Last updated September 7, 2026
ShootOS ("we", "us") provides software for real estate media companies to run their bookings, teams, editing, invoicing, and client delivery. This policy explains what we collect and how we use it. We built ShootOS to run our own media business — we treat your data the way we want ours treated.
ShootOS is used by two kinds of people: team members (owners, photographers, editors, project managers) who sign into the apps, and clients (real estate agents) who book shoots and view their media. This policy covers both.
The iPhone and Android apps ask for these only when you use the feature that needs them, and each one can be refused without losing access to the rest of the app:
The apps do not request or collect your device location. Drive times and routing are calculated on our servers from the property addresses you type in, not from where your phone is. We do not track your movements.
Only to operate the product for you: scheduling shoots, notifying your team, delivering media to clients, sending invoices and receipts, and improving reliability. We do not sell your data or share it for advertising.
When you connect a Google account, ShootOS receives your email address and permission to view and edit events on your calendars. We use this only to check your availability before offering a client a booking time, and to put your shoots on your calendar when you are assigned to one.
ShootOS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this information, we do not use it for advertising, and we do not use it to train generative AI models. Nobody at ShootOS reads your calendar except where you ask us to while helping you, or where the law requires it.
You can disconnect at any time from Settings, which deletes the access we hold. You can also revoke it yourself from your Google Account permissions page.
We use trusted service providers strictly to run ShootOS — cloud hosting and database (Railway, Supabase), email and SMS delivery (Resend, Twilio), payments (Stripe), file handling where a company connects it (Dropbox), photo editing where a company turns it on (AutoHDR), calendar (Google), maps for drive times and the fonts our pages and emails load (Google), AI features (OpenAI), media storage and delivery plus bot screening on public pages (Cloudflare), encrypted offsite backups (Backblaze), push notification delivery and app updates (Expo), product analytics (PostHog), error monitoring (Sentry), video players where a page shows a video (YouTube), and webinar registration on our marketing site (Zoom). Each processes data only to provide its function. We never sell personal information. The current list is at shootos/subprocessors, and we give 30 days' notice before adding or replacing one.
Where your data is processed. Our application hosting, main database and offsite backups are in the United States, so your information is stored and processed outside Canada. For our other providers we don't choose a region, so where they process data is set by the provider and can include other countries. Wherever it is, it can be reachable by courts, law enforcement and national security authorities under that country's law.
Our booking assistant and script writer send the text you provide to an AI provider to generate responses. Don't paste sensitive personal information into these tools.
Our marketing site (tryshootos.com) uses a Google Ads tag and a Meta pixel so we can tell whether our own advertising works. They set cookies and receive page-visit events from the marketing site only — they are never loaded on a company's booking site or client galleries, and nothing from inside the product (your bookings, clients, or media) is shared with them. When you create an account, open the demo, register for a webinar or start a trial on the marketing site, we also report that one event to Meta from our server with a hashed (SHA-256) copy of the email you used, your IP address and browser type, so the advertising measurement above works when browser cookies are blocked. Nothing else about you or your account is included. The marketing site also keeps one random identifier of its own in your browser's local storage so we can count unique visitors ourselves; it is not linked to your name, email, or account, is never shared with anyone, and clearing site data removes it. The marketing site works fine with cookies and storage blocked. The product itself uses cookies to keep you signed in, and Cloudflare Turnstile may set one while screening public booking pages for bots.
Data is encrypted in transit. Delivered photos and video are kept for 6 months after delivery: the gallery shows the exact date, we email a warning before anything happens, and after that date the shoot’s files are removed from our storage. If a company cancels its subscription, we send reminders around days 60 and 80, remove its media 90 days after cancellation, and delete the remaining account records after one year — with export available the whole time. You can also ask us to delete data at any point, and team accounts can be deactivated at any time.
When we look at your account. Our staff can open your account to help with a support request. Every one of those sessions is recorded — who opened it, why, and when it started and ended — and you can see that history yourself in your settings. We don't browse customer accounts outside a support request.
If something goes wrong. If a breach creates a real risk of significant harm we'll notify the people affected without undue delay, and report it to the Office of the Privacy Commissioner of Canada as required. For business customers, our Data Processing Agreement sets out what we'll tell you and how quickly, so you can meet your own obligations to your clients.
You can access, correct, export, or delete your data. Email ben@schumacher.media and we'll handle it promptly. Clients can request their portal link or removal the same way.
Ben Schumacher is responsible for our compliance with this policy and with applicable privacy law, and is who to contact with a question or a complaint: ben@schumacher.media. If you raise something and aren't satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.
When a real estate media company uses ShootOS to email or text you, that company decides who to contact and is responsible for having your consent. We deliver the message for them and identify them as the sender. If you don't want their messages, use the unsubscribe link or reply STOP — and you can always ask them directly.
ShootOS is a business tool and is not directed to anyone under 18.
We'll update the date above when this policy changes. Continued use means you accept the current version.