Privacy Policy

1. Introduction

This Privacy Policy is published by DeGroot Labs Private Limited, a company incorporated under the laws of India with its registered office in Hyderabad, Telangana ("Company", "we", "our", or "us").

This Policy explains how we collect, use, disclose, and safeguard your information when you use JOSSTE, our cloud-based studio collaboration platform, accessible at josste.com and its subdomains (the "Service").

Where our Users (photographers, studios, and organisations) upload content to be shared with their clients, we act as a Data Processor on their behalf. For account and billing information of our direct customers, we act as a Data Controller.

2. Information We Collect

A. Information You Provide

• Account Information: Name, email address, phone number, and profile details provided during registration or via third-party authentication (e.g., Google OAuth).
• Billing Information: Payment and invoicing details, processed securely by our third-party payment processor (Stripe). We do not store full payment card numbers on our servers.
• Media Assets: Photos, videos, and associated metadata (including EXIF data such as camera settings, timestamps, and geolocation if embedded) uploaded by Users.
• User-Generated Content: Comments, annotations, and selection preferences made within the Service.

B. Information Collected Automatically

When you access the Service, we may automatically collect:

• IP address, browser type, operating system, and device information.
• Usage data such as pages visited, features used, assets viewed, and interaction timestamps.
• Session information for security and access control purposes.

3. Legal Basis for Processing

We process your personal data on the following lawful bases:

• Contractual Necessity: To provide, operate, and maintain the Service as agreed in our Terms of Service (e.g., account management, media hosting, collaboration features).
• Legitimate Interests: To improve the Service, monitor for security threats, prevent fraud, and ensure platform stability — where such interests are not overridden by your rights.
• Legal Obligation: To comply with applicable laws, regulations, or enforceable governmental requests.
• Consent: Where required by law, we obtain your explicit consent before processing (e.g., for marketing communications). You may withdraw consent at any time.

4. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Facilitate collaboration between photographers and their clients.
• Process transactions and manage subscriptions.
• Send transactional notifications (e.g., gallery shared, comment received).
• Monitor for security threats, enforce access controls, and prevent abuse.
• Improve the Service and develop new features.
• Comply with legal obligations.

We do not use your media assets or personal data for advertising, profiling, AI model training, or any purpose unrelated to providing the Service.

5. Cookies & Similar Technologies

The Service uses cookies and similar technologies for the following purposes:

• Strictly Necessary: Authentication session cookies and tenant identification cookies required for the Service to function. These cannot be disabled.
• Security: Cookies used to detect and prevent unauthorised access and fraudulent activity.

We do not use third-party advertising or tracking cookies. We do not engage in cross-site tracking or behavioural profiling.

6. Sharing of Data

We do not sell, rent, or trade your personal data. We share information only with the following categories of third-party service providers ("sub-processors"), strictly to the extent necessary to provide the Service:

• Cloud infrastructure and object storage providers
• Authentication and database service providers
• Email delivery service providers
• Payment processors

All sub-processors are bound by data processing agreements that require them to protect your data to standards no less stringent than those described in this Policy. A list of current sub-processors is available upon request by contacting us.

We may also disclose your information if required by law, court order, or to protect our legal rights.

7. International Data Transfers

Your data may be processed and stored in countries other than your country of residence, including India, the United States, and the European Economic Area. Where we transfer personal data across borders, we ensure appropriate safeguards are in place, including standard contractual clauses or equivalent mechanisms recognised under applicable data protection laws.

8. Data Storage & Security

We implement industry-standard technical and organisational measures to protect your data, including:

• Encryption of data in transit (TLS) and at rest.
• Private, access-controlled storage for all media assets with time-limited, authenticated access tokens.
• Database-level access controls ensuring strict tenant isolation — each organisation's data is logically separated and inaccessible to other tenants.
• Continuous security monitoring and logging of access events.

No method of electronic storage or transmission is 100% secure. While we strive to use commercially reasonable means to protect your data, we cannot guarantee absolute security.

9. Data Retention

We retain your account information for as long as your account is active or as needed to provide the Service. Media assets are retained until deleted by the User (photographer/studio) or until the account is closed.

Upon account termination, we will retain your data for a reasonable period (not exceeding 90 days) to allow for data export, after which it will be permanently deleted from our systems, unless retention is required by law.

10. Your Data Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data, subject to legal retention obligations.
• Portability: Request a machine-readable copy of your data for transfer to another service.
• Restriction: Request that we limit the processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Complaint: Lodge a complaint with a relevant data protection authority in your jurisdiction.

We will respond to verified requests within 30 days. To exercise any of these rights, please contact us at [email protected].

For California Residents (CCPA/CPRA): We do not sell or share your personal information as defined under the California Consumer Privacy Act. You have the right to know, delete, and opt-out. You may exercise these rights using the contact information above.

11. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a person under 18, we will take steps to delete such data promptly. If you believe a minor has provided us with personal data, please contact us immediately.

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authorities and affected individuals without undue delay, and in any event within 72 hours of becoming aware of the breach, in accordance with applicable laws.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you via email or a prominent notice on the Service at least 30 days before the changes take effect. Continued use of the Service after the effective date of a revised Policy constitutes acceptance of the changes.