Privacy Policy

1. Who we are

ShotSync.ai is operated by Photoworks Sydney Pty Ltd (“we”, “us”, “our”). We provide a post-production automation platform for fashion eCommerce brands, accessible at shotsync.ai. For privacy enquiries, contact us at hello@shotsync.ai.

2. What data we collect

• Account data: name, email address, organisation name, and billing details provided at signup.
• Usage data: pages visited, features used, export jobs created, and browser/device information collected via server logs.
• Uploaded images: product images you upload for processing. These are used solely to perform the service and are not shared with third parties.
• Payment data: handled entirely by Stripe. We do not store card numbers or banking details.

3. How we use your data

• To provide, operate, and improve the ShotSync.ai platform.
• To send transactional emails (account creation, billing receipts, onboarding).
• To respond to support requests.
• To comply with legal obligations.

We do not sell your data to third parties or use uploaded images to train AI models.

4. How your images are handled

Your product images never leave your device during normal use. ShotSync.ai processes images entirely within your browser — clustering, renaming, resizing, and export packaging all happen locally. Images are stored in your browser's local storage (IndexedDB) for the duration of your session and are never uploaded to our servers as part of the standard workflow.

There are two specific exceptions where image data temporarily leaves your device:

• Background removal — if you use the background removal feature, a compressed copy of the relevant image is transmitted to an AI processing provider to perform the removal. The image is processed and returned immediately and is not retained by the provider.
• Shopify draft creation — if you push draft listings directly to Shopify, processed images are temporarily uploaded to a private staging area to generate the required URLs for the Shopify API. These temporary files are deleted immediately after the Shopify upload completes.

Account data (name, email, organisation, billing history) is stored securely in cloud infrastructure hosted in Australia. We use TLS encryption in transit and encryption at rest for all stored data.

5. The ShotSync browser extension

The ShotSync Chrome extension fills a retailer’s product form with listings you have already created in ShotSync. It is optional, does nothing on its own, and requires a ShotSync account.

What it reads. When you click the ShotSync icon on a retailer’s page, the extension reads the structure of the form on that page — the field names, labels and types it needs in order to know what to fill. It reads the page only on that click, only on the tab you are looking at, and stops when you navigate away.

What never leaves your browser. The form structure it reads, and the field mappings you create for your own portals, are stored in your browser’s local extension storage and are never transmitted to us. We do not receive, log or store the contents of the retailer pages you visit, and the extension does not track your browsing.

What it sends to ShotSync. Only what is needed to fetch your own listing: your ShotSync API key, to authenticate you, and the identifier of the product you select. In return it receives that product’s own data and images — the ones you are about to place into the form.

What it never does. The extension fills a form and stops. It does not submit listings, and there is no setting that makes it do so — pressing the retailer’s own Submit button is always yours.

Removing the extension deletes its stored key and mappings from your browser.

6. Third-party service providers

To operate the platform, we engage third-party service providers who process data on our behalf. We only share data necessary for each provider to perform their specific function and do not authorise any provider to use your data for their own purposes.

• Cloud infrastructure and hosting — account data, session data, and application logs are stored and served via cloud hosting providers. Data is stored in Australia where available.
• Payment processing — billing and subscription payments are handled by a PCI-compliant payment processor. We do not store card numbers or banking details.
• Transactional email — your email address is shared with an email delivery provider solely to send account and billing notifications.
• AI processing — where you use AI-powered features (product copy generation, background removal), the minimum necessary data — such as product specifications or a single compressed image — is transmitted to an AI provider to perform the requested task. Images are not retained by the provider or used for model training.
• Error monitoring — anonymised error and performance data may be shared with an application monitoring service to help us identify and resolve bugs. This may include browser type and general usage context but does not include your images or brand assets.
• Analytics — anonymised traffic and feature usage data is collected by a web analytics service. This data is not linked to individual accounts and does not include image data.
• Advertising measurement — on our public marketing pages only, LinkedIn and Meta receive a signal when a visit or a signup happens, so we can tell which advertisements work. They see the page and the event, not your account contents, your product data or your images. Nothing in the signed-in application reports to them.

A current list of our specific sub-processors is available on request — email hello@shotsync.ai.

7. Your rights

Under Australian Privacy Law and where applicable GDPR, you have the right to access, correct, or delete your personal data. To exercise these rights, email hello@shotsync.ai.

8. Cookies

We use essential session cookies for authentication. These are required for the platform to work and cannot be turned off.

We also use analytics and advertising cookies on our public marketing pages, set by Google Analytics, the LinkedIn Insight Tag and the Meta pixel. They tell us which pages people read and which advertisements led someone to sign up. They are not used inside the application, are never connected to your shoot files or product data, and set no cookie that identifies you personally to us.

Your browser’s Do Not Track or tracking-prevention settings are respected, and blocking these cookies does not affect anything in the product.

9. Changes to this policy

We may update this policy from time to time. Significant changes will be notified by email. Continued use of the platform after changes constitutes acceptance.