Last updated:
ShepShak services are provided by ShepShak Inc. and ShepShak Ltd. Contact: hello@shepshak.com. This policy explains how ShepShak uses account, photo, invitation and communication information.
Account and business details
We process your name, email, phone, address and profile details to operate your account, and bank, tax and business details and uploaded documents for seller registration and review. We receive this information through the forms you complete and the sign-in services you use.
Photos and the 24-hour window
Photographers upload photos for previews, selection and delivery of original files after purchase. Album access ends 24 hours after upload; the album and its files enter automatic deletion. A purchase does not extend this window. Downloaded copies remain on your device. Anyone you share the QR code or link with can access the album preview; keep the link private.
Sales and invitation records
Selected photos, orders, payments, refunds, earnings and invitation relationships are recorded to operate the service. A free inviter can see a registrant’s display name and joined status; invitations generate no earnings. Full card details are processed by the payment provider. When payment and sales-document services are used, necessary identity, tax, order and contact details may be shared with the relevant provider. Photo-access emails and invoices are different documents.
Document review
Verification information is requested only as required for the service, account and applicable requirements; an activity document is not required from every user. Identity documents submitted on a payment provider’s own screens are collected by that provider. Activity or other verification documents uploaded directly to ShepShak are held in our private storage for authorized review and are not published. Verification status and provider account references are also processed.
AI assistant
Messages and selected images you send to the assistant are sent to OpenAI to generate a response. Chat images are not added to sales albums. Clearing a chat from your screen does not mean the service provider’s records are immediately deleted. Do not share passwords or full card details. Assistant feedback you separately approve and submit, including the related question, answer and note, is subject to a 30-day retention period for improvement and then enters cleanup. Do not assume that your entire conversation is automatically sent to support.
Communication and device information
Messages sent through Contact and team replies are stored to follow up your request. Cookies and browser storage support sessions, language preferences and invitations. Connection, device and usage records may be processed for security, troubleshooting and abuse prevention. We collect data through forms, uploads, conversations, sign-in and payment services, and technical usage records. Processing relies on applicable legal grounds such as contract performance, legal obligations, protection of rights and security/service-improvement interests balanced against your rights. Where consent is required it is obtained separately. Accepting the agreement or reading this policy is not marketing consent.
Service providers
We use Vercel for hosting, Google Firebase for sign-in and data storage, and OpenAI for AI features. When enabled, Cloudflare Turnstile helps prevent automated abuse. These providers may process the data needed for their services, including outside your country. Records needed to respond to legal requests may be shared with competent authorities. International processing must follow applicable transfer rules and required safeguards; you may request information about transfer arrangements at hello@shepshak.com.
Retention and security
The album’s 24-hour window does not cover account, business-document, transaction, invitation, communication or security records. Their retention depends on service needs, disputes and applicable legal obligations. We use access permissions, session checks and expiring file links to protect data; no internet transmission or storage method can guarantee absolute security.
Photo permission and children
Photographers must obtain the permissions needed for shooting and uploading. For photos of children, a parent or legal guardian must consent and receive the QR code. Photographers may not use customers’ photos in portfolios, social media or advertising.
Your rights and contact
You can request information about processing and recipients, access, correction or deletion of your data. Depending on applicable law, you may also have rights to object, restrict processing, portability, withdraw consent, contest automated assessments and lodge a complaint. Send requests and privacy questions to the address below. We may verify your identity to the extent needed; requests are assessed under applicable legal conditions.