1 – Introduction and Data Controller

SHOOT NOW! (shootnow, "we", "us", or "our") is committed to respecting your privacy and protecting your personal information. This Privacy Policy explains the types of personal information we collect, how it is used, when it is shared with third parties, and your rights as a data subject.

 

Data Controller: shootnow (https://www.shootnow.me/contact)

​

This Policy has been prepared in compliance with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CalOPPA), and Japan’s Act on the Protection of Personal Information (APPI). For users accessing from China, we endeavor to comply with the Personal Information Protection Law (PIPL) and other applicable data protection laws.
 

2 – Information We Collect

2.1 Information Collected Directly from Users

• Name, email address, and phone number (for booking and communication purposes)

• Payment information (processed via Stripe; we do not store raw card data)

• Booking details (desired date, location, and plan)

• Inquiry contents

• Photographs  (delivered as digital files via Google Drive)
   

2.2 Information Collected Automatically

• IP address, browser type, and access timestamps

• Behavioral data via cookies and similar technologies (see Part Three for details)

• Device information
   

2.3 Information Obtained from Third Parties

• Payment completion and failure information from Stripe

• Aggregated data from analytics tools such as Google Analytics
   

3 – Purposes of Use

Personal information collected is used for the following purposes:

 

Processing and confirming bookings : Performance of contract

Matching with photographers : Performance of contract

Delivering photos : Performance of contract

Customer support : Legitimate interests

Service improvement and analytics : Legitimate interests

Marketing emails (with consent) : Consent

Legal compliance : Legal obligation

 

4 – Sharing of Information

We do not sell or disclose personal information to third parties except in the following circumstances:

• Photographers: To the extent necessary for conducting the Session (name and booking details)

• Stripe: For payment processing (Stripe’s Privacy Policy applies)

• Google: For photo delivery via Google Drive and analytics via Google Analytics (aggregated/anonymized data)

• As required by law: Court orders, legal proceedings, etc.

• Business transfers: In the event of a merger or acquisition (Users will be notified in advance)

 

We do not sell personal information to third parties for advertising purposes.
 

5 – Data Retention

 

Booking and transaction records : 7 years from the last transaction (per tax and accounting laws)

Account information : 30 days from account deletion request

Marketing email consent : Until consent is withdrawn

Access logs : 6 months

 

6 – Your Rights

6.1 Rights of All Users

• Right of Access/Disclosure: The right to request disclosure of personal data we hold about you

• Right to Rectification: The right to request correction of inaccurate data

• Right to Erasure: The right to request deletion of your data under certain conditions

• Marketing Opt-Out: The right to unsubscribe from marketing emails
   

6.2 Rights of EU/EEA Residents (GDPR)

In addition to the above, you have the following rights:

• Right to Data Portability: The right to receive your data in a machine-readable format

• Right to Restriction of Processing: The right to request restriction of processing under certain conditions

• Right to Object: The right to object to processing based on legitimate interests

• Right to Lodge a Complaint: The right to lodge a complaint with your local EU data protection authority
   

6.3 Rights of California Residents (CCPA)

• Right to Know: The right to request disclosure of the categories and purposes of data collected, used, or disclosed

• Right to Delete: The right to request deletion of personal information

• Right to Non-Discrimination: The right not to be discriminated against for exercising your rights

 

We do not sell or share personal information.

The CCPA “opt-out” right does not currently apply; however, we will update this Policy if it becomes applicable in the future.

6.4 How to Exercise Your Rights

To exercise any of the rights above, please contact us at Contact form. We will verify your identity and respond within 30 days as a general rule, unless a longer period is required or permitted by applicable law.
 

7 – International Data Transfers

We are based in Japan; however, due to the nature of the services we use (Stripe, Google, etc.), your personal information may be processed on servers located outside Japan.

For data transfers from the EU/EEA, we apply Standard Contractual Clauses (SCCs) approved by the European Commission or other appropriate safeguards.
 

8 – Privacy of Minors

Our service is not directed at persons under the age of 16. We do not knowingly collect personal information from persons under 16. If we become aware that such information has been collected, we will promptly delete it. We also give due consideration to GDPR consent ages (13–16, varying by EU member state).
 

9 – Security

We implement reasonable technical and organizational measures, including SSL/TLS encryption and access controls, to protect personal information against unauthorized access, disclosure, alteration, or loss. However, we cannot guarantee absolute security in internet communications.
 

10 – Changes to This Policy

This Policy may be updated from time to time. Material changes will be communicated via notice on our website or by email.