Privacy Policy

Plain-language summary: 4ShootOps collects only what it needs to run the service (account info, media you upload, payment info via Stripe, usage analytics, communications), shares data with trusted providers (e.g., Stripe, backup/storage partners), and gives you control over your data—access, correction, deletion, export. We protect your data with industry-standard controls, notify you of breaches, and comply with major privacy laws including Canadian PIPEDA, EU GDPR, and US CCPA.

1. Information We Collect

We collect information directly from you, automatically through your use of the Service, and from third parties.

1.1 Account and Identity Data

• Full name and email address
• Username and company name (if provided)
• Billing address and contact information

1.2 User Content

• Media files you upload (photos, videos, audio)
• Metadata associated with media
• Contracts, project and event data, notes, messages

1.3 Usage and Analytics Data

• Feature usage and performance metrics
• Device and browser information
• IP addresses and general location

2. How We Use Your Information

We process your data for the following purposes:

• Service Provision: Account management, media hosting, project workflows
• Payment Processing: Billing, invoicing, fraud prevention
• Customer Support: Responding to inquiries, sending transactional emails
• Analytics: Usage trends, performance tuning, feature development
• Security: Detecting unauthorized access, anomaly detection
• Legal Compliance: Responding to legal requests, enforcing Terms

3. Information Sharing

3.1 Service Providers (Sub-processors)

We share Personal Data with the trusted providers we use to operate 4ShootOps (our "sub-processors"):

• Payments: Stripe (USA)
• Hosting / Infrastructure: Hetzner (EU) and Cloudflare (global CDN, DNS, and security)
• Encrypted service backups: Cloudflare R2 and Backblaze B2 — used only for our own encrypted database backups, not for your media
• Transactional email: Brevo (EU)

Your connected (Bring-Your-Own) storage and your own SMS provider are engaged by you, not by us, and are therefore not 4ShootOps sub-processors—your media resides in your own storage account, under your control. Any product analytics we use are privacy-respecting and configured to minimize collection of personal data. A current list is maintained on our Sub-processors page (and is available on request); see also our Data Processing Addendum.

3.2 Legal Requirements

We may disclose information to comply with legal obligations, respond to lawful requests, or protect rights, property, or safety.

3.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you and ensure continued protection.

4. Data Security

We implement industry-standard safeguards including:

• TLS encryption in transit
• Encryption at rest for backups and sensitive storage
• Access controls and least privilege
• Regular security updates and vulnerability management
• Monitoring and anomaly detection

However, no system is perfectly secure; we cannot guarantee absolute security.

5. Your Rights

5.1 Access and Control

You have the right to:

• Access your personal data
• Correct inaccurate information
• Delete your data (subject to legal retention requirements)
• Export your data in a portable format
• Restrict or object to certain processing

5.2 How to Exercise Rights

Submit requests to [email protected] with a clear description of your request. We may need to verify your identity before fulfilling requests.

6. Data Retention

We retain data only as long as necessary:

• Account data: While your account exists plus 1 year after deletion
• Media/content: Per your plan's retention policy
• Billing records: 7 years for tax compliance
• Support communications: 2 years unless otherwise requested
• Logs: 90 days for access logs, longer if required for investigations

7. International Data Transfers

Your data may be transferred to and processed in countries other than your residence, including Canada and the United States. We ensure appropriate safeguards are in place, including Standard Contractual Clauses for EU/EEA data.

8. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect data from minors. If you believe we have collected data from a minor, contact us for deletion.

9. Cookies and Tracking

We use cookies and similar technologies for:

• Authentication and preferences
• Performance optimization
• Analytics and fraud detection

You can manage cookie preferences via your browser settings.

10. Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated via email or dashboard notice at least 14 days before taking effect.

11. Contact Information

12. Supervisory Authorities

If you believe your data rights have been violated, you may lodge a complaint with your local data protection authority. For Canadian residents, this is the Office of the Privacy Commissioner of Canada. We request that you first contact us to attempt resolution.