Privacy policy

Your account

Signing in is handled by Netlify Identity, not by Latentshoot’s own database. It holds your email address, the name you gave it, and — if you sign in with a password rather than with Google — your password, which Latentshoot itself never sees or stores. Signing in leaves a small marker in your browser so you stay signed in between visits.

What is stored in Latentshoot’s database

Once you are signed in, Latentshoot stores the things a shoot needs: your team, the projects under it, and for each project the shot list, the shoot days and running order, the moodboard, the locations, the gear list, and the people on the crew list for that shoot. Two of those are personal data about people other than you:

• Your library — the clients and contacts you keep at team level, so you do not retype them on every shoot. This is personal data about third parties (a client’s contact details, a model’s agency, a crew member’s phone number), and you are the one who decides to put it in Latentshoot and who has a basis for holding it — Latentshoot stores it on your behalf, it does not collect it independently.
• A project’s people and locations — a casting of a library contact onto one shoot (their call time, their number for that job), plus each location’s address, access notes, parking, permit and the person to ring there. This is treated as more sensitive than the rest of a project — see share links, below.

A project’s client name is never stored as its own text field — it is looked up from the client record each time, so renaming a client does not leave a stale copy sitting on old projects.

Uploaded images

Moodboard references, shot sketches and your team’s logo are kept as files in Netlify’s file storage (Netlify Blobs) rather than in the database itself. Each file is served back from a web address containing a long random code, and that code is the only thing protecting it: the service that makes the thumbnails you see in the app cannot be told to check whether you are signed in. Anyone who has the exact address of an uploaded image can view it. Do not put anything confidential in a moodboard reference or a shot sketch.

RAW and HEIC files you add to a gallery are kept in private storage that is never shown to your clients, and you can remove them at any time from the gallery’s settings or your account page.

Finding references, and pasting addresses

The moodboard can search a handful of photograph libraries — Unsplash, Pexels, Flickr, Openverse and Wikimedia Commons. A search goes to the library you are searching, so it sees the words you typed; the results are shown straight from the library’s own addresses and Latentshoot stores nothing for them. Picking a photograph copies it into Latentshoot’s file storage, with the photographer’s name and its licence kept alongside so the credit survives.

Pasting a web address onto the moodboard makes Latentshoot’s server fetch that page for you — the site you pasted sees Latentshoot’s address, not yours. Where the page is a single photograph, the photograph is copied into file storage and credited; any other page becomes a link card built from what the page publishes about itself.

You can also connect your own Pinterest account. Doing so stores the permission Pinterest issues, encrypted, together with the account’s name — so the panel can say whose account is connected without asking Pinterest each time. Nothing from your boards is stored: pins are read live each time the panel opens, and picking one imports the page the pin was saved from, exactly as if you had pasted its address. Disconnecting the account, from the panel or from your account page, deletes the stored permission.

Share links

A share link is how a client or a crew member sees a project without an account. It works the same way as an uploaded image: the long random code in the link is the key. There is no login behind it. Anyone who has the link can see whatever it was created to show — a moodboard, a shot list, a schedule, or (on a call-sheet link) crew and location contact details. Treat a call-sheet link the way you would treat the printed sheet: fine for the people on the job, not for a public post. Switching a link off stops it working immediately; Latentshoot keeps a record that it existed, how many times it was opened and when it was last opened, for your own reference, even after it is switched off. That record is a count and a moment; nothing else about the reader is stored beside the link.

On the Studio plan you can put a password on a link as well, which is the one thing about it that does not travel with the address. What Latentshoot stores is a salted hash of that password, never the password itself, so nobody here can read it or tell it to anyone who asks — including you, which is why changing it is the only way to recover it. Until the password is typed, the link answers with nothing at all: not the shoot, not the client, not the name you gave the link.

Payments

Upgrading a plan and managing billing happens through Stripe Checkout and the Stripe customer portal. Card details are entered on Stripe’s own pages and never reach Latentshoot’s servers. What Latentshoot stores about billing is limited to the references Stripe gives it for you and your subscription, the plan you are on, whether it is active, and when it next renews.

What stays on your device

On-set mode saves your taps — a shot marked captured, a reorder, a recorded duration — on the device itself before sending them, so a tap survives with no signal. Until they have gone through, they exist only on that one device: clearing your browser’s data for this site, or using a private window, can lose a change that had not sent yet. These public pages, including this one, carry no analytics or advertising trackers of any kind.

How the app itself is measured

Once you are signed in, the app records how it is used — which screens are opened, which actions are taken, and the errors it runs into — through PostHog, so that what gets built next follows from what people actually do. Your account identifier, your name and your email address go with it, so a returning session is recognised as the same person. What does not go with it is the work itself: no shot list, image, client record or call sheet is sent. None of it is sold, and none of it goes to an advertising network. Payments are counted the same way, from the receipt Stripe sends our server rather than from your browser, so the figure recorded is the one actually charged.

Opening a share link is counted too, without the identifying part: no name, email or account goes with it, and what is recorded is the kind of link that was opened — a moodboard, a shot list, a call sheet — never what was on it.

Connected assistants

You can authorise an AI assistant — Claude or ChatGPT, for example — to work with your shoots. The consent screen states what the grant allows before you approve it, and an assistant never gets more than your own role in the team allows: a viewer’s grant stays read-only. An assistant can add shots and revise a plan; it cannot delete a project, a shot or a person — removing work stays in the app, where you can see what else points at the thing you are about to lose. Every grant is listed on your account page, and revoking one there cuts the assistant off immediately. What an assistant does is counted in the same usage measurement described above — which tool it called, never the text it carried.

The weather forecast

The schedule and the call sheet show a forecast from Open-Meteo for each place a shoot day goes. To get it, Latentshoot’s server sends Open-Meteo the place’s latitude and longitude, rounded to about a kilometre, and the date. The place’s name and address, the shoot, your account and your client are not sent. Your browser never contacts Open-Meteo, and neither does the browser of anybody opening a call-sheet link. Latentshoot keeps a copy of each forecast on its server, under the rounded coordinates and the date, so everybody opening the same call sheet is shown the same forecast, fetched once.

Who else sees any of this

Latentshoot is built entirely on Netlify: the site itself, the database behind it, file storage, sign-in and the image handling all run there. Payments are handled by Stripe. Maps, and looking up an address to place it on one, come from OpenStreetMap and its Nominatim address search. The map link printed on a call sheet opens Google Maps; following it is a visit to Google, the same as clicking any link. The weather forecast comes from Open-Meteo, which is sent only the rounded coordinates and the date, as described above. A reference search goes to the photograph library you are searching, as described above, and to nobody else. If your team’s owner has agreed to sending photographs to a model, a smaller copy of each photograph you analyse goes through Netlify’s AI Gateway to Google’s Gemini, which marks closed eyes and a missed focus and describes what is in it; the description is stored with the photograph, used to suggest a set-up and tags, and never shown to your client. Nothing from your shot list is sent with it. Matching a photograph to a reference in Develop sends a smaller copy of both, with the settings being refined, through the same gateway to Google’s Gemini. Selecting part of a photograph from a description sends a smaller copy of it through the same gateway to Google’s Gemini, and the outline that comes back is stored with the photograph. Changing an area you have painted over sends the part of the photograph around it, and the area you painted, through the same gateway to the image model Latentshoot uses for changes at the time, which is Google’s Gemini or one of OpenAI’s image models, and the picture that comes back is stored with the photograph. Extending a photograph past its edges sends a smaller copy of the whole photograph through the same gateway to Google’s Gemini, and the picture that comes back is stored with the photograph; only the area around the photograph is taken from it. Sorting a client’s notes on their selects sends the words of each note, the photograph’s filename and whether an area was marked through the same gateway to Google’s Gemini, and never the photograph or the name or email address the client gave; what each note is asking for is stored beside it and never shown to your client. Drafting a fix for a client’s note sends a smaller copy of the picture the client chose, with the words of their note and the area they marked, through the same gateway to Google’s Gemini; the settings it proposes are stored beside the note and never shown to your client, and a change it proposes is sent to the image model only once you have confirmed it. The gateway sends photographs and notes only to services that keep no copy of what they are sent. Nothing is sent from a gallery unless it allows sending frames, and the marks a scan leaves are never shown to a client. Product analytics for the signed-in app go to PostHog, as described above. None of these exist to further process your data for their own purposes beyond providing the service Latentshoot is built on; none of them other than Stripe ever receives payment details.

Content Credentials

Where Latentshoot adds Content Credentials to a photograph an image model helped make, the file records which areas the model made and that Latentshoot signed it. The credentials do not record what you asked the model for, the photograph’s filename or your account. Latentshoot keeps its own record of each signature: which file it covers, which account asked for it if one did, which team and version it belongs to, and when it was made. That record is kept so a signed file can be accounted for if anybody questions it, and it is deleted two years after the signature. The credentials inside a file you have delivered stay with the file.

Getting your data out, or deleting it

Latentshoot does not yet have a self-service export or account-deletion button. Until it does, write to hello@latentshoot.com and ask for either — a copy of a project’s data, or the deletion of your account and everything under it. One thing to know going in: a client or contact you have used on a shoot is archived rather than deleted when you remove it from your library, because it is part of the record of work already done; archiving hides it from your day-to-day lists without erasing that history. A full account deletion removes it regardless. A request for a copy of your data, or for its deletion, is answered within one calendar month; a confirmed deletion is completed within 30 days of being confirmed, after which only routine service backups hold a copy until they age out in the ordinary run of the platform.

Who is responsible for this data

Latentshoot is provided by HJ Digital, subject to the law of England and Wales. An operation of this size is not required by data-protection law to appoint a formal data-protection officer, and none has been appointed. A data-protection enquiry, formal or otherwise, goes to hello@latentshoot.com and is answered by the people who run the service.

Changes to this policy

If what Latentshoot stores or how it is used changes in a way that matters, this page will be updated and the date at the top will change.

Contact

Questions about anything above: hello@latentshoot.com.