Privacy Policy

When you book a rental, we collect your name, email, and phone number (phone is optional), your shipping address, your event date, and the number of camera sets you request.

Payment details are handled entirely by Stripe — GrainFlash never receives or stores your full card number. With your action at checkout, Stripe may retain a payment method on file so we can charge damage, loss, or late fees per the Rental Agreement you accept when booking.

Whether you opted in to marketing email is stored separately from your rental agreement acceptance — opting out of marketing never affects your booking.

If you set or change a gallery PIN, we store that PIN hashed, never in plain text.

We also keep standard web server logs (IP address, browser type, pages visited) for security and abuse prevention — for example, rate-limiting to stop automated booking spam — and error reports (via Sentry) when something breaks on the site.

We do not sell personal information, and we do not use tracking cookies for cross-site advertising.

We use your information to create and fulfill your booking: ship cameras, process payment, and send confirmation and photos-ready emails.

We use it to enforce the Rental Agreement — for example, charging a damage or late fee to the card on file, per the terms you accept at checkout.

We send marketing email only if you checked the marketing opt-in box at booking, and you can unsubscribe at any time via the link in any marketing email.

We use it to keep the site secure and working: fraud and abuse prevention, and error monitoring.

Your event photos are uploaded to your private gallery after the cameras are returned, and delivered via a unique, unguessable link — no account needed.

Galleries are automatically deleted 90 days after creation. The photos-ready email states the exact date yours expires. Download anything you want to keep before then — we cannot recover a gallery after it's deleted.

We share the minimum necessary with the vendors who help us run the business, and we don't permit them to use your data for their own purposes. See the table below for who handles what.

We may also disclose information if required by law, or to protect GrainFlash's rights — for example, pursuing payment for a lost or damaged camera.

If you're a California resident, you have the right to know what personal information we've collected about you and why, request a copy of it, request deletion of it (subject to our need to retain booking records for legal, tax, or dispute purposes for a reasonable period), and opt out of marketing communications. We do not sell personal information, so there is no "sale" opt-out to exercise.

To exercise any of these rights, email [PRIVACY CONTACT EMAIL]. We'll respond within the time CCPA requires.

These rights are extended to all customers regardless of state, as a matter of practice, not just California residents.

We use industry-standard measures — encrypted connections, hashed credentials, access-controlled admin tools — to protect your data, but no system is 100% secure. If we ever experience a breach affecting your personal information, we'll notify you as required by law.

GrainFlash is not directed at children under 13, and we don't knowingly collect information from them.

We'll update the "Last updated" date above when this policy changes, and post the updated version here. Material changes will also be noted in a banner on the site for a reasonable period.

Questions about this policy or your data: [PRIVACY CONTACT EMAIL]

[BUSINESS LEGAL NAME], a [STATE] limited liability company [BUSINESS ADDRESS]