Privacy notice

Who is responsible

What we collect and why

• Update requests: your email address, the form you used, the updates you requested and when you signed up. We use these to record your request and send the updates you asked for, based on your consent.
• Purchases: your purchase email, order and payment references, amount, currency and payment/refund status. We use these to deliver and support your purchase and maintain necessary transaction records.
• Course sign-in: your purchase email, hashed sign-in tokens and session expiry times. We use these to authenticate you and protect paid access.
• Support: the email address, topic, message and reference associated with a contact request. We use these to answer questions, handle refunds and respond to privacy requests.
• Security: short-lived request counters keyed to a hash of the client IP address. These help limit abuse. Our hosting and payment providers may also process connection and security logs.

Providing contact information is optional when you explore the free tool. An email address is needed to save an update request, reply to a message or recover a course purchase. We do not ask you to upload photographs to use the shoot planner.

Our reasons for using this information

We rely on consent for requested marketing updates; carrying out a contract for purchases and course delivery; and our legitimate interests in responding to enquiries, securing the site and preventing abuse. Necessary transaction records may also be retained to meet applicable legal obligations. Privacy requests are handled to meet those obligations.

We do not sell your personal information. Browsing the shoot planner does not subscribe you to email, and contacting support does not add you to marketing. We do not use the shoot planner to make automated decisions with legal or similarly significant effects about you.

Services that handle information

Railway hosts this website and its PostgreSQL database. Waitlist and contact requests are saved there. Email delivery is not yet configured for this waitlist launch. Resend is the planned provider for requested updates; Stripe is used by the course purchase system when sales are enabled. Course checkout is currently closed. AlphaShot does not store full payment card details.

The current Railway application and database are hosted in its US West region, outside the UK. Provider arrangements and applicable transfer safeguards are being confirmed before the full launch. Ask through our privacy contact form for details.

You can read Resend’s privacy policy and Stripe’s privacy policy. Following a research source link takes you to a separate website with its own practices.

Cookies and browser storage

Signing in sets a cookie named shotalpha_course_session. It keeps you signed in for up to seven days and is removed when you sign out. It is used for course access and cannot be read by normal page scripts.

The current application does not include advertising trackers or analytics cookies. The shoot planner’s filters stay in page memory. When you save an idea, its brief ID is stored in this browser under alphashot.shortlist.v1. This list is not sent to our servers or linked to your email. It stays on this website address in this browser until you remove the ideas or clear site data. Browser/private-mode settings can also remove or block it. A shortlist backup is a file you choose to download and import; it contains brief IDs. There is no account or automatic device sync. When you choose Save this plan in the personalised planner, your equipment, time, experience, selected settings, participants, interests, brief ID and optional notes are stored under alphashot.personal-plan.v1. It keeps one personal plan in this browser until you replace it, remove it or clear site data. These answers and notes are not sent to our server or linked to your email. Unsaved changes stay in the current tab. No location lookup or photo upload is used. Stripe’s hosted checkout may use its own cookies under its privacy policy.

How long information is needed

Signup requests are kept while needed for the updates you requested, unless you withdraw the request or the purpose ends. Order records are needed while we provide purchased access and for any applicable accounting, refund or dispute obligations. Support records are kept while handling the request and any related complaint or dispute. These records are managed separately from provider contact lists and backups.

Sign-in links expire after 15 minutes and sessions after seven days. Expired token records are removed during subsequent sign-in requests. Rate-limit counters expire after their short request window and are cleared during subsequent checks. Expiry and deletion from storage are separate events.

Your choices and rights

You can withdraw consent for marketing at any time using the unsubscribe link in an update email or by submitting an email-preference request. Existing unsubscribe preferences are not automatically reversed when you submit another signup. Withdrawing marketing consent does not cancel a course purchase or necessary access emails.

Depending on applicable law, you may ask to access, correct, delete, restrict or obtain a copy of your information. You may object to direct marketing at any time and to processing based on legitimate interests where applicable. We may need to verify your identity before changing or disclosing records. Some information may need to be retained to meet a legal obligation or resolve a claim.

You can complain to the data protection authority in your country. For UK data protection concerns, information is available from the Information Commissioner’s Office.

Changes to this notice

The date above identifies this version. If we introduce a materially different use of personal information, we will explain it before that use and seek consent where required.