own permissions.

You can disconnect Gmail in Settings → Integrations or revoke Zaiya's access in your Google Account. Disconnecting removes the stored Gmail connection tokens and stops future Gmail sends; it does not erase messages already sent or the studio's existing email history. Those records follow the retention and deletion practices below. You can contact us to request deletion of your data.

Zaiya's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use this information to provide the connected features you request, with our hosting and storage providers as needed to operate those features. We do not sell Google user data, use it for advertising, or use it to train generalized AI models. Human access is limited to your affirmative agreement, necessary security or legal purposes, or aggregated internal operations permitted by that policy.

3.6 Support, Contact, And Marketing

If you contact us, join a waitlist, submit a form, or subscribe to updates, we collect the information you provide, such as name, email, studio name, message content, and source page.

3.7 Usage, Logs, And Device Data

We collect standard technical information such as IP address, user-agent, requested URL, timestamps, error logs, and aggregate product usage. We use this to operate, secure, troubleshoot, and improve the Service.

4. How We Use Information

• Provide, maintain, and secure the Service
• Create accounts, authenticate users, and manage workspaces
• Operate the Atrium and deliver galleries, proposals, invoices, contracts, and forms
• Process subscriptions and connected payment workflows
• Send transactional emails, opt-in client activity notifications, and support replies
• Respond to contact requests and product inquiries
• Detect abuse, fraud, spam, security incidents, and outages
• Comply with legal obligations and enforce our Terms
• Improve the Service using aggregated or de-identified information

5. AI Features

Zaiya may offer AI-assisted drafting, summaries, and workflow tools. These tools are intended to help you draft or organize content; you remain responsible for reviewing outputs before sending them to clients or collaborators. We do not use your client records or studio content to train generalized AI models.

When you choose Generate with AI for a contract, Zaiya sends the selected client and shoot details, the contract text or instructions you submit, and a limited drafting prompt to Anthropic. The generated text is returned for your review and is not sent or signed automatically. Do not include secrets, payment credentials, or private access links in contract instructions. Provider processing is subject to Anthropic's applicable terms and retention practices.

Ask Zaiya uses published Help Center articles to answer product questions. When you ask a question, we may send that question, up to three earlier questions from the current conversation, a broad product-section hint, and relevant help articles to Anthropic to generate a response. The assistant does not retrieve your private client records, invoices, contracts, files, or messages. Do not include sensitive information or private access links in your questions.

Zaiya does not store Ask Zaiya conversations in its database. The current conversation remains in the open browser panel until you clear or close it. We retain operational usage and article-feedback information without question text, and use hashed request identifiers for abuse limits. AI provider processing is subject to the provider's applicable terms and retention practices. If you contact human support, the message and reply address you review and submit are sent to our support inbox; the AI conversation is not automatically attached.

6. How We Share Information

We share personal information only as needed to provide the Service, comply with law, protect rights and security, or complete a business transaction such as a merger or acquisition. We do not sell personal information or share it for cross-context behavioral advertising.

7. Legal Bases For Processing

Where GDPR, UK GDPR, or similar laws apply, our legal bases may include contract performance, legitimate interests, consent, and legal obligations. For client and collaborator data you add to your workspace, you are responsible for identifying the lawful basis for your own photography business.

8. Data Retention

We keep personal information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Active workspace content is retained while the workspace remains active. After account cancellation or deletion, we delete or de-identify data within a reasonable period unless retention is required by law, security, backup integrity, or payment records.

9. Security

We use technical and organizational safeguards including TLS, access controls, encrypted sensitive fields where appropriate, role-based permissions, monitoring, and service-provider controls. No system is perfectly secure, so you should use strong passwords, protect Atrium links, and grant collaborator access carefully.

10. Your Choices And Rights

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to certain processing of your personal information. California residents may also have rights to know, delete, correct, opt out of sale or sharing, and not be discriminated against for exercising rights. Zaiya does not sell or share personal information for cross-context behavioral advertising.

To make a privacy request, contact hello@zaiya.studio. We may need to verify your identity before fulfilling a request.

11. Cookies

Zaiya uses essential cookies and similar technologies for authentication, session management, security, workspace routing, and product functionality. We may also use limited analytics to understand aggregate usage and improve the Service.

12. International Transfers

The Service and its providers may process information in the United States, Canada, and other locations where our providers operate. When required, we rely on contractual safeguards or other lawful transfer mechanisms.

13. Children

Zaiya is not directed to children under 16 and we do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact us so we can take appropriate steps.

14. Changes To This Policy

We may update this Privacy Policy from time to time. The "Last updated" date shows when the latest version took effect. Material changes may be communicated by email, in-app notice, or posting on this page.

15. Contact

Questions or requests about this Privacy Policy can be sent to hello@zaiya.studio.

This policy should be reviewed by counsel for your operating entity, jurisdiction, and commercial launch requirements.