Legal

Privacy Policy

Last updated October 2026

Slancio is a business management app for independent wedding and event photographers. This page explains what we collect, why, and how it's handled — for both photographers using the app and their clients, who interact with Slancio through shared links and, optionally, a lightweight client account.

Who this covers

• Photographers — the app's account holders, identified and authenticated through our identity provider (Auth0).
• Clients — couples and event clients who interact with a photographer through a shared chat or gallery link, or by claiming their booking with an Order ID to set up a lightweight client account (just a phone number and name — no app install required for link-only access).

What we collect

What we collect depends on whether you're a photographer running your business through Slancio, or a client interacting with a photographer through a shared link or lightweight account.

From photographers

• Account & profile data — name, age, phone number, studio name, and email (managed through Auth0), plus location, service area, bio, style tags, price range, and optional Instagram/Facebook handles.
• Unique username/ID — every photographer account has a mandatory unique username that identifies your public profile and bookings.
• Booking data — couple names, venue, dates, budget notes, and other client and booking information you enter or that's extracted from pasted inquiry text. This syncs automatically to the cloud and can be restored if you reinstall the app or switch devices.
• Chat messages — messages exchanged with clients and with the AI chatbot, capped at 5,000 characters per message and retained for 7 days before being automatically purged.
• Gallery photos & videos — media you upload for a booking, stored on our object storage provider (Cloudflare R2) and shared with your client via a private link or QR code.
• Identity verification data — if you opt into the Verified Badge, your government ID document is submitted during that verification flow. We store only a one-way hash of your identity reference and the resulting verification status — never the raw document itself.
• Phone verification data — your phone number is sent to our SMS provider (Twilio) to deliver a one-time verification code. We store only a one-way hash of the number, not the number itself.
• Payment & subscription data — your plan tier and subscription status, processed by Google Play, Apple, and RevenueCat. We never see or store your card details ourselves.
• Device push notification tokens — used to deliver booking and message notifications to your device.
• Camera & photo library access — used only when you choose to take or upload a photo for a booking gallery. We don't access your camera or photos in the background.
• Crash & performance diagnostics — basic technical data (device type, OS version, and crash reports) collected to keep the app stable.
• IP address & usage logs — collected for security, abuse prevention, and diagnosing issues.
• Referral activity — if you take part in the referral program, we track referral links and their outcomes.

From clients

• Phone number & name — provided when claiming a booking with an Order ID or setting up a lightweight client account.
• Reviews — any review you write about a photographer.
• Chat messages — messages with your photographer and with the AI chatbot.
• Photo access logs — a record of when a shared gallery is viewed.

From both photographers and clients

• Reported content — chat reports and other moderation flags, if something is reported.
• Account warnings & suspension history — kept for photographer accounts only, as part of our moderation process.

How we use it

• To operate the booking pipeline, client chat, and gallery delivery features you use directly.
• To enforce your plan's active-booking limits and gallery storage quota.
• To display your Verified Badge status on your public Discover profile, if you've completed verification.
• To back up and sync your booking and pipeline data across devices and reinstalls.
• To generate AI chatbot responses to your questions and your clients' questions.

Who we share it with

We use a small set of specialist providers to run the app, and share only what each one needs to do its job:

• Auth0 — authentication and sign-in. Receives your email or phone number and manages your login session.
• Twilio — delivers SMS verification codes. Receives your phone number only to send that code.
• RevenueCat — subscription and payment status.
• Cloudflare R2 — photo and video storage, uploaded directly from your device via a short-lived, single-use upload link.
• Amazon Web Services (AWS Lightsail) — hosts our backend servers and managed PostgreSQL database, in AWS's Mumbai, India (South Asia) region.
• Google Gemini — processes AI chatbot conversations; message content is sent to Gemini to generate a response.
• Resend — sends transactional emails, like booking and account notifications.
• Google Play & Apple — handle subscription billing through their respective app stores.

This website (separate from the app) also calls Frankfurter, a free, no-signup currency-conversion API sourced from European Central Bank rates, to show approximate local pricing to visitors outside India. No account or personal data is sent — only the ordinary request information any web call includes (such as your IP address) reaches Frankfurter, and the converted rate is cached in your browser's local storage for an hour so we don't call it more than necessary.

We do not sell your data or your clients' data to third parties.

International data transfers

Our backend and database are hosted in AWS's Mumbai, India region. A few of the specialist providers listed above do operate servers outside India — including Cloudflare, Google (Gemini), and Resend. Where your data is transferred internationally, we rely on the standard contractual and security safeguards those providers offer to protect it in transit and at rest.

Children

Slancio is intended for people 18 and older, consistent with the account eligibility requirement in our Terms of Service. We don't knowingly collect personal data from children, and a client's lightweight account requires only a phone number and name provided by an adult claiming their own booking.

Deleting your account

To delete your account, go to Profile › Delete Account in the app. This starts a 14-day restore window — logging back in during that time cancels the deletion. After 14 days, your profile, booking data, chat history, and galleries are permanently erased, except for records we're required to keep for longer (see Data retention & deletion below).

Your client's data

A client's chat messages and gallery access are scoped to a single private link tied to their booking. Clients can optionally claim their booking with an Order ID to set up a lightweight account using just a phone number and name — this is what lets you write reviews, keep chat history across devices, and track photo access, without a full sign-up. Either party can block a chat thread, which stops new messages without deleting history.

Data retention & deletion

• Chat & chatbot conversations — retained for 7 days, then automatically purged.
• Account deletion — starts a 14-day restore window; logging back in during that window cancels the deletion. After 14 days, your data is permanently deleted.
• Suspended accounts — you have a 7-day window after suspension to export your data before it's removed.
• Payment & transaction records — kept for 7 years to meet tax and legal obligations, even after account deletion.
• Gallery photos — deleted when a gallery is removed manually, or after a 14-day grace period if the subscription tied to it lapses.

Security

Access to bookings, chat, and galleries is tied to your authenticated identity — never to a client-supplied or request-supplied value. Identity and phone references are stored as one-way hashes rather than raw values.

Your rights under India's DPDP Act (Indian users)

If you're in India, the Digital Personal Data Protection Act, 2023 gives you rights over your personal data:

• Right to access — a summary of the personal data we hold about you and how it's processed.
• Right to correction & erasure — correct inaccurate data, or ask us to erase it, subject to the retention exceptions described below.
• Right to grievance redressal — raise a complaint about how your data is handled and get a response.
• Right to nominate — nominate another individual to exercise these rights on your behalf in the event of death or incapacity.

To exercise any of these rights or raise a grievance, contact us at admin@slancio.site.

Your rights under GDPR (EU users)

If you're in the EU, data protection law gives you specific rights over your personal data. Here's what they mean in practice:

• Right to access — you can request a copy of the personal data we hold about you.
• Right to erasure — you can ask us to delete your account and associated data. Deletion follows the 14-day restore window and retention exceptions described above (e.g. payment records kept for legal compliance).
• Right to rectification — you can correct inaccurate or incomplete personal data at any time.
• Right to data portability — you can request your data in a structured, commonly-used format to move to another service.
• Right to object to processing — you can object to us processing your data in certain circumstances, and we'll honor that unless we have a compelling legal basis to continue.

To exercise any of these rights, contact us using the details below.

Contact us

Slancio is operated by Slancio LLP. Questions about this policy or a request to delete your data can be sent to admin@slancio.site.