Skip to content
STIL LAB StudioBack to STIL LAB Studio

Privacy policy

STIL LAB Studio, stillabstudio.com

1. About this policy

This policy explains how STIL LAB looks after personal information in STIL LAB Studio. It covers the Studio, this website, the websites photographers make with the Studio (including their basket and checkout), and the prints and frames we make and deliver for them. It does not cover stillab.co.nz, our own print shop.

"We" and "us" mean Craig Madsen Photography Ltd, trading as STIL LAB, Building C319, Ballance Road, Waiouru 4826, New Zealand (NZBN 9429032609202). We follow the Privacy Act 2020.

To ask about your information, or to raise a concern, email support@stillab.co.nz, phone 027 539 7510, or write to us at that address.

2. The short version

  • We collect what we need to run the Studio, make and deliver orders, and get paid.
  • If you buy from a photographer's website, the photographer is the seller. We run their checkout and make the print, so we see your name, contact details and delivery address.
  • Card details are only ever entered on Stripe's page. We never receive a full card number or security code.
  • There is no advertising, analytics or tracking on the websites this policy covers. We don't sell personal information.
  • Some companies we use are overseas, mainly in the United States.
  • You can ask to see or correct what we hold about you (section 11).

3. Photographers and their teams

We collect your name, the name you sell under and your email address, your business details (country, GST status and number, branding, membership plan and price), the website you build, your photographs, the names and emails of people you add, and the messages we exchange. A published website is public.

When you sign in or out we record the time, internet (IP) address and browser, and we keep a log of important actions on your account. There are no passwords: you sign in with a one-time link we email you.

We use this to run and secure your account, check it before your website goes live, invoice you, and tell you about your account, billing and sales. We don't send marketing emails from the Studio.

Monthly card payments

Your membership is paid by card each month through Stripe.

  • You enter your card details on Stripe's page, and they never reach STIL LAB. We can't see your full card number or security code.
  • To set this up we give Stripe your business name and the email address of the person adding the card.
  • We keep a Stripe customer ID and subscription ID, the subscription's status and dates, a record of each membership invoice (amount, status, when paid), and a record of which version of our terms was accepted, by whom and when. That record is never changed or removed.
  • Stripe uses some information for its own purposes, such as preventing fraud (Stripe's privacy policy).

Selling through your own Stripe account

Stripe asks you directly for your identity and bank details when you connect it. We don't receive them. We keep your Stripe account's ID and status, and the notices Stripe sends us about it.

4. Customers of photographers

You type your details into the photographer's checkout, which we run, so they come to us as well as to the photographer. We collect:

  • your name, email, delivery address (New Zealand or Australia) and phone number, which Australian orders need, and an optional note to the photographer;
  • your order: what you bought, the options, prices, order number and status; and
  • payment records from Stripe: reference numbers, amounts, any refund or dispute, and notices that can include the name, email and billing details you gave Stripe and your card's type and last four digits.

We use it to take your order and payment, work out shipping, make and deliver it, and keep tax records.

The photographer sees your details and order. Other photographers don't. Our staff can see all orders, to make, send and support them. We email you about your order only, never marketing. Order emails include a private link to your order page: anyone with it can open the page, so please don't share it. These links don't currently expire.

5. Photographs

We store each photograph a photographer uploads, at full size, in private storage. Originals are never shown on a web page and can carry hidden camera details, including the location. Web copies have that information removed. Staff open an original only to make an order.

Anything on a website can be copied. Deleting a photograph removes it from the library and website but does not yet erase the stored files. Photographers confirm they have the right to use any photograph of an identifiable person (see our terms).

6. Cookies

This website sets no cookies, and we use no advertising, analytics or tracking cookies anywhere. The Studio and photographers' websites use only these:

  • `__Host-stil_portal` keeps a photographer signed in. It holds a random code, not personal details, and lasts up to 90 days.
  • `stil_basket` remembers a basket on one photographer's website for up to 30 days.
  • `stil_basket_notice` carries one message to the next basket page for one minute.

Stripe's own cookies apply on its page.

7. Who we share it with

  • The photographer you bought from, as the seller.
  • Stripe, which takes payments and our membership fee. For a customer's payment we send your email, what you are buying, the order number and the photographer's name.
  • Railway, which hosts our servers and database, so holds everything in this policy, with logs that include IP addresses.
  • Cloudflare, which stores photographs only.
  • Resend, which sends our emails and sees each one.
  • GoSweetSpot, which prices and books delivery. Your address goes to it at checkout to work out shipping, and your name and address when we book the courier.
  • NZ Post, which delivers the parcel and sees your name and address on the label.
  • Addressfinder, only where address suggestions are switched on: what you type into the address box goes to it.
  • Our email host, which keeps emails to our support address.
  • Others the law requires, such as Inland Revenue or a court, and our accountant or lawyer when we need their help.

8. Information held overseas

Railway, Cloudflare, Resend and Stripe operate mainly from the United States, so some information is stored or handled outside New Zealand. We have not yet recorded the exact region each one uses. We stay responsible for information they handle for us.

9. Who is responsible for customers' information

Photographers are the sellers and have their own duties under the Privacy Act. We run the checkout for the photographer, and we also keep our own record of each order we make (name, email, phone and delivery address).

We have not finally settled whether we hold customers' details only as the photographer's agent, or also in our own right. Until we have, we treat ourselves as responsible for the details we hold, and will answer requests about them.

10. How long we keep it, and how we protect it

We have not yet set fixed deletion periods, and most information is not deleted automatically today. Sign-up and sign-in links work once and expire after 24 hours. Baskets expire after 30 days. Accounts, websites, orders, invoices, payment and security records are kept for now, including after an account closes, and we keep the business and tax records the law requires. Photographs are kept even after a photograph is deleted or an account closes. Terms acceptance records are kept permanently. We will set periods and update this policy.

We take reasonable steps to keep information safe: encrypted connections, single use sign-in links, each photographer's information kept apart, private photograph storage, limits on repeated attempts, and a record of staff changes and original downloads. No system is completely secure. If a breach causes, or is likely to cause, serious harm, we will tell the Privacy Commissioner and the people affected as soon as practicable, and tell a photographer promptly if their customers are involved.

11. Seeing and correcting your information

You can ask for the personal information we hold about you, and ask us to correct it. Contact us as in section 1.

  • We check who you are first.
  • We reply within 20 working days. If we need longer, we will tell you why.
  • We don't charge for a request.
  • If a photographer or Stripe holds it, we will pass your request on.
  • Placed orders, invoices and payment records are kept as they were. If one is wrong, tell us, and we will fix it by hand and note what you wanted changed.

To close a Studio account, email us.

12. Complaints and changes

If you are unhappy with how we have handled your information, please contact us first. You can also complain to the Office of the Privacy Commissioner: www.privacy.org.nz, phone 0800 803 909.

We may update this policy and will publish the new version here. We will email photographers before a change that significantly affects their information.