Your photographs stay part of a private, controlled workflow.

The gallery displays JPEG photographs and filenames stored in the photographer’s Google Drive. Depending on the gallery, Morrow may also handle a client email address, favourited photographs, editing notes, submitted selections, and records showing when a gallery was opened or files were downloaded.

A random identifier is stored on the client’s device so selections can remain available between visits. For security and request limiting, Morrow temporarily stores a one-way fingerprint made from an IP address and browser information; the raw IP address is not stored in the Morrow gallery database. Hosting providers may keep their own limited security logs.

Information is used only to provide the photography service: to display and protect a private gallery, enable previews and downloads, return selections and notes to the photographer, deliver a requested gallery invitation, troubleshoot problems, and notify the photographer about relevant client activity.

Morrow does not sell personal information, use gallery photographs to train artificial-intelligence models, or use client information for advertising. Gallery-delivery information is not added to a marketing list.

Information is collected from the client, from the photographer’s existing service records, or automatically when the private gallery is used. Only information reasonably needed to provide and protect the gallery is requested. A client can decline optional notes, email delivery, or favourites and can contact the photographer to change or withdraw a submitted selection.

The JPEG files remain in the photographer’s Google Drive. Morrow has read-only access to specifically approved studio folders and cannot edit or delete those photographs. Google provides file storage, Cloudflare hosts the gallery and its private records, and an email delivery provider may be used when invitations or selection alerts are enabled.

These providers may process information outside Canada. Information handled in another country may be subject to that country’s laws and lawful access by its authorities. Damindu Singith remains responsible for selecting providers and limiting their access to what is needed for the service.

Morrow uses only functional storage needed for the gallery. This can include a secure access cookie after a correct PIN, an essential Cloudflare security cookie, and the random device identifier used for selections. There are no advertising cookies. If optional analytics or advertising tools are added later, this policy and any required consent controls will be updated first.

Security fingerprints and failed-access records are automatically removed after approximately 24 hours. Active gallery settings, selections, notes, activity and email-delivery records are kept while needed to complete the photography service. Inactive galleries are reviewed at least twice a year, and Morrow records are normally deleted within 24 months after final delivery unless they are still needed for an unfinished service, a dispute, a legal obligation, or a client request.

Archiving a gallery pauses public access but preserves its records. Deleting a gallery from Morrow removes its gallery settings and client interaction records; it does not delete the photographer’s original or delivered photographs from Google Drive. The photographer may retain those files separately as part of the studio archive and any agreement made with the client.

Morrow uses HTTPS, owner-only controls, optional gallery and download PINs, restricted browser permissions, request limits, and read-only Drive access. Client gallery links are intended only for the people the photographer or client chooses to share them with. Clients should not post a private link or PIN publicly.

No online system can promise zero risk. If a privacy incident creates a real risk of significant harm, Damindu Singith will document it and notify affected people and regulators when legally required.

A client may ask what gallery information is held about them, request a correction, withdraw optional consent, change a selection, or ask that information be deleted when it is no longer required. Some information may need to be retained where reasonably necessary to complete the service, keep required business records, establish a legal claim, or meet another legal obligation.

To make a request or complaint, contact Privacy contact: Damindu Singith through the studio website below and identify the gallery title. A response will normally be provided within 30 days. If a privacy concern cannot be resolved directly, a person may contact the Office of the Privacy Commissioner of Canada.

This policy may be updated when the gallery service or its providers change. The current version and its revision date will remain available at this address. A material change will not be applied retroactively where fresh consent is required.