Privacy Policy
Tobren Software LLC ("Tobren", "we", "us") operates Tobren Deliver. This Privacy Policy explains what personal information we collect, how we use it, and the rights you have. By using the service, you agree to this Policy and our Terms of Service.
1. Roles and Data Processing
For the purposes of data protection laws, when a photographer or videographer ("Tenant Admin") uses our platform to deliver media to their own clients ("Customers"):
- Tenant Admin is the Data Controller of Customer information and uploaded media.
- Tobren is the Data Processor, acting on the instructions of the Tenant Admin.
Customers seeking to exercise their privacy rights (access, deletion, etc.) should contact their photographer directly.
2. Information we collect
2.1 Information you provide directly
- Account information: Name, email, and hashed passwords.
- Workspace information: Business name, custom domains, and branding assets.
- Payment information: Tokenized payment details handled by Square. We do not store full card numbers.
- Media: Photos, videos, and metadata uploaded for delivery.
- Waitlist & contact forms: If you join a product waitlist or send us a message, we collect the email address (and, for contact, your name and message) you submit, plus basic metadata (timestamp, referrer, and a hashed IP) to prevent abuse. We use it only to reply to you or to notify you about the product you asked about, and we do not sell it.
2.2 Information collected automatically
- First-party cookies: We use essential HTTP-only cookies for authentication and security (e.g., session management, CSRF protection). The application itself sets no advertising cookies.
- Website analytics: Our public marketing website (tobren.io) uses Plausible Analytics to count visits. Plausible sets no cookies, collects no personal data, and does not track visitors across sites or over time; it reports only aggregate figures such as page views and referring sites.
- Advertising measurement: Our public marketing website also carries the Meta Pixel, which reports page views and similar website activity to Meta Platforms so we can measure our advertising and build audiences. This is third-party advertising technology and it does set third-party cookies. You can limit it through your browser's cookie controls, an ad blocker, or your Meta ad preferences. The Pixel also runs on the Tobren Deliver sign-up page (deliver.tobren.io/signup), where it reports that the page was viewed and, when a paid-plan trial is created, the plan and billing cycle chosen, the plan's list price, whether a card was added, and the campaign parameters in the link you arrived by. It is not present anywhere else in the application, including every signed-in page. When you create a Tobren Deliver account and confirm your email address, our servers may also send Meta a scrambled (hashed) form of that address, with the same trial details, to measure our advertising. Meta does not receive your email address itself.
- Technical Logs: IP addresses, browser types, and usage metrics used for security monitoring and billing.
3. Photo and video ownership
Tenant Admins retain all rights to media they upload. We do not claim ownership. We do not use uploaded media to train artificial intelligence (AI) models.
4. Who we share information with
- Infrastructure: Google Cloud Platform (USA) for hosting and storage.
- Payments: Square and Stripe for billing and customer transactions.
- Communications: Hostinger SMTP for transactional emails.
- Website analytics: Plausible Analytics, for aggregate marketing-website statistics. No personal data is shared.
- Advertising: Meta Platforms, which receives marketing-website and sign-up-page activity through the Meta Pixel described in section 2.2.
We do not sell personal information. Apart from the Meta Pixel activity on our marketing website and sign-up page described in section 2.2, we do not share personal information with third-party advertisers.
5. International Rights (GDPR & CCPA)
EEA/UK Residents: Our lawful basis for processing is the performance of our contract with you. For business users in these regions, our Data Processing Addendum (DPA), including Standard Contractual Clauses (SCCs) for international transfers, is incorporated into our Terms of Service by reference.
California Residents: We comply with the CCPA. We do not "sell" your personal information as defined by California law.
No Automated Decision-Making: We do not use your data for automated profiling or decisions that have legal effects on you.
6. Data retention
We retain billing records for up to 7 years. Tenant Admins control the retention of their uploaded media. Once deleted by a Tenant Admin, media is removed from active storage; backups may persist for up to 30 days.
7. Contact
Tobren Software LLC
Email: contact@tobren.io