Privacy Policy

This Privacy Policy applies to openset.studio, join.openset.studio, OpenSet accounts, studio applications, booking workflows, and related communications that link to this policy.

OpenSet is responsible for the platform information described here. Independent studios are separate businesses and may separately use booking, production, guest, insurance, or payment information under their own policies and legal obligations.

Depending on how you use OpenSet, we may collect:

• Account information: name, email address, phone number, profile image, authentication provider, account role, verification status, and account preferences. Authentication credentials are handled by Firebase Authentication; OpenSet does not receive your password in readable form.
• Studio application and listing information: business and contact details, addresses, descriptions, services, equipment, rates, availability, policies, insurance status, certificates or related details, photographs, links, and owner or staff information.
• Booking and production information: requested studio, service, date and time, duration, estimated price, contact details, crew or setup needs, notes, booking status, cancellation details, reviews, and communications between users and studios.
• Payment and transaction information: if payment features are enabled, transaction amount, currency, status, payment-provider identifiers, refunds, and related records. Stripe or another payment provider receives complete card details; OpenSet does not store full payment-card numbers.
• Support and communications: messages, feedback, support requests, email delivery information, and records of our responses.
• Device and usage information: IP address, browser and device type, operating system, pages or endpoints requested, timestamps, referring page, error and security events, and similar server or service logs.
• Approximate or precise location: if you allow browser location access, the studio directory may use your device's coordinates to sort locations by distance. The current web feature performs that sorting in your browser and does not intentionally save those coordinates to your OpenSet profile.
• Bot and abuse-prevention signals: device, browser, network, interaction, and challenge results processed by Cloudflare Turnstile and our rate-limiting systems.

Free-form fields may contain information you choose to provide. Please do not include government identifiers, financial-account credentials, medical details, or other sensitive information that OpenSet has not requested.

• Directly from you when you create an account, apply, request a booking, communicate, or upload content.
• From a studio owner, staff member, customer, or organization acting on your behalf.
• Automatically from your browser, device, and interactions with the service.
• From service providers that support authentication, hosting, security, communications, storage, and payments.

We use personal information to:

• create and secure accounts, verify identities, and provide role-appropriate access;
• review studio applications and create, maintain, and publish approved listings;
• process booking requests, availability decisions, payments when enabled, refunds, and related communications;
• enable messages, notifications, reviews, support, and account recovery;
• personalize and improve studio discovery, including location-based sorting when authorized;
• prevent fraud, abuse, spam, security incidents, and unauthorized access;
• debug, measure reliability, maintain audit records, and improve the service;
• enforce agreements, resolve disputes, protect users, and comply with law; and
• send operational messages and, where permitted, product or service updates that you may opt out of.

We may disclose information in the following circumstances:

• Studios and booking participants. We share information needed to evaluate and fulfill a booking request, communicate, manage access, address safety, and resolve a dispute.
• Public listings and content. Approved studio details, photographs, public reviews, ratings, and studio responses may be visible publicly. Contact, insurance, internal review, and account details are not published unless the relevant user or studio chooses to make them public.
• Service providers. We use providers such as Google Firebase and Google Cloud for authentication, databases, storage, and backend services; Vercel for web hosting and delivery; Cloudflare for bot protection; Upstash for rate limiting; SendGrid or another email provider for communications; and Stripe for payments when enabled. Providers may process information only for the services they supply, subject to their agreements and legal obligations.
• Legal, safety, and integrity. We may disclose information when reasonably necessary to comply with law or legal process; investigate fraud, abuse, or security incidents; protect rights, safety, and property; or enforce our agreements.
• Business transfers. Information may be reviewed or transferred in connection with financing, reorganization, merger, acquisition, or sale of assets, subject to appropriate confidentiality protections.
• At your direction. We may share information when you request or consent to it.

OpenSet does not sell personal information for money. We do not currently share personal information for cross-context behavioral advertising or use it to serve targeted advertising. If that practice changes, we will update this policy and provide legally required choices before using information that way.

We use essential cookies and browser storage for authentication, security, role-aware navigation, theme preferences, and service operation. We do not currently use advertising cookies. Details and control options are in our Cookie Notice.

We retain information for as long as reasonably necessary to provide the service, maintain an account or listing, fulfill bookings, comply with financial and legal obligations, maintain security and audit records, resolve disputes, and enforce agreements. Retention depends on the type of record, its sensitivity, the relationship, and applicable law. Backups and fraud-prevention records may remain for a limited period after information is removed from active systems.

Account deletion does not require us to delete information that must be retained for completed transactions, tax or accounting records, disputes, safety, fraud prevention, or legal compliance. Where appropriate, we may anonymize retained records instead.

We use administrative, technical, and organizational safeguards designed to protect personal information, including encrypted network connections, managed authentication, access controls, private backend invocation, rate limiting, and bot protection. No system is completely secure, and we cannot guarantee absolute security. Protect your credentials and contact us promptly if you suspect unauthorized access.

You may update certain account and studio information in the service, control browser permissions such as location, manage cookies or browser storage, unsubscribe from non-essential marketing messages, and request account deletion.

Depending on where you live and subject to legal exceptions, you may have rights to request access, correction, deletion, or a portable copy of personal information; to learn about categories of collection and disclosure; to opt out of certain sale, sharing, targeted advertising, or profiling; to limit certain uses of sensitive data; and to appeal a denied request. OpenSet does not discriminate against people for exercising applicable privacy rights.

To make a request, email howie@openset.studio with “Privacy Request” in the subject line. Describe your request and the account or email involved. We may verify your identity and authority before responding. Authorized agents may submit requests where permitted by law, but we may require proof of authority and direct confirmation from the individual.

We honor legally required browser-based opt-out preference signals, such as Global Privacy Control, for processing to which the signal applies. Because OpenSet does not currently sell or share information for targeted advertising, such a signal does not change current advertising practices.

OpenSet is intended for adults and is not directed to children under 13. We do not knowingly collect personal information from children under 13. Users must be at least 18 to create an account or enter a booking or studio relationship through OpenSet. If you believe a child provided personal information, contact us so we can investigate and take appropriate action.

OpenSet is operated from the United States. Information may be processed and stored in the United States and other locations where our providers operate. Those locations may have different privacy laws from your home jurisdiction. Where required, we use lawful transfer mechanisms and contractual protections.

Third-party services, studios, and linked sites have their own privacy practices. This policy does not govern information handled independently by those parties. Review their notices before providing information directly to them.

We may update this policy as OpenSet, our providers, or legal requirements change. We will post the revised policy and effective date, and will provide additional notice when a material change reasonably requires it.

OpenSet is operated from New York, New York, United States. Questions, complaints, and privacy requests may be sent to howie@openset.studio.