Privacy Policy

Last updated: 2026-05-02

1. Who is responsible

Model Release Form is operated from Belgium and the data controller for personal data processed by the Service. For any privacy-related question, contact support@modelreleaseform.app.

2. What we collect

We collect only what is needed to operate the Service:

  • Account data — email address and (optionally) name, managed by our auth provider.
  • Release form content — photographer name, shoot date, location, scope of use, model names, model emails (optional), and the signature image captured at signing.
  • Generated PDFs — produced from the form content above and emailed to you and the model(s).
  • Subscription state — Pro status, Stripe customer ID, current period end. We do not store card numbers or banking details.
  • Operational logs — error reports and request metadata strictly needed to keep the Service reliable.
  • Aggregate analytics — page views and conversion events without personal identifiers (no cookies, no cross-site tracking).

3. Lawful basis

We process this data on the basis of (a) contract — running the Service you signed up for, (b) legitimate interest — keeping the Service secure and reliable, and (c) legal obligation — invoicing and tax records.

4. Who else processes your data

We use the following sub-processors. All are bound by their own data-processing agreements and security commitments:

  • Clerk (US) — authentication and account management.
  • Neon (EU) — Postgres database storing your forms, signatures, and account state.
  • Vercel (US/EU) — application hosting and edge network.
  • Stripe (US/EU) — payment processing and subscription billing.
  • Resend (US) — email delivery (signed PDFs, transactional notifications).
  • Sentry (US/EU) — error monitoring with PII scrubbing enabled.
  • Vercel Web Analytics (US/EU) — privacy-friendly analytics, cookie-less and GDPR-compliant.
  • Cloudflare (US/EU) — DNS and email routing for our domains.

International transfers (e.g. to US sub-processors) are covered by the EU–US Data Privacy Framework or Standard Contractual Clauses, as applicable.

5. How long we keep it

We keep your account and forms for as long as your account is active. When you delete your account from /settings, we delete your forms, signatures, and identifiable account data within 30 days. Stripe and tax records may be retained longer where required by law (typically 7 years for invoicing in Belgium).

6. Your rights

Under the GDPR you have the right to: access your data, correct inaccurate data, erase your data, restrict or object to processing, and receive your data in a portable format. To exercise any of these, email support@modelreleaseform.app. We respond within 30 days.

You can also lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be) if you believe we are mishandling your data.

7. Models who sign a release

If a photographer using the Service has sent you a signing link, the photographer is the controller of the release content (names, signatures). We process that content as a processor on their behalf. Contact the photographer to access, correct, or delete your signed release. If they cannot help, you may contact us and we will assist where possible.

8. Cookies and tracking

We set a session cookie issued by our auth provider so you stay signed in. We do not use advertising cookies, fingerprinting, or cross-site tracking. Our analytics provider (Vercel Web Analytics) is cookie-less.

9. Children

The Service is not directed at children under 16. Do not create an account if you are under 16. If you are a photographer collecting a release from a model under 18, you remain responsible for obtaining a parent or guardian’s consent where required by your jurisdiction.

10. Security

We use HTTPS everywhere, encrypted storage at rest, scoped production credentials, and PII scrubbing in error logs. No system is perfectly secure; if we ever discover a breach affecting your data we will notify you and the relevant supervisory authority within 72 hours, as required by GDPR Article 33.

11. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the current version. Material changes will be announced by email to active accounts at least 14 days in advance.

12. Contact

Questions, requests, or complaints? support@modelreleaseform.app.