Privacy Policy

Our role depends on whose information we are processing:

• Account holders and website visitors. For personal information about people who hold a CoreHue account (Users) and about visitors to our websites, CoreHue is the controller, and this Privacy Policy applies.
• Clients of Users. When Users work with their clients through the Services, for example to receive inquiries, send contracts and invoices, or share galleries, the User is the controller of their clients’ personal information, and CoreHue processes it on the User’s behalf as a processor or service provider. See Information we process for Users.

You may contact us about this Privacy Policy at privacy@corehue.co or CoreHue Inc., 8 The Green, Ste A, Dover, DE 19901, USA.

We use personal information for the following purposes. Where applicable law requires a legal basis for processing, such as the GDPR, the basis is stated for each purpose.

• To provide the Services, including creating and maintaining your account, hosting your Public Pages and galleries, sending documents and messages on your behalf, processing your subscription and operating the integrations you connect. Legal basis: performance of our contract with you.
• To secure the Services, including verifying sign-ins, detecting and preventing fraud and abuse, enforcing our Terms and maintaining audit records. Legal basis: our legitimate interests in protecting our users and the Services, and compliance with legal obligations.
• To provide support, including responding to requests and troubleshooting. Legal basis: performance of our contract with you, or our legitimate interests.
• To maintain the Services, including monitoring performance, detecting errors and diagnosing problems. Legal basis: our legitimate interest in operating reliable Services.
• To analyze and improve the Services, including through product analytics and session recordings. Legal basis: our legitimate interest in understanding how the Services are used and improving them. You may object to this processing at any time by turning off product analytics in your account settings.
• To communicate with you about your account, billing, security and changes to the Services or our policies. We send product updates and tips only if you opt in, at sign-up or in your notification settings. You can turn them off in those settings or unsubscribe from any of these emails at any time. Account, billing and security emails are part of the Services and are not affected. Legal basis: performance of our contract with you, our legitimate interests or consent.
• To comply with legal obligations, including maintaining tax and accounting records, responding to lawful requests and handling copyright complaints. Legal basis: compliance with legal obligations.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects. We do not use photos, videos, documents or client information to train artificial intelligence or machine learning models.

CoreHue uses cookies and similar technologies on our websites and products for the following purposes:

Necessary - To keep our services secure and working.

Analytics - We use tools such as Google Analytics to understand how our services are used and improve them. Where required, we ask you first.

You can change your choice at any time using Cookie preferences at the bottom of each page.

We do not sell personal information or share it for cross-context behavioral advertising. We disclose personal information only as described below.

If you have interacted with a User, for example by sending an inquiry, booking a session, signing a contract, paying an invoice, answering a questionnaire or viewing a gallery, the User controls your personal information and CoreHue processes it on their behalf. Depending on the features the User uses, this may include:

• your name, email address, phone number and address;
• details about your session or event, inquiry messages, and questionnaire responses and uploads;
• your electronic signature on contracts, together with the time of signing, your IP address and browser information;
• invoices and payment records. Card payments are processed by the User’s payment processor, and CoreHue does not receive your card details. If you pay by bank transfer, any proof of payment you upload is stored for the User;
• emails you exchange with the User through the Services;
• gallery activity, such as visit times, device and browser type, images you mark as favorites or download, and your email address if the gallery requests it;
• video playback information, such as playback quality and errors, together with device and browser information, when you watch a video in a gallery; and
• usage information about how Public Pages are used, such as pages viewed, whether a step such as booking, signing or payment was completed, errors displayed, and general device and country information. Our analytics records do not include your name or contact details, we do not use this information to identify you, and we do not store any information on your device for this purpose.

The User’s privacy notice describes how they use your information. To access, correct or delete your information, please contact the User. If you contact us, we will forward your request to the User and assist them in responding. If you are unable to reach the User, contact privacy@corehue.co.

If you sign in with Google, we receive your name, email address and profile picture. If you connect Google Calendar, we request permission to view and manage your calendars so that we can add, update and remove your CoreHue bookings, display your existing events and, if you choose, block times that conflict with busy events. When you select Google Meet for a session, we create the meeting link through your calendar.

CoreHue’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide these features. We do not use it for advertising, sell it or use it to train artificial intelligence models, and we do not allow humans to read it except with your permission for support, where necessary for security, or as required by law. You can disconnect Google at any time in your account settings or your Google account.

CoreHue stores personal information in the United States. Our service providers may process it in other countries, and our content delivery network may temporarily cache copies of pages and files at locations outside the United States in order to deliver them. These countries may have data protection laws that differ from those of your country. A current list of our service providers and their processing locations is available on request at privacy@corehue.co.

Where the law of the country from which information is transferred restricts international transfers, including in the European Economic Area, the United Kingdom, Switzerland, Nigeria, Ghana and South Africa, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, or another transfer mechanism permitted by local law.

We retain personal information only for as long as necessary for the purposes described in this Privacy Policy, taking into account the nature of the information, the purpose for which it was collected, our legal, tax and accounting obligations, and the need to secure the Services, resolve disputes and enforce our agreements.

• Account information and Your Content are retained while your account is open. You may delete your account at any time in your account settings. Your account is permanently deleted 30 days after you request deletion, and you may cancel the request at any time during that period.
• Invoices and payment records may be retained after an account is deleted for as long as required by tax, accounting and other legal obligations, which may be up to 10 years.
• Gallery photographs and videos that exceed a Plan’s allowance are deleted 30 days after they are hidden from Clients, as described in our Terms of Use.
• Product analytics information is retained for up to two years, and session recordings for up to 90 days.
• Other information, such as security records and logs, is retained for limited periods appropriate to its purpose and then deleted or anonymized.

We maintain technical and organizational measures designed to protect personal information, including:

• encryption of information in transit, and additional encryption of sensitive information at rest;
• secure password storage;
• additional verification for unusual sign-ins and sensitive account changes;
• access controls on stored files and documents; and
• restricted and logged staff access to customer information.

No method of transmission or storage is completely secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

Depending on where you live, you may have the right to:

• access the personal information we hold about you and obtain a copy;
• correct inaccurate or incomplete information;
• delete your information;
• receive your information in a portable format;
• object to or restrict certain processing, including processing based on our legitimate interests;
• withdraw consent at any time where we rely on consent, without affecting processing carried out before withdrawal; and
• opt out of the sale or sharing of personal information or of targeted advertising. We do not engage in either.

You can update most account information, turn off product analytics and product update emails, export a copy of your account data and delete your account in your account settings. To make any other request, email privacy@corehue.co. We will respond within the period required by law, generally within 30 days, and may need to verify your identity before doing so. Where permitted by law, you may use an authorized agent to make a request. We will not discriminate against you for exercising your rights. If we deny your request, you may appeal by replying to our response.

CoreHue accounts are available only to individuals aged 18 or older, and our websites are not directed to children. We do not knowingly collect personal information directly from children under 13, or under the age of digital consent in their country. If you believe a child has provided us with personal information, contact us and we will delete it.

Users may photograph or film children or collect information about them from parents, such as names and ages for a family session. Users are responsible for obtaining the consent of a parent or guardian, and CoreHue processes that information on their behalf.

We do not request sensitive personal information from account holders. Users may use questionnaires to ask clients questions that could reveal sensitive information, such as health information. Users should collect such information only where necessary and with the client’s explicit consent. Forms, questionnaires and messages must not be used to collect payment card numbers, passwords or government identification numbers.

We may update this Privacy Policy from time to time, including when we engage a new service provider. We will post the updated policy on this page and update the date above. If we make a material change, we will notify you by email or in the Services before it takes effect.