Privacy Policy

Mudimedia Yazılım ("we", "us") operates the Lens & Muse mobile application and the web pages at lensandmuse.co (together, the "Service"). This policy explains what data we collect, why, and how you can control it. It is written for freelance models and photographers using Lens & Muse's shoot diary, cards and document-signing features.

We handle personal data under UK GDPR. Your account data is stored in our Supabase project in the eu-west-2 (London) region.

Data we collect

Account and profile

• Email address, and if you sign in with Apple or Google, the identifier and name they provide.
• Role (model / photographer / both / other), display name, date of birth (used once to confirm you are 18 or over — we do not display it, and store only the confirmation, not a reusable age record beyond what is needed to enforce the 18+ gate).
• Currency preference and the city and travel radius you set for your card.

Your card and photos

• Up to 12 photos, plus your levels, rates, availability and any PurplePort / Model Mayhem / Instagram links you choose to add.
• Photos are re-encoded on your device before upload, which strips EXIF metadata including GPS location.
• Every photo is automatically screened for adult, racy or violent content using Google Cloud Vision SafeSearch before it becomes visible to anyone else. Rejected photos are deleted from our storage immediately; so we can check that the automatic decision was right, a copy of a rejected photo may be emailed to our moderator for review and is then deleted. Photos flagged for manual review are held in a moderation queue and reviewed within 24 hours.
• Other people only ever see your photos through short-lived signed URLs (valid 1 hour), never a public file.

Shoots, documents and signatures

• Shoot details you log: date, location, the other party's name and any contact details you add, fee, and status.
• Document content you generate from a template (a model release, TFP agreement or paid shoot agreement), and the fields you fill in.
• Signatures: a drawn or typed signature image, the signer's legal name and email, the timestamp, IP address, user agent and device information, and the version of the e-signature consent the signer ticked. This is the audit trail that makes an electronic signature admissible in evidence under the UK Electronic Communications Act 2000, and it is printed on the signed PDF.
• How the signer was identified. Someone signing through a link without an account confirms their email address with a 6-digit code we email them; we record the confirmed address and when it was confirmed. Someone signing in the app is identified by their account, so we record the account email and the sign-in provider (Apple, Google or email code). The code itself is stored only as a one-way hash and expires after 10 minutes.
• Signed documents, and their signature audit trail, are kept for 7 years from the date of signing, then automatically and permanently deleted. This matches standard UK record-keeping practice for signed contracts. See What we keep after you delete your account.
• A write-once archive copy of each signed agreement (the PDF, the signature images and the audit trail) is stored in a private Cloudflare R2 bucket that is locked for 7 years, so that nobody, including us, can alter or delete the record before then. It is never shown to anyone and is used only if the agreement is disputed.
• Anyone holding a signed PDF can check it at lensandmuse.co/verify. The file is fingerprinted in their browser and never uploaded; a match shows only the document title, the signing date and the signers' initials, never names or emails.

Purchases

Subscription and document-pack purchases are handled by RevenueCat, which receives your purchase and entitlement status from Apple or Google. We do not see or store your payment card details.

Usage analytics

We use PostHog, hosted in the EU, to understand how the app is used. Analytics events are tied to a random, pseudonymous account identifier — never your name, email, phone number, free-text content or photos. You can opt out at any time in Settings → Share usage analytics. The website itself loads no analytics script and sets no cookies; the only web-triggered analytics events (e.g. a card being viewed) are sent from our server, not your browser.

Reports and moderation

If you or someone else files a report (nudity, harassment, spam, impersonation, under-18 concern, copyright or other), we store the report, the reason, and any details supplied, so it can be reviewed and actioned within 24 hours.

Third parties we use

• Supabase — database, authentication and file storage, hosted in eu-west-2 (London).
• RevenueCat — subscription and purchase management.
• PostHog (EU cloud) — pseudonymous product analytics.
• Google Cloud Vision — automated SafeSearch screening of uploaded photos.
• Resend — sends sign-in codes, signing codes, signed-document PDFs, and moderation emails.
• Cloudflare — hosts this website and stores the write-once archive copy of signed agreements (Cloudflare R2).
• Apple and Google — Sign in with Apple / Google, and push notifications (Apple Push Notification service, Firebase Cloud Messaging via Expo).
• GeoNames — the city list used for your card location (public, non-personal reference data, CC BY 4.0).

We do not sell your personal data, and we do not share it with data brokers or advertisers.

International transfers

Your account data, card, photos and documents are stored in the UK (London). Some of the providers above — RevenueCat, Resend (including emails sent to our support address), Cloudflare (website and the signed-agreement archive), Google and Apple — may process data in the United States or the EU. Where that happens, the transfer is covered by the UK Extension to the EU–US Data Privacy Framework or by the UK International Data Transfer Addendum to the providers' standard contractual clauses.

Who sees your data

Your card is only reachable through a private link you choose to share, or a QR code you generate — it is never listed publicly or indexed by search engines. A shoot record and its documents are visible only to you and the other participant in that shoot. Blocking someone hides your card and shoot invites from them, server-side.

Retention & deletion

You can export a copy of your data at any time from Settings → Export my data, or delete your account from Settings → Delete account (or by emailing us). Deleting your account deletes your account itself, your profile, card, photos, links, blocks, notes, references, credits, analytics identifiers and any document nobody has signed yet, straight away. You can sign up again with the same email, Apple or Google account afterwards. Signed agreements are the one exception, explained below.

What we keep after you delete your account

A signed agreement is a record for both people who signed it, so deleting one person's account does not destroy it. For 7 years from the date of signing we keep:

• the signed agreements (the document text and the signed PDF) and the shoot details they belong to;
• the signature images (drawn or typed);
• the audit trail: when the document was created, opened and signed, and the document and file hashes;
• an identity record of each signer: legal name, email address, sign-in provider (Apple, Google or email) and the identifier it gave us, and the IP address and device used at signing.

We keep these only to establish, exercise or defend legal claims, which UK GDPR Article 17(3)(e) allows even after an erasure request. They are not visible to anyone in the app or on the web, including the other person if they have no account (they received the signed PDF by email when it was signed); if the other person has an account, the shoot and its signed agreements stay in their diary. Access is restricted to us, and only to answer a dispute or a legal request about that agreement. Everything is deleted automatically 7 years after signing, including the write-once archive copy. Without any signed agreement, the identity record is deleted after 30 days.

Children

Lens & Muse is for adults 18 and over only. We check your date of birth at sign-up and block anyone under 18.

Your rights

Under UK GDPR you have the right to access, correct, export and delete your personal data, and to object to or restrict certain processing. Contact us using the details below to exercise any of these rights, or use the in-app tools in Settings.

Contact

Mudimedia Yazılım — [email protected]