Privacy policy

Account details (name, email, studio), billing and payment information, uploaded media metadata, client records the studio submits, support conversations, and review content.

For the platform to run safely we also record operational signals: IP address, device and browser type, authentication events, page activity, and logs that help us spot and stop abuse.

To create and manage accounts, authenticate users, deliver galleries, process invitations and payments, send notifications, answer support tickets, and keep the service reliable.

Operational and diagnostic data is used to investigate suspicious behaviour, reduce abuse, understand how features are actually used, and decide what to build next.

Studios are responsible for the data they upload or enter — client names, contact details, project notes, and media files. In practice the studio is the party deciding what is shared with its own clients.

Invited clients and recipients may open galleries, download files, leave reviews, or answer invitations. Their activity is logged and tied back to the studio account that invited them.

We rely on infrastructure, hosting, storage, analytics, support, messaging, authentication, and payment providers. We share data with them only to run the platform.

Those providers act on our behalf under the contracts and obligations appropriate to the services they perform. We do not sell data to third parties.

Account, transaction, and operational records are kept for as long as needed to run the service, meet legal duties, resolve disputes, and keep security logs useful.

When an account or its content is deleted, parts of archived and backup records can survive for a limited time before they are rotated out of our systems.

Sessions are authenticated, access is restricted by role, and important actions are audited. We take regular backups and use providers with infrastructure-level safeguards. No internet service is perfectly secure, and we do not claim otherwise.

Security is also a studio habit: strong passwords, limited team access, and care about who a gallery link is shared with go a long way.

Orivu and our providers may process data outside the country where it was collected — including, for many clients, in other regions entirely. We work with providers whose practices are appropriate for cross-border work.

You can request access to, correction of, export of, or deletion of personal information, subject to the platform’s obligations, studio responsibilities, and applicable law.

Send requests to privacy@orivu.studio. For sensitive requests we may verify your identity before acting.