Privacy Policy

Effective August 27, 2026 · Applies to mastline.co and the Mastline application

1. Who Mastline is

Mastline (“Mastline”) is operated by Storyworlding, with its principal place of business at 155 Prince Street, Floor 3, New York, NY 10012. Mastline is the controller of the personal information described in this policy. You can reach Mastline at privacy@mastline.co.

2. What Mastline collects

Information you give Mastline

• Account details: name, email address, password, city or market, and billing information (processed by Mastline’s payment provider; Mastline does not store full card numbers).
• Your work: photographs, video, captions, metadata, shoot records, contacts, submissions, licenses, invoices, and payment records you add to Mastline.
• Contacts and buyers: names, outlets, email addresses, and notes about the editors and buyers you work with.
• Messages: support requests and anything you send Mastline directly.

Information collected automatically

• Usage data: pages and features used, actions taken, timestamps, and performance data, so Mastline can keep Mastline fast and fix what breaks.
• Device and connection data: IP address, browser and device type, operating system, and approximate location derived from IP address.
• Cookies and analytics: Mastline uses three analytics services, two of which are optional and can be turned off. Google Analytics, loaded through Google Tag Manager, is used to understand how the site is used. Microsoft Clarity, provided by Microsoft, records how pages are used — pointer movement, scrolling, and clicks — to show where the site is confusing; it sets the cookies _clck and _clsk, and Microsoft may set cookies of its own once it runs. In the EEA, the UK, and Switzerland, neither is loaded, nothing is stored on your device, and no analytics identifiers are collected unless you accept. Everywhere else both run by default. Either way you can change the choice at any time from “Cookie choices” in the footer, and refusing stops both wherever you are. Vercel Analytics, provided by Mastline’s hosting provider, counts page views and records basic browser, device, and country information; it sets no cookie, stores nothing on your device, and does not follow you across other sites, so it is not part of the choice described above. A short-lived cookie recording your country is set to decide whether to ask you; it holds nothing else.
• Pitch and license activity: when a buyer opens a pitch link, accepts a license, or downloads files. This is core to the product and is shown to you.
• Delivery link activity:when a photographer shares a delivery link with a picture desk, Mastline records for that photographer’s delivery record that the link was opened, when it was first and most recently opened, whether the terms were accepted and by what name, and which files were downloaded — each with the time and the address the request came from. Those are commercial records of what happened to somebody’s work and are kept whatever choice a visitor makes about the optional measurement below.
• Delivery viewing time (optional): on a delivery page, and only where the choice described above allows it, Mastline also measures roughly how long the page was on screen and which photographs were visible, so the photographer can see which frames drew attention. This is first-party measurement: no advertising tag, no third-party tracker, and no session recording. Time is counted only while the page is visible, focused, and in use — a background tab counts for nothing. The visitor is identified by a random value the browser generates for that one link, scoped so the same browser opening two links cannot be recognised as the same visitor; Mastline does not fingerprint the browser and does not use the IP address as an identifier. Mouse movement, keystrokes, and browsing elsewhere are not collected. Detailed session records are kept for a limited period and then removed, leaving only aggregate totals against the link.
• What a delivery link never carries:a recipient’s name, email address, phone number, or internal contact reference is stored in Mastline’s database and is deliberately kept out of the link address, because a web address ends up in browser history, in referrer headers, and in server logs along the way.

Information from third parties

If you connect storage, accounting, or other services, Mastline receives the data you authorize those services to share. If you use Rights Matches, Mastline receives results from image-matching providers about where your images may appear online.

3. How Mastline uses it

• To run Mastline: store your work, send your pitches, issue licenses, track payments, and keep your records.
• To make suggestions inside your own workspace, such as captions, buyer fit, pricing bands, and archive matches, based on your own history.
• To secure the service, prevent fraud and abuse, and keep an audit trail of consequential actions.
• To bill you and communicate about your account, including service and security notices.
• To improve the product, using aggregated and de-identified usage patterns.
• To comply with law and enforce Mastline’s Terms.

4. What Mastline will not do

• Mastline does not sell your personal information, your images, your contacts, or your sales history.
• Mastline does not use your photographs to train artificial-intelligence models for anyone else, and Mastline does not license them to third parties.
• Mastline does not share one photographer’s buyer relationships, prices, or deal history with another photographer in identifiable form.
• Mastline does not show advertising in the product, does not sell access to you as an audience, and does not use your pictures, your contacts, or your sales history to target advertising anywhere.

One exception, stated plainly. Microsoft Clarity, the optional session-recording service described above, causes Microsoft to set third-party cookies of its own whenever it runs. Microsoft’s own documentation describes MUID, which identifies unique browsers across Microsoft sites, as used “for advertising, site analytics, and other operational purposes”, and CLID, which identifies the first time Clarity saw your browser on any site running Clarity. Mastline neither receives nor uses that data, and Mastline is not in a position to promise what Microsoft does with it; Microsoft’s privacy statement governs that. Turning off Analytics stops Clarity and those cookies with it, and in the EEA, the UK, and Switzerland Clarity never runs unless you accept.

5. When Mastline shares information

• With buyers, at your direction: when you send a pitch, license an image, or deliver files, the recipient receives what you chose to send, under the terms you set.
• With service providers who help Mastline run Mastline, such as cloud hosting, payment processing, email delivery, and image matching. They may use your data only to provide services to Mastline. Microsoft Clarity is the one exception, set out in section 4: Microsoft also acts for its own purposes, which is why Clarity is optional and can be switched off.
• Within your team, according to the roles and permissions you configure.
• For legal reasons, if required by law, subpoena, or court order, or to protect the rights, safety, or property of Mastline, Mastline’s users, or others. Where lawful, Mastline will tell you first.
• In a business transfer, such as a merger or acquisition, under the same protections described here.

6. Confidential sources and sensitive content

Mastline knows that tips, locations, and identities can be sensitive. Source and location fields you mark confidential are visible only to the roles you allow, are excluded from any aggregated analysis, and are covered by access logs you can review. Mastline will resist disclosure of confidential source information to the fullest extent the law allows and will notify you of any request unless legally prohibited.

7. Your rights and choices

Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal information, and to object to certain processing. Regardless of where you live, every Mastline account can export its complete data at any time from Settings, and you can delete your account and its contents. To exercise any other right, email privacy@mastline.co. Mastline will respond within the time required by applicable law.

Residents of California, the European Economic Area, the United Kingdom, and other jurisdictions with specific privacy laws have additional rights including the right to lodge a complaint with a supervisory authority.

8. Retention

Mastline keeps your work and records for as long as your account is active, because the commercial history of an image is the product. After you close your account, Mastline deletes or de-identifies your data within 30 days, except where it must keep the data to meet legal, tax, or dispute-resolution obligations, or where you have asked it to retain license and provenance records as evidence.

9. Security

Mastline encrypts data in transit and at rest, restrict access to production systems, log access to sensitive records, and tests its defenses regularly. The Security page describes those practices in more detail. No system is perfectly secure; if Mastline learns of a breach affecting your information, it will notify you as required by law.

10. International transfers

Mastline is operated from the United States. If you use it from elsewhere, your information will be transferred to and processed in the United States and in the countries where Mastline’s service providers operate, under appropriate safeguards such as standard contractual clauses.

11. Children

Mastline is a professional tool and is not directed to anyone under 18. Mastline does not knowingly collect personal information from children.

12. Changes

When Mastline changes this policy, Mastline will update the effective date above and, for material changes, notify you by email or inside the product before they take effect.

13. Contact

Storyworlding · 155 Prince Street, Floor 3, New York, NY 10012 · privacy@mastline.co