Privacy Policy

1. Who We Are

ShotScout ("we," "our," or "us") is a photography planning service that sends forecasts, reports and alerts for the photo locations you choose. We are the data controller for the personal information described in this policy.

This policy explains what we collect, why, who we share it with, how long we keep it and the rights you have. We process personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you live in the European Economic Area, the EU GDPR also gives you the same rights.

2. Information We Collect

2.1 Information you give us

• Account details: your email address and password. Passwords are handled by our authentication provider and stored only in hashed form; we never see them.
• Base location: the coordinates and country of the place you travel from, which we use to work out travel times and local times.
• Photo locations: the spots you add, including the names you give them and their photo and parking coordinates.
• Alert rules and preferences: which phenomena you want alerts for, at which locations, and how you want to be notified.
• Community contributions: if you suggest a location, its name, its photo and parking coordinates and the photography types it suits.
• Support messages: anything you send us by email.
• Waitlist: if you join the waitlist before launch, your email address.

2.2 Information collected automatically

• Your current location: only if you choose to use your device's location (for example to fill in a spot's coordinates). Your browser asks for permission first.
• Consent and request records: your IP address and browser details, recorded with your cookie and privacy choices and with any privacy request you make, so we can show what was agreed and when.
• Server logs: technical records of what our systems did, which can include your email address.
• Cookies: see our Cookie Policy.

2.3 Payment information

Payments are handled by Stripe. Stripe collects your card details directly; we never receive or store your card number. From Stripe we receive a customer reference, your plan, your subscription status and your renewal date.

2.4 What you must provide

An email address is required to create an account. A base location and at least one photo location are needed for reports and alerts to work. Everything else is optional.

3. How We Use Your Information and Our Legal Basis

We only use your information where the law allows us to. For each purpose, the legal basis is:

Where we rely on legitimate interests, we have weighed our interest against your rights, and you can object at any time (see section 10). Where we rely on consent, you can withdraw it at any time without affecting what we did before.

We do not send marketing emails. If we ever do, we will only send them with your consent, and every one will include an unsubscribe link.

4. How We Use AI

To help pick the best location in your Daylight and Nightfall reports, we send the names and coordinates of your photo locations, together with forecast data, to an AI model. We never send your email address, your name or your base location. A technical safeguard blocks your base coordinates from being included.

Your base location is often your home, so we treat it as more sensitive than your photo locations. If one of your photo locations is at your base location (within 50 metres of it, or with "base location" in its name), we leave it out of what we send to the AI, so the AI recommendation will not consider it. It still appears, with its forecast, in the rest of your reports, and we will let you know by email the first time it happens. To have it included, set your base location in your Settings to somewhere more than 50 metres away from it.

We use OpenAI and Google Gemini through their paid business APIs. Under those terms, the information we send is not used to train their models.

5. Automated Decisions

Our systems automatically score forecasts to decide which reports and alerts to send you. This only affects which photography suggestions you receive. We do not make any decision based solely on automated processing that has legal or similarly significant effects on you.

6. What Other People Can See

Your account, base location, photo locations and alert rules are private. If you submit a community contribution and it is approved, its location name and its photo and parking coordinates become publicly visible in our location catalogue. We do not show your name or email address with it. Approved locations stay in the catalogue if you later delete your account, but the link to your account is removed.

7. Who We Share Information With

We do not sell, trade or rent your personal information. We share it only with service providers who process it on our behalf, under contract, and only for the purposes below:

We may also disclose information if the law requires it, to protect our rights or the safety of others, or to a buyer if the ShotScout business is ever sold, in which case this policy would continue to apply.

8. International Transfers

Our main database is in the United Kingdom. Some of the providers above process data in other countries, mainly the United States. Where that happens, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

9. How Long We Keep Information

If we ever need to restore a backup, we re-apply every account deletion afterwards, so a restore cannot bring a deleted account back. Our service providers keep their own records under their own policies; for example, Stripe keeps payment records it is legally required to hold.

10. Your Rights

You have the right to:

• Access: get a copy of your personal data
• Rectification: have inaccurate data corrected
• Erasure: have your data deleted ("right to be forgotten")
• Restriction: ask us to limit how we use your data
• Portability: receive your data in a machine-readable format
• Objection: object to processing based on legitimate interests
• Withdraw consent: at any time, where we rely on consent

You can download or delete your data yourself from your Privacy Dashboard, or email us at privacy@shotscout.photo. Requests are free, and we will reply within one month. We may refuse or charge a reasonable fee only if a request is clearly unfounded or excessive. We may need to confirm your identity first.

If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the EEA, you can also complain to your local data protection authority.

11. Data Security

We protect your information with technical and organisational measures, including:

• Encryption of data in transit and at rest
• Database access rules that limit each account to its own data
• Restricted administrative access
• Daily backups, with restores tested

If a data breach is likely to put your rights at risk, we will report it to the ICO within 72 hours and tell you without undue delay if the risk is high.

12. Cookies

We use essential cookies to run the site and optional cookies only with your consent. You can change or withdraw your choice at any time using the Cookie Settings link at the bottom of every page or, if you have an account, your Privacy Dashboard. See our Cookie Policy for details.

13. Children's Privacy

Our services are not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us and we will delete it.

14. Changes to This Policy

We may update this policy from time to time. The "Last Updated" date above shows when it last changed. If we make a material change, we will email registered users before it takes effect.

15. Contact Us