Your data, plainly
Last updated: July 2026. This policy covers lightmeetslegacy.com, operated by Wayne Anderson Photography ("we"). Questions or requests: [email protected].
What we collect
- Account: your email address, sign-in sessions, and storyboard credit balance.
- Content you create: photos you upload and the AI-generated titles, captions, and closing lines attached to them.
- Payments: which credit pack you bought, when, and for how much. Card details go directly to Stripe — we never see or store them.
- Abuse prevention: short-lived, hashed request counters (including a hashed form of your IP address) used only for rate limiting.
We do not run advertising, analytics trackers, or sell data. Full stop.
Why we process it (legal bases)
- Running your account and generating storyboards you request — performance of a contract.
- Payment records — legal obligation (accounting and tax law).
- Rate limiting and abuse prevention — legitimate interest in keeping the service available.
- Showing your storyboard on the public wall — your explicit choice: nothing is published unless you tick "share", and a human reviews it first. You can unshare at any time.
Where it lives (processors)
- Cloudflare — hosting, storage, and AI processing of your photos and text.
- Stripe — payment processing (PCI-DSS certified).
- Resend — delivery of sign-in code emails.
Cookies
One cookie: wa_session, which keeps you signed in. It is strictly necessary, HttpOnly, and expires after 30 days or when you sign out. There are no tracking or advertising cookies, so there is no cookie banner.
Retention
- Your photos and storyboards: until you delete them or your account.
- Sessions: 30 days.
- Sign-in codes: 10 minutes.
- Rate-limit counters: about 24 hours.
- Payment records: retained as required by accounting law, anonymized if you delete your account.
Your rights
Access, portability, correction, and erasure are all self-service on your account page: export everything as JSON, delete individual storyboards, or delete your entire account (photos and storyboards are erased immediately). You can also email [email protected] to exercise any right under GDPR/UK-GDPR/CCPA, and you have the right to lodge a complaint with your local supervisory authority.
Children
The service is not directed at children under 16, and we do not knowingly hold their data.
Changes
If this policy changes materially, we will note it here with a new "last updated" date.