Privacy Policy

Our Commitment to Student Data Privacy

Timeless Portraits is built on a simple principle: Student data is not a product — it is a responsibility.

• Collect only the minimum data necessary to deliver the services the school, university, or organization requires.
• Use student data only for school-authorized purposes.
• Do not sell or monetize student data under any circumstances.
• Align our practices with FERPA, COPPA, and industry best practices.
• Operate with security controls consistent with SOC 2 principles (Security, Availability, Confidentiality).

1. Information We Collect

We collect information in the following categories:

2. How We Use Information

We use collected information strictly to:

• Deliver photography services (e.g., Picture Day, sports, events)
• Match images with student records for accurate fulfillment
• Produce school-authorized materials (yearbooks, ID cards, directories)
• Process and fulfill customer orders
• Provide customer service and support
• Improve our services and user experience
• Maintain system security and prevent fraud

We do not use student data for advertising, profiling, or unrelated commercial purposes.

3. How We Collect Information

• Directly from parents, customers, or users
• From schools or partner organizations (for authorized services only)
• Automatically through website technologies (cookies, analytics tools)

Schools and organizations remain responsible for obtaining appropriate parental consent where required.

4. Sharing of Information

We only share information in limited, controlled circumstances:

We do not sell personal or student data to third parties.

5. Data Retention

We retain personal information only as long as necessary to:

• Fulfill service obligations
• Meet contractual requirements with schools
• Comply with legal and regulatory requirements

Student images and data are retained based on school agreements, customer purchases, and operational necessity. We provide mechanisms for data access and deletion requests, subject to verification and school authorization where applicable.

6. Data Security (SOC 2-Aligned Practices)

We implement administrative, technical, and physical safeguards consistent with industry standards, including:

• Role-based access controls (least privilege access)
• Secure data storage and encryption practices
• Vendor risk management and oversight
• Continuous monitoring for security threats
• Incident response and breach notification protocols

While no system is 100% secure, we continuously invest in protecting the integrity and confidentiality of all data entrusted to us.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to improve website functionality, enhance user experience, and analyze site performance. Users can manage cookie preferences through browser settings.

8. Children's Privacy

Our services are designed for schools and families, not direct use by children. We:

• Do not knowingly collect personal information directly from children under 13 without appropriate authorization
• Rely on schools and parents for consent where required
• Limit student data use strictly to authorized educational and service purposes

9. Your Privacy Rights

Depending on your location, you may have rights to:

• Access your personal data
• Request correction or deletion
• Opt out of certain communications
• Request information about how your data is used

Requests can be submitted through our contact information below.

10. Data Ownership and School Control

For school-based services:

• Schools retain control over student data provided to us
• We act as a service provider, not a data owner
• We honor school and district requirements for data handling, retention, and deletion of certain non-copyright protected data

11. Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in technology, regulatory updates, or service enhancements. Updates will be posted on this page with a revised effective date.

12. Contact Us

For questions about this Privacy Policy or data practices: