Privacy Policy Version 3 · prepared 2026-10-31 What personal information GenieGalleries collects, why, who it is shared with, how long it is kept, and how to exercise your rights. Who is responsible GenieGalleries is operated by the legal entity identified before payment and on your booking receipt: - Legal operator: GenieGalleries - Business address: 291 St Anne Rd, Winnipeg, MB - Email: support@geniegalleries.ca · Phone: 2049971940 Send privacy requests through Support@GenieGalleries.ca with the subject "Privacy request", or our contact form (/contact). They are routed to the person responsible for privacy at GenieGalleries. What we collect - Account and contact details: name, email, phone, password (stored only as a one-way hash), and sign-in and security records. - Age and guardian confirmations you give when you sign up or book. - For photographers: application, portfolio, profile and availability details, payout details, and seller or tax information where the law requires it. - Booking details: package, date, location, your shoot brief, and messages sent through the platform. - Payment status and transaction records. Card details are handled by our payment provider, not stored by us. - Support, complaint, satisfaction and refund records. - Gallery images, file information, and consent or release records. - Affiliate referral records (which partner referred a visit or booking). - Technical data: the cookies and similar storage described in our Cookie Notice (/cookies), and security logs. We store hashed, not raw, IP addresses in download and acceptance records. Why we use it To create and manage accounts; match and book shoots; take payments and pay photographers; deliver and protect galleries; provide support, safety reviews, complaint handling and refunds; prevent fraud and abuse; keep the service secure; and meet legal, tax, accounting and platform-reporting obligations. We send marketing only if you have opted in or another lawful basis applies. Who we share it with - Your photographer: only the booking and contact details needed for a shoot they have accepted. Messaging stays on the platform. - Service providers that run GenieGalleries: Stripe (payments and photographer payouts), Vercel (hosting), Neon (database), Cloudflare R2 (photo and file storage), and Resend (email delivery), and Mailchimp by Intuit (our marketing audience: it holds your email address, name, city and province, your role and account status with us, and your marketing choice, so that we send marketing only to people who have opted in; it sends marketing email only to those people). If Google or Apple sign-in is offered and you use it, that provider is involved in signing you in. - Meta Platforms (Facebook and Instagram), only if you accept advertising cookies: see Cookies and analytics below. - Affiliates: only what is needed to credit a referral. They do not receive your booking details. - Regulators, law enforcement or others where the law requires it, or where needed to protect someone's rights or safety. We do not sell or rent personal information. We never use private gallery images for marketing unless you give separate permission for that gallery. Where it is stored, and how it is protected Some of these providers process or store information outside your province or outside Canada, including in the United States. We use contractual, technical and organizational safeguards with them. Staff access is limited by role and administrative actions are logged. Data is encrypted in transit. Galleries are private and delivered through short-lived links. Tax identifiers and private gallery addresses are never shown on public pages or written to ordinary logs. Marketing choices Booking confirmations, payment notices, gallery notifications, security messages and case updates are operational messages about your account and bookings. Marketing email or text is separate, optional and off unless you turn it on. We record when and how you agreed and the wording you saw. Every marketing message identifies us and includes a working unsubscribe link, and we act on an unsubscribe without delay and within 10 business days at most. If you sign up for our photographer resources (such as the Business Playbook), we send your email address, the first name you give us, the date, the page you signed up on and the campaign that brought you to Mailchimp, which stores them and sends those emails for us. Applying to photograph with us does not sign you up for marketing email. When you create an account or apply to work with us, we also record you in our Mailchimp audience as a non-marketing (transactional) contact, with your name, city and province, your role and account status, and whether you have opted into marketing. This lets us keep marketing lists accurate and honour your choice everywhere. You receive marketing email only if you opt in, on sign-up or in your account settings, and you can change that choice there or with the unsubscribe link at any time. Unsubscribing in Mailchimp is recorded on your account as well. Access, correction, deletion and retention You can ask to see or correct your information, or to delete your account, from your account settings or through the privacy contact above. We verify your identity in proportion to the request. When you ask to delete your account we disable it promptly and complete deletion or archiving within 30 days where feasible. Records we must keep for tax, accounting, payments, security, legal claims or other legal duties are kept with restricted access and deleted or anonymized when that purpose ends. Tax and accounting records are generally kept for six years from the end of the tax year they relate to. Delivered galleries currently stay available while we finish our retention system. When it starts, galleries will be available for 90 days after delivery plus a 30-day Last Chance Recovery period, and we will give you notice before any existing gallery expires. Please download your photos. If you unsubscribe, we keep only what is needed to respect that choice. Photographers: seller reporting If GenieGalleries is a reporting platform operator under Canada's digital-platform reporting rules and you are a reportable seller, we may need your legal name, primary address, tax residence, tax identification number (where required), and the payments you received, and we may have to report them to the Canada Revenue Agency. We will tell you what we need and why. Access to this information is restricted, and tax numbers are used and disclosed only as the law allows. If legally required information is not provided, we may have to pause new bookings or payouts until it is. Cookies and analytics Advertising measurement is optional and off unless you accept it in our cookie banner. If you accept, Meta learns which of our public pages you visited (never a private link), the campaign that brought you, and when you completed a photographer or affiliate application or paid for a booking (with the amount). To match that to an ad, we also send Meta its own browser cookies, your device's network address and browser type, and a one-way hashed (SHA-256) copy of your email address; never your name, phone number, address, application answers, files, photos or card details. Meta acts under its own terms and may process this in the United States. Your choice applies in our servers too, and you can withdraw it at any time on the Cookie Notice (/cookies). Gallery content and sensitive booking details are never used for ad targeting. If something goes wrong Staff and providers must report suspected security incidents promptly. We contain them, preserve evidence, assess the harm, notify regulators and affected people where the law requires it, and keep a record of every breach for at least two years. Complaints If you are not satisfied with how we handled a privacy request, you may contact the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.