A child's photos resolve to one code
Galleries are reached through the code printed on that child’s card. There is no browsable index of children, and no public gallery URL — the photo files themselves sit in private storage, not on the open web.
Security & data protection
Written to be read by a school’s data protection officer as much as by a photographer. If something here isn’t clear enough for your DPO, tell us and we’ll fix the page.
Galleries are reached through the code printed on that child’s card. There is no browsable index of children, and no public gallery URL — the photo files themselves sit in private storage, not on the open web.
Every uploaded image is watermarked automatically, before any parent can view it. Full-resolution files are released only after purchase.
Every record carries the studio it belongs to. For the things a school asks about — photographs, galleries, access codes and family addresses — that separation is enforced inside the database itself, not only in the interface.
Payments run through Stripe into the studio’s own connected account. Card data does not pass through Liteflow, and we never hold the studio’s money.
A sale window ends on a set date in the studio’s own timezone, and the job archives automatically afterwards.
Removed users are purged after a grace period, and communications data can be exported or erased on request.
The formal answers
| Question | Answer |
|---|---|
| Who is the data controller? | For the photographs and the families they belong to, the photography studio is the controller and Liteflow is the processor acting on its instructions. Liteflow is the controller only for its own direct-customer data — the studio’s own account. This is set out in full in our privacy notice. |
| Where is data hosted? | The database is in London (AWS eu-west-2). The application runs in London and Paris. A few of the providers we rely on sit outside the UK and EEA; those transfers run under the UK International Data Transfer Addendum or standard contractual clauses. |
| Who are the sub-processors? | A small number of providers, for hosting, payments, email and text messages. We will give your DPO the current list on request — we would rather answer accurately on the day than publish a list here and let it drift out of date. |
| How long is data kept? | A job’s gallery closes at the end of its sale window and archives automatically. Tenant content is retained for 90 days after an account ends, and longer only where billing and tax law requires it. |
| Can data be exported or erased? | Yes. Communications data can be exported, removed users are purged after a grace period, and erasure requests are handled through the studio as controller. |
| What certifications do you hold? | None, and we would rather say so than imply an accreditation we do not have. What we can do is answer a specific question from your DPO directly. |
The full legal position, including the controller/processor split and how transfers outside the UK are handled, is in our privacy notice and terms.
Send them our way. We'd rather answer a DPO directly than have you guess on our behalf.
Get in touch