Last updated: 27 September 2026
Carve Photography (“Carve,” “we,” “us,” or “our”) operates the Carve Desk mobile application and related services (the “Service”), including our website at https://www.carvephotography.in and public delivery pages.
This Privacy Policy explains how we collect, use, store, share, and protect information when you use Carve Desk or related Carve services.
If you do not agree with this policy, please do not use the Service.
1. Who we are
Carve Photography
403, Alphs Euphoria, Nr. Gota Cross Road,
Sarkhej–Gandhinagar Highway, Gota,
Ahmedabad, Gujarat 382481, India
Email: [email protected]
Phone: +91 85111 98121
Carve Desk is an internal business management platform used by Carve staff to manage doctors (customers), patients, photography orders, invoices, payments, delivery links, reminders, and analytics.
2. Scope
This policy applies to:
- Carve staff who use the Carve Desk mobile app
- Doctors and other recipients who open delivery links or receive emails/reminders from us
- Visitors who interact with our website or contact forms
Doctors do not create Carve Desk staff accounts in the current version; they may receive branded delivery pages and communications related to orders.
3. Information we collect
3.1 Staff account information
When staff accounts are created or used, we may process:
- Name
- Email address
- Login credentials (passwords are stored in hashed form)
- Role (OWNER, ADMIN, STAFF)
- Authentication tokens (access and refresh tokens)
- Device push notification tokens (for Firebase Cloud Messaging)
3.2 Business and order information
To run photography operations, we may process:
- Doctor/customer details (name, contact information, clinic/practice details)
- Patient details needed for orders (e.g., name and other identifiers entered by staff)
- Order, photography type, scheduling, and status information
- Invoice and payment records (amounts, payment method/status, related notes)
- Google Drive or other delivery URLs for completed work
- Delivery tokens used to access public delivery pages
- Reminder and email delivery records
- Activity logs of important business actions
3.3 Technical and usage information
We may automatically collect:
- Device type, OS version, and app version
- IP address and approximate location derived from network data
- Crash logs, performance, and diagnostic data
- Dates/times of access and basic usage events
3.4 Communications
If you contact us (email, phone, website form), we collect the information you provide (name, email, phone, message content) to respond.
We do not intentionally collect payment card numbers inside Carve Desk beyond payment status/records needed for billing operations. Card processing, if any, is handled by the payment channel you use outside this policy’s direct control.
4. How we use information
We use information to:
- Provide, operate, and secure Carve Desk
- Authenticate users and manage roles/permissions
- Create and manage orders, invoices, payments, and deliveries
- Send emails, reminders, and staff push notifications
- Provide public delivery pages via secure tokens
- Generate internal analytics and business reports
- Maintain activity logs for accountability and support
- Improve reliability, fix bugs, and prevent abuse/fraud
- Comply with legal, tax, and regulatory obligations
- Respond to inquiries and support requests
We process personal data based on one or more of: performance of a contract/service, legitimate business interests, compliance with law, and where required, consent.
5. Sensitive / health-related context
Carve provides medical and dental photography services. Order records may include patient identifiers and service details connected to clinical photography work.
We treat this information as confidential business and personal data. Access is limited to authorized Carve staff and systems needed to deliver the Service. We do not sell this information.
If you are a doctor or clinic providing patient information to Carve, you are responsible for ensuring you have a lawful basis and any required notices/consents to share that information with us for photography and delivery services.
6. How we share information
We may share information with:
- Service providers who help us operate the Service, such as:
- Cloud hosting / database providers
- Email providers (e.g., Gmail/Resend or similar)
- Push notification providers (e.g., Firebase)
- Google services when Drive links or related integrations are used
- Doctors/customers and authorized recipients, via delivery pages or communications needed to fulfill an order
- Professional advisors (legal, accounting) when reasonably required
- Authorities when required by law, court order, or to protect rights, safety, and security
We require service providers to use information only to perform services for us and to protect it appropriately.
We do not sell personal information.
7. Public delivery pages
Completed work may be shared through a delivery link containing a unique token (for example, via /delivery/:token). Anyone with the link may be able to view the associated delivery content.
Please treat delivery links as confidential and do not share them more widely than necessary.
8. Data retention
We retain information for as long as needed to:
- Operate the Service and fulfill orders
- Maintain business, billing, and audit records
- Resolve disputes and enforce agreements
- Meet legal and tax retention requirements
When information is no longer required, we delete or anonymize it where reasonably practicable, subject to backups and legal holds.
9. Security
We use reasonable administrative, technical, and organizational measures, which may include:
- Encrypted connections (HTTPS) where supported
- Hashed passwords and token-based authentication
- Role-based access controls
- Server-side logging of important actions
No method of transmission or storage is 100% secure. If you believe your account or a delivery link has been compromised, contact us immediately.
10. Your rights
Depending on applicable law (including India’s Digital Personal Data Protection Act, 2023, where applicable), you may have rights to:
- Request access to your personal data
- Request correction of inaccurate data
- Request deletion or withdrawal of consent (where consent is the basis)
- Request restriction of certain processing
- Lodge a complaint with the relevant data protection authority
To exercise rights, contact [email protected]. We may need to verify your identity before responding.
Staff users should also contact an account owner/admin for account-level changes inside Carve Desk.
11. Children’s privacy
Carve Desk is a business tool for authorized staff and professional customers. It is not directed at children under 18. We do not knowingly collect personal information from children for app accounts. If you believe a child has provided personal data inappropriately, contact us and we will take appropriate steps.
12. International transfers
Our primary operations are in India. If we use service providers in other countries, information may be processed outside India. We take reasonable steps to ensure appropriate safeguards consistent with applicable law.
13. Third-party links and services
The Service may contain links to third-party sites or services (for example, Google Drive). Their privacy practices are governed by their own policies. We are not responsible for third-party practices.
14. Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date will change when we do. Continued use of the Service after an update means you accept the revised policy, to the extent permitted by law. Material changes may also be communicated by email or in-app notice where appropriate.
15. Contact us
For privacy questions, requests, or complaints:
Carve Photography
Email: [email protected]
Address: 403, Alphs Euphoria, Nr. Gota Cross Road, Sarkhej–Gandhinagar Highway, Gota, Ahmedabad, Gujarat 382481, India
Website: https://www.carvephotography.in