Privacy policy

Effective October 17, 2026 · Gallery Composer, made by Suffuse, Asheville, North Carolina

What we collect, why, who else handles it, and how long we keep it. We collect what the service needs to work, and we do not sell personal information.

1. Who we are

Gallery Composer is made and operated by Suffuse, Asheville, North Carolina, United States. For the personal information of our account holders, we decide how it is used. Questions about this policy go to hello@gallerycomposer.com.

2. What we collect from account holders

Account details: your email address, a hashed password (we never store the password itself), the date you joined, and whether your email is verified.
Your content: the galleries, sites, pages, products, photographs, words and settings you create or upload.
Team and sites: which sites you belong to, your role on each, and invitations you send or receive, including the invitee’s email address.
Billing: your plan, its status, and the identifiers Stripe gives us for your customer record and subscription. Card details are entered on Stripe and never reach us.
Selling: if you connect Stripe to sell, the identifier of your Stripe account and whether it can take payments.
Domains: if you buy a domain through us, the owner’s name, address, phone and email that the registry requires, passed to our registrar partner to register it.
AI connections: which assistants you have connected, when, and when they last used the connection.
Security and support: sign-in attempts and IP addresses (to stop abuse), error reports, and anything you send us when you write to us.

3. What we collect from buyers

When someone buys from a site or gallery, Stripe handles the payment and tells us about the order: the buyer’s name and email, what was bought, the amount, and the shipping address. We keep this so the seller can fulfil the order and so stock can be counted. The seller can see it. We do not use buyers’ information for our own marketing and we do not sell it.

4. What we collect from visitors

People who visit a site or gallery made with the service are not tracked by us. We do not use analytics or advertising trackers on those pages. Like any web server, ours and our providers’ record basic technical logs (such as IP address, browser type, the address requested, and the time) to deliver pages, keep the service secure, and fix problems.

5. Cookies and browser storage

We set one cookie, a sign-in cookie, and only for people who log in. It keeps you logged in for up to 30 days and is not used for tracking. Some features remember things in your own browser’s storage, such as a shopping cart before checkout or which tab you last had open; that stays on your device until it is needed. Fonts on sites may be loaded from Google Fonts, which receives the request as any web host would.

6. How we use information

to provide, run, secure and improve the service, and to publish what you ask us to publish;
to take payment for plans and domains, and to let sellers take payment from buyers;
to send the email the service needs: verification, password resets, receipts, invitations, hand-offs, and notices about your account, these terms, or changes;
to answer you when you write to us;
to prevent abuse and fraud, and to meet our legal obligations.

We do not sell or rent personal information, and we do not use it for advertising.

We share information only with the providers who help run the service, only as much as they need, and only to do that job:

Stripe: plan billing, and payments between sellers and buyers;
Cloudflare: storage and delivery of photographs, published galleries, and backups;
Amazon Web Services: the servers that run the service, and sending email;
our domain registrar partner: registering domains bought through us;
AI assistants you connect: the information you authorise them to access.

We may also disclose information if the law requires it, to protect the rights, safety or property of our customers, the public or us, or as part of a merger, sale or reorganisation, in which case this policy continues to apply to it.

8. How long we keep it

We keep account information and content for as long as your account or site is open. When you delete something or close an account, it is removed from the live service straight away; copies in our backups are overwritten within about 30 days. We keep order and billing records for as long as tax and accounting law requires, and security logs for a limited time.

9. Security

We use reasonable safeguards: passwords are hashed, connections are encrypted, access is limited, and the service is backed up nightly. No system is perfectly secure, and we cannot guarantee the security of information sent to or stored on the service. If we learn of a breach affecting your personal information, we will tell you as the law requires.

10. Your choices and rights

You can see and change most of your information inside the service, download your galleries, delete content, and close a site or your whole account at any time. Depending on where you live, you may also have the right to ask for a copy of your personal information, to correct it, to delete it, to object to or restrict how it is used, or to move it elsewhere. Email hello@gallerycomposer.com and we will respond within the time the law allows. We will not treat you differently for asking.

11. If you sell or run a site

For your buyers’ and your visitors’ personal information, you are responsible for how you use it, and for having your own privacy policy and store policies where the law requires them. We handle that information on your behalf, to provide the service to you.

12. Children

The service is not meant for children, and accounts are for adults. We do not knowingly collect personal information from children under 13. If you believe a child has given us their information, contact us and we will delete it.

13. Where it is stored

Our servers are in the United States, and our providers may process information in other countries. By using the service you understand that your information will be handled in the United States, where the law may differ from where you live.

14. Changes to this policy

We may update this policy. If a change is material, we will email account holders before it takes effect. The date at the top shows when it last changed.