We handle sensitive data — model photos, signatures, and personal information. Here's exactly what we collect, why, and how we protect it. No legal jargon.
Last updated: March 2026 · Effective immediately
Your information and your clients' data is never sold or shared for advertising.
Email us and we'll delete your account and all associated data within 30 days.
All data travels over HTTPS/TLS. Sensitive records are stored on secure infrastructure.
When you sign up, we collect your email address, optional business name, and optional phone number. That's it — we don't require a password. We use a "magic link" sent to your email to log you in securely.
When you create a model release, the form captures the model's name, date of birth, contact information, selfie photo, and digital signature. This is the core purpose of the product — it's what makes your releases legally valid. This data belongs to you and your clients; we store it to make your records accessible.
When you create invoices, we store client names, email addresses, billing details, and shoot descriptions you enter. We also store the invoice amounts and payment status you manually mark.
The selfie verification feature captures a photo of the model's face at the time of signing. This image is stored as part of the signed release record. We do not run facial recognition or biometric analysis on these photos — they serve only as a visual record that the correct person signed the release.
Our hosting provider (Vercel) automatically collects basic server logs including IP addresses and browser type when you use the site. We don't actively collect analytics beyond what's needed to keep the service running.
We only collect data that is directly necessary to provide the service. Here's the plain-English reason for each piece:
We do not sell your data. We do not share it with advertisers. The only third parties who touch your data are the vendors we use to operate the service:
Our site and all your data runs on Vercel's servers. Vercel may process server logs (IP addresses, request data) as part of normal hosting operations.
View their privacy policy →When we send magic links, release signing notifications, or invoice emails, the recipient email address passes through Resend's systems for delivery. Resend does not retain email content beyond delivery.
View their privacy policy →Important: When you send a signed release to a stock agency (Getty, Shutterstock, etc.), you are sharing that release with that agency directly. ShootForms facilitates this delivery but the agency's own privacy policy governs how they handle that data.
Because ShootForms handles selfie photos and digital signatures, we want to be especially clear about how this sensitive data is handled.
Illinois BIPA / State Biometric Laws: Some US states have laws governing the collection of biometric data (facial geometry, fingerprints, etc.). Selfie photos that are not processed for biometric features generally fall outside these laws. We take a conservative approach: we do not extract or process biometric identifiers from any photos stored on ShootForms. If you have specific concerns about your jurisdiction, please contact us.
Model releases and invoices often need to be retained for years — stock agencies may need to reference a release years after a shoot. Here's our retention approach:
Regardless of where you live, we honor these rights for everyone:
California residents (CCPA): We do not sell personal information. You have the right to know what categories of data we collect, which is fully described on this page.
We use no advertising cookies and no third-party tracking scripts. The only browser storage we use is:
If you want to access, correct, or delete your data — or if you have any privacy concern at all — please reach out. We'll respond within 5 business days.
ShootForms is operated by 4mattcarlson · shootforms.com