Privacy Policy

Vellum & Vestige

Effective date: 06/01/2026

Last updated: 07/30/2026

1. Who we are

Vellum & Vestige ("we", "us", "the atelier") is a heritage preservation studio that creates bespoke archival photograph albums. We are operated by Vellum & Vestige, LLC, a Utah limited liability company, with a registered address at 2860 S 2540 E, Salt Lake City, UT 84106.

For the purposes of the UK and EU General Data Protection Regulation, Vellum & Vestige is the data controller of the personal information described in this policy.

If you have questions about this policy or about how we handle your information, contact us at curator@vellumandvestige.com.

This policy covers our website, our patron intake form, our patron portal - through which you submit your photographs and memories and later review your proofs - and the correspondence we exchange with you while producing your album.

2. The information we collect

Information you provide when you inquire or commission an album

  • Your name

  • Your email address

  • Your telephone number

  • The volume of your narrative you wish to commission

The material you entrust to us for your album

  • Photographs you upload (up to 70 images per volume)

  • The written memories, narratives and briefings you submit to accompany them — including the "overarching truth" of the period you are preserving and the notes attached to individual photographs

We refer to this collectively as your archival material. It is the most sensitive information we hold, and we treat it accordingly. It may include images of, and references to, other people — including family members and children.

Information created while we produce your album

  • The refined narrative text ("whispers") generated from the memories you submit

  • Your album's layout, proofs and production files

  • Comments, annotations and approvals you leave in the patron portal

  • A unique access token issued to you for the portal

Information collected automatically when you visit our website

  • Standard website analytics provided by our website host (pages viewed, approximate location, referring site, device and browser type), collected through cookies

  • Technical information such as IP address and access times, retained in server logs

Information you provide if you join our mailing list

  • Your email address and your subscription preferences

We do not collect payment card details through our website. Where payment is taken, it is handled by our payment provider, and we never see or store your full card number.

3. How we use your information, and our legal basis for doing so

To respond to your inquiry and discuss a commission. So that we can answer you and prepare a proposal. Legal basis: steps taken at your request before entering into a contract.

To produce your album. To design your spreads, refine your narratives and prepare print files — the service you commissioned. Legal basis: performance of our contract with you.

To send you proofs and obtain your approval. So that you can review your album and sign off before it is printed. Legal basis: performance of our contract with you.

To send you production updates by email and SMS. To keep you informed about the progress of your commission. Legal basis: performance of our contract with you.

To transmit final files to our printing partner. So that your album can be manufactured and bound. Legal basis: performance of our contract with you.

To understand how our website is used. To maintain and improve the site. Legal basis: your consent, where cookies require it, or our legitimate interest in operating our website.

To send marketing emails, if you have subscribed. To share news about the atelier. Legal basis: your consent, which you may withdraw at any time.

To keep records of transactions and correspondence. To meet our tax, accounting and legal obligations. Legal basis: compliance with a legal obligation.

We do not sell your personal information. We do not share it with advertisers. We do not use your photographs or your memories in marketing, on our website, or in any portfolio without asking you first and obtaining your explicit, separate permission.

4. Automated processing and artificial intelligence

We want to be plain about this, because it concerns the most personal material you give us.

The written memories you submit are processed using a third-party artificial intelligence service (Google Cloud Vertex AI) to help transform them into the refined narrative passages that appear in your album. Your text is transmitted to that service, processed, and returned to us.

  • This is an editorial aid. A human being — your curator — reviews, edits and approves every passage before it appears in your album. Nothing is placed in your album on the say-so of a machine alone.

  • Your photographs are not submitted to any AI image-generation or image-analysis service.

  • Under Google Cloud's terms for this service, material submitted is not used to train their models. We do not permit any of our service providers to use your material to train artificial intelligence systems.

  • No decision producing a legal or similarly significant effect about you is made by automated means.

If you would prefer that we prepare your narrative passages without the use of any automated assistance, tell us and we will do so manually.

5. Who we share your information with

We do not sell your data. We share it only with the service providers necessary to produce and deliver your album, and only to the extent each one needs. Our providers act on our instructions under contract.

  • Squarespace — our website hosting, site analytics and mailing list.

  • Make.com — automated routing of submissions between our systems.

  • Google Workspace and Google Cloud (Drive, Cloud Storage, Sheets, Gmail) — storage of your archival material and production records, and our correspondence with you.

  • Google Cloud Vertex AI — the narrative processing described in Section 4.

  • Twilio — SMS production notifications.

  • Render — hosting of the patron proofing portal, which is the secure application through which you upload your photographs, write the descriptions and memories that accompany them, review your proofs and give you approval. Your archival material is held there while your commissioning is in progress.

  • RedTree Album Manufacturing — printing and binding of your finished album. Your final print files are transmitted to them for manufacture.

We may also disclose information where we are legally required to do so, or to establish or defend legal claims.

International transfers. We are based in the United States, and our service providers are located principally in the United States. If you are in the United Kingdom or the European Economic Area, your information will be transferred outside your country. Where that occurs, transfers are made under appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable). You may request details of these safeguards using the contact address above.

6. How long we keep your information

Your archival material — your photographs and the memories you submit — is retained for a maximum of 60 days from the date of submission, after which it is deleted from our systems.

This is deliberate. We hold irreplaceable family material for no longer than is necessary to produce your album.

Two things follow from this, and we ask you to note them carefully:

  • Please retain your own copies. We are not an archive of last resort. Do not send us your only copy of a photograph. After 60 days we cannot return material to you, because we will no longer hold it.

  • Reprints after 60 days will require you to resubmit your material. If you anticipate wanting a reprint or a second volume, tell us and we can agree in writing to retain your material for longer.

Other information is retained on different schedules:

  • Contact details and correspondence: for the duration of our relationship and for a reasonable period afterwards

  • Transaction and tax records: for as long as required by law, typically seven years

  • Mailing list subscription: until you unsubscribe

  • Website analytics: in accordance with our website host's retention settings

Deleted material is removed from our active systems. Copies may persist briefly in routine backups before being overwritten in the ordinary course.

7. How we protect your information

We maintain reasonable administrative and technical safeguards appropriate to the sensitivity of the material we hold, including access-controlled cloud storage, individually issued portal access tokens, encrypted connections for transmission, and limiting access to those who need it to produce your album.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you and any relevant regulator where the law requires it.

8. Your rights

If you are in the United Kingdom or the European Economic Area, you have the right to: access your personal data; correct inaccurate data; request erasure; restrict or object to processing; data portability; and withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk).

If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it; to request deletion; to request correction; and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising, and we have not done so in the preceding twelve months.

Wherever you live, you may ask us to delete your archival material at any time, and we will do so promptly — you do not need to wait for the 60-day period to elapse.

To exercise any right, write to curator@vellumandvestige.com. We may need to verify your identity before acting, particularly for requests concerning archival material. We respond within the timeframes the law requires (generally one month under UK/EU law, 45 days under California law).

9. Cookies and site analytics

Our website uses cookies — small files placed on your device.

  • Strictly necessary cookies allow the site to function, keep it secure, and remember your cookie preferences. These cannot be switched off.

  • Analytics cookies, provided by our website host, tell us how visitors use the site in aggregate — which pages are read, how visitors arrive. We use this to improve the site. We do not use advertising or cross-site tracking cookies.

Where required by law, we ask for your consent before setting non-essential cookies, using the banner shown when you first visit. You can change your choice at any time through that banner, and you can block or delete cookies through your browser settings — though parts of the site may not work correctly if you do.

The patron portal uses a token to keep you signed in to your own album. This is strictly necessary to operate the portal.

10. Children

Our services are offered to adults. We do not knowingly collect personal information directly from children under 16.

Family archives, by their nature, frequently contain photographs of children. When you submit such material you confirm that you have the authority to do so and the consent of any parent or guardian whose permission is required. We handle that material under the same terms as all archival material, and delete it on the same 60-day schedule.

11. Other people who appear in your material

The photographs and memories you send us will usually contain personal information about other people. You are responsible for ensuring you have the right to share it with us. We process it solely to produce your album, we do not use it for any other purpose, and we delete it on the schedule set out above. If someone whose image appears in material we hold contacts us with a request, we will consult you before responding wherever we are permitted to do so.

12. Changes to this policy

We may update this policy from time to time. The current version is always posted here with its effective date. If we make a material change to how we handle your archival material, we will tell existing patrons directly.

13. Contact us

Vellum & Vestige, LLC

2860 S 2540 E

Salt Lake City, UT 84109

curator@vellumandvestige.com