Privacy Policy

Introduction

SLEEEK ("SLEEEK", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, platform, and services.

By using SLEEEK, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this policy, please do not access or use our services.

Information We Collect

Personal Information

When you register for an account or use our services, we may collect:

• • Name, email address, phone number
• • Business name and address
• • Payment information (processed securely via Stripe)
• • Property addresses for scheduled shoots
• • Profile information and preferences

Automatically Collected Information

When you access our platform, we automatically collect:

• • Device information (browser type, operating system)
• • IP address and general location
• • Usage data (pages visited, features used, time spent)
• • Cookies and similar tracking technologies

Content You Provide

This includes photographs, videos, property information, communications through our platform, and any other content you upload or share through SLEEEK.

Mobile App Data

When you use the SLEEEK mobile app, we may access:

• • Camera and photo library (to capture and upload property photos)
• • Device sensors including gyroscope and accelerometer (for level guidance during capture)
• • Location data, including precise GPS coordinates stored in a camera file's metadata when present (to associate media with the correct property)
• • Local device storage (to cache photos before upload)
• • Push notification tokens (to notify you of delivery status)

Automated Processing

Photos uploaded to SLEEEK are processed by automated systems for quality control, bracket detection, editing, clutter detection, and editorial content generation. This processing is performed to deliver our core services and does not involve human review unless flagged for quality reasons.

Model Training (Opt-In Only)

We do not use your photos to train our machine learning models by default. Your RAW files and final images are never automatically included in training datasets. You may opt in to contribute your images for model improvement via your account settings. This is entirely voluntary, can be revoked at any time, and does not affect your service. If you opt out, your images are excluded from future training.

How We Use Your Information

We use the information we collect to:

• • Provide and maintain our services
• • Process bookings and payments
• • Send confirmations, updates, and service-related communications
• • Improve and personalize your experience
• • Analyze usage patterns to enhance our platform
• • Detect and prevent fraud or security issues
• • Comply with legal obligations
• • Respond to your inquiries and provide support

Google Account Data

If you choose to connect a Google Calendar or a Google mailbox, SLEEEK asks Google for exactly the following, and nothing more:

• See and edit your calendar events (calendar.events) — so a shoot you book in SLEEEK appears on your calendar, and a booking already on your calendar can be shown alongside your SLEEEK shoots.
• See your calendars and their events (calendar.readonly) — so booking can avoid offering a time you are already committed to, and so you can choose which of your calendars SLEEEK should check. This is read-only: SLEEEK cannot change or delete anything on a calendar it did not create.
• Know which Google account you connected (userinfo.email) — so SLEEEK can show you which account a calendar or mailbox belongs to, and stop the same one being connected twice.
• Send email on your behalf (gmail.send) — so a reply to a client from within SLEEEK leaves from your own address instead of ours.
• Read your email (gmail.readonly) — so a client's reply reaches SLEEEK's inbox without anyone forwarding it by hand. This is requested only when you turn syncing on for a connected mailbox, is off by default, and only the mailbox owner can switch it on. Only work-related mail is stored; everything else is dropped before it is written down, and attachments are never downloaded.

Each of these is requested separately on Google's consent screen, and you can decline any of them individually. Disconnecting in Settings revokes the grant; anything already stored (a synced calendar event, a kept email) stays until it is deleted under the retention terms above or you remove it yourself.

SLEEEK's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sharing Your Information

We may share your information with:

Service Providers

Third-party vendors who perform services on our behalf, including:

• • Stripe (payment processing, USA)
• • Akahu (bank feeds for invoice matching, New Zealand), only when a studio connects its bank
• • Xero or QuickBooks Online (accounting, the region of the studio's own account), only when a studio connects one
• • Square (payment processing, USA), only when a studio connects it
• • CubiCasa (floor-plan ordering, Finland), only when a studio connects it
• • Slack (notifications to a studio's own workspace, USA), only when a studio connects it
• • Firecrawl (public-web property lookups from a listing address, USA)
• • Vercel (cloud hosting, USA)
• • Supabase (database, authentication and cloud hosting, Sydney, Australia)
• • Backblaze B2 (file storage for camera originals and a second copy of delivered photos, USA)
• • Railway (image processing, USA)
• • Google (image analysis and generation, and calendar/mailbox integration if you choose to connect one, USA)
• • OpenRouter and fal (image generation routing, USA)
• • AutoHDR (photo blending, USA)
• • Anthropic (photo quality checks, grouping photos into rooms, and assistant features, USA)
• • ElevenLabs (voice narration, USA)
• • Resend (email delivery)
• • Sentry (error monitoring)
• • Analytics providers

Photographers and Team Members

When you book a shoot, relevant information (property address, contact details, special instructions) is shared with the assigned photographer.

Legal Requirements

We may disclose information if required by law or in response to valid requests by public authorities.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• • Encryption of data in transit and at rest
• • Secure authentication and access controls
• • Regular security assessments
• • Limited access to personal data by employees

However, no method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

A fuller account of our security practices, including where files are stored, how they are encrypted, who can see them, and what we have not built yet, is on our Security page.

If Something Goes Wrong

If we become aware of a breach of your personal information that is likely to cause you serious harm, we will tell you, and the Office of the Privacy Commissioner, as soon as practicable, as the Privacy Act 2020 requires.

Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes described in this policy. Specifically:

• • Account information: Retained while your account is active; when you delete the account, the sign-in and personal profile are deleted or anonymised promptly
• • Photo and video content: Retained for 12 months from delivery, then archived or deleted
• • Transaction records: Retained for 7 years as required by New Zealand tax law
• • Usage data: Typically retained for 2 years

Shared shoot, client, transaction and audit records that belong to a participating studio may remain with that studio after an individual account is deleted. We remove the deleted account's login links and personal profile from those records unless retention is required by law.

Your Rights

Under the New Zealand Privacy Act 2020, you have the right to:

• • Access the personal information we hold about you
• • Request correction of inaccurate or incomplete information
• • Request deletion of your personal information (subject to legal retention requirements)
• • Object to processing of your information in certain circumstances
• • Withdraw consent where processing is based on consent

SLEEEK mobile users can delete their account directly in Settings. To exercise another privacy right, contact us at [email protected].

Cookies and Tracking

We use cookies and similar technologies to:

• • Keep you logged in
• • Remember your preferences
• • Understand how you use our platform
• • Improve our services

You can control cookies through your browser settings. Disabling cookies may affect some features of our platform.

Third-Party Services

Our platform integrates with third-party services that have their own privacy policies:

• • Stripe (payment processing)
• • Akahu (bank feeds, only when a studio connects its bank)
• • Xero or QuickBooks Online (accounting, only when a studio connects one)
• • Google: image analysis and generation, and calendar/mailbox integration if you choose to connect one (see "Google Account Data" above)
• • Supabase (database and authentication)
• • Backblaze B2 (file storage)
• • Railway (image processing)
• • OpenRouter and fal (image generation routing)
• • AutoHDR (photo blending)
• • Anthropic (photo quality checks, grouping photos into rooms, and assistant features)
• • ElevenLabs (voice narration)
• • Vercel (cloud hosting)
• • Resend (email delivery)
• • Square (payment processing, only when a studio connects it)
• • CubiCasa (floor-plan ordering, only when a studio connects it)
• • Slack (notifications to a studio's own workspace, only when a studio connects it)
• • Firecrawl (public-web property lookups)
• • Sentry (error monitoring)

We encourage you to review the privacy policies of these services.

Children's Privacy

SLEEEK is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us.

International Data Transfers

Your information may be transferred to and processed in countries other than New Zealand, including the United States (where our hosting providers operate). We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of SLEEEK after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: