Privacy Policy

1. Who we are

Studio (kadrasys.dev) is a service for photographers: videos from photos, client and booking management (CRM), an AI secretary, and a work schedule.

The operator is Arkadiy Sheferman, self-employed. Data questions: support@kadrasys.dev.

This policy explains what data Studio stores, why, and who it is shared with.

2. Data we store

• Account: email address, password (only as a bcrypt hash; the password itself is not stored), time zone, the invite code you registered with.
• Photographer profile: name, studio name, the contacts you entered (phone, messengers, website, city, studio address).
• CRM: data about your clients that you enter (name, phone, email, Telegram, WhatsApp, birthday, notes), bookings (date, time, service, price, payments, location, notes), booking files, tasks, services.
• AI secretary: the knowledge base about your work (facts you confirmed), the full interview conversation with the secretary, drafts and confirmation cards, AI cost records.
• Schedule: working days and hours, date exceptions, booking rules.
• Media: uploaded photos, generated videos, covers, selected music, voice-overs, post and script texts.
• Google Calendar - only if you connected it (section 6).
• Technical logs: our servers and providers keep service request logs (time, requested address, errors).

3. Why

Only to make Studio work for you: store your materials and bookings, create videos and texts, run the secretary interview and its knowledge base, calculate free time for bookings, sign you in.

We do not sell data, show ads, or share data for advertising.

You enter your clients' data into the CRM yourself. You are responsible for having a basis to process it; Studio stores and processes it on your behalf.

4. Who else processes data

Studio runs on providers' services. Each receives only what it needs for its part of the work. Provider servers may be located outside Russia.

• Railway - application servers, database, task queues.
• Vercel - the website interface.
• Cloudflare - domain names, site protection, forwarding mail to support@kadrasys.dev.
• Cloudflare R2 - file storage: photos, videos, music, voice-overs, booking files.
• Anthropic (Claude models) - AI: the secretary interview and processing of its answers, post and script texts, analysis of your photos for video direction.
• Novita AI and PiAPI - creating videos from your photos (Kling model): they receive a photo and a motion description.
• Yandex SpeechKit - speech synthesis for video voice-overs: receives the voice-over text and returns audio.
• Google - only if you connected Google Calendar (section 6).

5. Voice and photos

Studio does not record or store your voice: Studio has no voice input. For video voice-overs, Yandex SpeechKit receives only text and returns a synthesized voice.

Photos are stored in Cloudflare R2 and sent to Anthropic, Novita AI and PiAPI only to create videos, texts and direction at your request.

6. Google Calendar

Connecting is optional. If you connect Google Calendar on the "Schedule" tab, Studio requests only two permissions from Google:

• calendar.freebusy - to see free/busy information of the calendars you select: only "busy from ... to ..." times. Studio does not receive or read the titles, descriptions, attendees or any other content of your events.
• calendar.app.created - to create a separate "Studio" calendar and keep your bookings there as events: time, service, client name. The client's phone and other contacts are not included. Studio does not write to your other calendars.

Why: busy times block that time for bookings in Studio, and your bookings appear in Google Calendar.

The Google access key (refresh token) is stored encrypted (AES-256-GCM). Free/busy information is cached for no longer than one day.

The "Disconnect" button deletes the access key from Studio and revokes it at Google. The "Studio" calendar stays with you - you can delete it in Google Calendar. You can also revoke access in your Google Account settings: myaccount.google.com/permissions.

Data received from Google is used only to show free time and to maintain the "Studio" calendar. It is not sold, not used for advertising, and not used to train AI models.

Studio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Cookies

Studio uses one cookie - to keep you signed in (session). There are no analytics, advertising or third-party tracking cookies.

8. Retention and deletion

Data is kept while your account exists.

You can have your account and all data deleted on request: write to support@kadrasys.dev from the address your account is registered with - we will delete them within 30 days.

You can delete individual bookings, clients, knowledge base facts and schedule exceptions yourself in the interface.

9. Security

The connection to the site is protected by HTTPS. Passwords are stored only as hashes, Google access keys are stored encrypted. The account owner has access to the account data; we access the data only to provide support at your request and to fix failures.

10. Your rights

You can find out what data about you is stored, correct it, or request its deletion - write to support@kadrasys.dev.

11. Changes

If this policy changes, the new version will be published on this page with a new date.

12. Contact

Arkadiy Sheferman, self-employed. support@kadrasys.dev