MOSbox Privacy Policy#

Last updated: October 16, 2026

MOSbox is software for wedding photographers, videographers and other creative businesses ("studios") and the clients they serve. Studios use it for bookings, contracts, invoices and payments, email, and delivering photos and films. This policy explains what information MOSbox collects, how we use it, who we share it with, and the choices you have.

MOSbox is operated by Joseph Pedreira Jr., a sole proprietor doing business as MOSbox, in Louisiana, United States ("MOSbox," "we," "us"). Questions: [email protected].

If you're a studio, read sections 1–10; sections 3A, 6 and 7 are about you in particular.
If you're a studio's client — for example a couple, a family, or someone paying an invoice — read sections 1–5 and 8–10; sections 2 and 3B are about you in particular, and section 7 if you sign in with Google.

1. Who this policy covers — for everyone#

• Studios — the businesses that sign up for MOSbox, and the team members they invite.
• Clients — couples and anyone else a studio works with through MOSbox. That includes people whose details a studio adds, people who fill in a studio's forms, sign its contracts or pay its invoices, and people who receive galleries and films in a MOSbox Vault.
• Visitors to mosbox.app.

MOSbox is for adults. You must be 18 or older to use it; section 11 explains.

2. Studios, clients, and who is responsible — for everyone#

MOSbox handles information for both studios and their clients, and each passes information to the other through MOSbox.

• Information a studio holds about its clients. When a studio adds its clients to MOSbox, or collects their details through MOSbox, the studio decides what to collect and how to use it. MOSbox stores and processes that information for the studio so the service works. If you're a client with a question about how a studio uses your information, ask the studio first. You can also contact us, and we'll help where we can.
• Information you give MOSbox directly. When a client uses their own Vault, or anyone uses mosbox.app, we handle that information directly under this policy.

3. Information we collect#

3A. For studios#

• Your account:
  • your name, business name, email address and sign-in details (passwords are held by our sign-in provider and never stored in plain text; if you sign in with Google, see section 7)
  • business details and branding, such as your logo, colors, website, social links and time zone (if you use "import from website," MOSbox fetches the logo and images from the address you give it)
  • team members you invite, and your settings
• Your subscription: your plan, billing status and billing records.
• Your Stripe connection. Each studio connects its own Stripe account to take payments. Stripe collects what it needs to verify you and pay you out, under Stripe's own terms and privacy policy. MOSbox stores your Stripe account ID and whether payments and payouts are switched on.
• Your connected mailbox: see sections 6 and 7, and the Email Policy.
• Help setting up or moving in. If you ask us to help set up your account or move your data into MOSbox, MOSbox support staff may look at the files you give us, for that purpose only.

3B. For clients#

• Information a studio adds or collects about you:
  • your name, email address and phone number
  • event details such as date, venue and notes
  • your answers to the studio's questionnaires and forms
  • contracts you sign electronically, with the name typed and the date and time
  • invoices, payment schedules and messages
• Your Vault: your email address or addresses, your display name, sign-in links, and which galleries and films have been delivered to you. If you sign in with Google, see section 7.
• Payments you make. Payments are processed by Stripe. You enter card or bank details on Stripe's secure page. MOSbox never receives or stores full card numbers or bank account numbers. We store the payment record from Stripe: amount, date, status, fees, payment method type (card or bank transfer), card brand, card type (for example debit or credit), and Stripe reference numbers.
• Activity the studio sees. MOSbox records certain actions and shows them to the studio in the project's activity feed. For example, it records when you open a file the studio sent, sign a contract, or pay.

3C. For everyone#

• Photos and videos a studio uploads for delivery, the thumbnails MOSbox makes from them, and technical details such as file size and running time.
• Technical information our hosting provider records automatically: IP address, browser type, pages requested, and the date and time. It's used for security and to keep the service running.
• Cookies. We use cookies and similar browser storage only to keep you signed in and to make MOSbox work. No advertising cookies and no third-party analytics.
• Support. When you contact us, we keep a record of the conversation and what we did. MOSbox support staff may look at your account to help, with your permission.

4. How we use information — for everyone#

• To run MOSbox:
  • store and show a studio's records
  • send the emails a studio writes, schedules or turns on
  • run the automations and reminders a studio sets up
  • deliver galleries and films
  • process payments through Stripe
• To keep MOSbox secure and prevent fraud and abuse.
• To tell studios about their account and the service, and to tell everyone when these policies change.
• To follow the law and enforce our Terms.

We do not sell personal information. We don't use it for advertising, and we don't share it with advertisers or data brokers. We don't use anyone's content or information to train artificial-intelligence models.

5. Who we share information with — for everyone#

Service providers that run MOSbox for us. They may use the information only to provide their service to us.

• Supabase — our database and sign-in.
• Vercel — hosts the website and app.
• Cloudflare — stores photos and videos (R2 and Stream), and runs our domain and email routing.
• Stripe — payments. Each studio's payments run through its own Stripe account.
• Google — to confirm who you are when you choose "Continue with Google," and, when a studio connects Gmail, to send that studio's email.
• Microsoft, or a studio's email provider — only when a studio connects its mailbox, to send and receive that studio's email.

Between studios and clients:

• A studio sees the information about its own clients.
• People the studio invites see what the studio allows. That includes team members, and a bookkeeper given a read-only finance link.
• A client sees the files, galleries, films, invoices and messages the studio shares with them.
• A studio never sees another studio's clients. If you work with two studios on MOSbox, neither can tell that you also work with the other.

For legal reasons. We share information when the law requires it, or to protect the rights, safety or property of our users, the public or MOSbox.

If MOSbox changes hands. If MOSbox is sold or merged, information may transfer to the new owner under this policy's protections. We'll tell you first.

6. Email connected to MOSbox — for studios, and the clients they email#

A studio can connect its own mailbox so its emails come from the studio's own address.

• Gmail is send-only. MOSbox never reads a Gmail inbox. Clients' replies come back through a MOSbox reply address, and a copy goes to the studio's Gmail. When the studio answers that copy, the answer comes back through the same address, and MOSbox sends it to the client. See section 7.
• Outlook and other providers. MOSbox sends from the studio's address, and checks new incoming mail only for replies from that studio's clients. Only those replies are copied into MOSbox. Everything else is left alone and not stored.
• Storage. Emails sent and received through MOSbox are stored with the project. Mailbox credentials are stored encrypted.
• Disconnecting deletes the stored credentials right away.

The Email Policy explains all of this in full, including reply addresses, unsubscribing, and the rules for sending.

7. Google user data — for anyone who signs in with Google, and studios who connect Gmail#

MOSbox's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data to develop, improve or train artificial-intelligence or machine-learning models.

Signing in with Google — for studios and clients#

If you choose Continue with Google to sign in:

• What we receive: your name, email address, profile picture and language preference, as Google's sign-in screen tells you, plus Google's confirmation that it has verified your email address and an ID that tells your Google account apart from others.
• What we don't receive: your Google password, or any access to your Gmail, Google Drive, contacts, calendar or anything else in your Google account.
• How we use it: only to sign you in, to recognize you the next time you sign in, and to connect you to the MOSbox account that uses the same email address. For clients, that includes the galleries and films a studio has delivered to that address.
• How we store it: with your sign-in record, held by our sign-in provider (Supabase).
• How we share it: we don't share it with anyone, except where the law requires it. We never sell it or use it for advertising.
• Stopping:
  • You can remove MOSbox's access at any time at myaccount.google.com/permissions. You can still sign in with an email link.
  • To delete your sign-in record along with your account, use Delete my account, or email [email protected].

Connecting Gmail — for studios#

If a studio connects a Google account:

• What we access:
  • the email address and basic profile of the connected account
  • permission to send email from that address (Gmail's "send email on your behalf" permission)

  We do not request permission to read, change or delete anything in your Gmail.

• How we use it: only to send, from your own address, the emails you write or schedule in MOSbox, the answers you send to a client through your MOSbox reply address, and notices to yourself, such as a copy of each reply a client sends to your MOSbox reply address.
• How we store it:
  • An encrypted access token (AES-256-GCM, with the key kept outside the database).
  • A record of each email sent through MOSbox, as part of your project.
• How we share it: we don't share Google user data with anyone except:
  • as needed to send your email through Google
  • with your permission
  • where the law requires it

  We never sell it or use it for advertising. No person reads it except:

  • with your permission
  • to investigate a security problem
  • where the law requires it
• How we protect it: encrypted connections everywhere, an encrypted token, and access limited to your own studio's records.
• Retention and deletion:
  • Disconnecting Gmail in Settings deletes the stored token right away.
  • You can also remove MOSbox's access at any time at myaccount.google.com/permissions.
  • Emails already sent stay in your project record until you delete the project or your account.

8. How we protect information — for everyone#

• Every connection to MOSbox is encrypted (HTTPS).
• Each studio's records are walled off at the database level, so a studio can reach only its own data.
• Mailbox credentials are encrypted.
• Card and bank details are handled by Stripe, a PCI-DSS Level 1 certified payment provider.
• Our storage providers encrypt stored data.

No system is perfectly secure. If a breach affects your information, we'll tell you as the law requires.

9. How long we keep information — for everyone#

• Studio accounts: while the account is open. After a studio closes its account, the rest of this list still applies.
• Delivered photos and videos:
  • kept as described in our Terms (sections 13–16): at no charge while the studio that delivered them keeps its MOSbox subscription
  • after that studio's subscription lapses: 90 days of full access, then up to one year of safe storage, then deletion unless a Vault membership keeps them
  • media that both the studio and the Vault owner delete is deleted right away
• Contracts and signed agreements: kept for the life of the account, as a record for both sides.
• Payment and financial records: at least seven years, for tax records.
• Emails and other project records: until the studio deletes them or closes its account, subject to the above.
• Mailbox credentials: until the mailbox is disconnected.
• Google sign-in details (if you use Continue with Google): with your sign-in record, until your account is closed.
• Records of who agreed to which version of these policies: for the life of the account.
• Technical logs: short periods set by our hosting provider.

10. Your choices and rights — for everyone#

• Studios:
  • You can see, edit and delete your information and your client records in MOSbox.
  • Delete your account in Settings → Delete my account. You'll be offered a download of your records first. To get a copy of your data at any other time, email [email protected].
  • Disconnect your mailbox in Settings at any time. You can disconnect MOSbox from your Stripe account in your Stripe dashboard.
• Clients:
  • Ask the studio first; it controls its records about you. If it doesn't help, contact us.
  • Download your media any time you have access.
  • Delete your account on your Vault page, or email [email protected].
  • Stop a studio's automated emails with the unsubscribe link in them.

The steps are also at mosbox.app/delete-account.

Some state laws give residents rights to know, access, correct and delete their personal information, and to opt out of its sale. We honor these requests from anyone, wherever they live. We don't sell personal information or share it for advertising. We won't treat you differently for making a request. Email [email protected] to make one; we may need to confirm who you are first.

11. Age — for everyone#

MOSbox is for adults 18 and older. We don't knowingly collect information directly from anyone under 18.

Studios sometimes photograph or film children, for example at a family session. The studio is responsible for having a parent's or guardian's permission to upload those photos and videos. If you believe we hold information about someone under 18 that we shouldn't, email [email protected] and we'll deal with it.

12. Where information is stored — for everyone#

MOSbox is run from the United States. Information is stored and processed in the United States and wherever our service providers operate.

13. Changes to this policy — for everyone#

When we change this policy, we post the new version here with a new date, and tell you before important changes take effect. That includes any change in how MOSbox uses Google user data.

• Studios get a notification in MOSbox, plus a banner.
• Clients see a banner in their portal or Vault the next time they visit.

You can read what changed, accept, or dismiss the notice. Using MOSbox after the change takes effect means you accept the new version.

14. Contact — for everyone#

MOSbox — Joseph Pedreira Jr., doing business as MOSbox, Louisiana, United States
[email protected]