FAQThe Darkroom’s Privacy Policy
Effective date: 9/10/2026 Last updated: 9/10/2026
At The Darkroom, we are passionate about film and our community of film enthusiasts and your privacy is important to us.
Introduction
The Darkroom (Swan Photo Labs, Inc., “The Darkroom,” “we,” “us,” or “our”) is a film processing lab located in San Clemente, California. We’ve been developing film since 1976, and we take the trust involved in mailing us your photographs seriously. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights and choices you have.
This policy applies to thedarkroom.com, our mail-in film processing services, our subscription storage service, and our wholesale services (collectively, the “Services”).
Your use of the Services is also subject to our Terms of Use.
Summary
- We collect the information needed to process your film, deliver your scans and prints, and run our business: your contact details, order and payment information, and the photographs you send us.
- Your photographs are yours. Our staff and technical contractors access them only to process, quality-check, and support your orders. We never use your photos in our marketing, and we do not use facial recognition.
- We use trusted service providers (payment processors, shipping carriers, cloud storage) to operate. We also use advertising and analytics tools on our website, which you can opt out of.
- We supplement customer records with demographic information from third-party data providers to better understand our customer community in aggregate.
- You can request access to, correction of, or deletion of your personal information at any time by emailing [email protected].
Information We Collect
Information you provide to us
Account information. An account is required to place orders. When you register, we collect your name, email address, and password, and optionally your phone number.
Order information. When you place an order, we collect your shipping and billing addresses, order details (film type, services requested), and any special instructions you provide.
Payment information. Payments are processed by Stripe and PayPal. Your card number goes directly to the payment processor and is tokenized; we never store full card numbers on our systems. If you submit a paper order form that includes card information, we use it only to process that order and securely shred the form within 30 days of order completion.
Communications. When you contact customer service, we keep a record of the correspondence in our support system. If you opt in to SMS order updates, we collect your mobile number to send transactional messages about your order (we do not send SMS marketing).
Contests and surveys. If you enter a photo contest or respond to a customer survey, we collect the information you choose to submit.
Wholesale accounts. If you use our wholesale services, we collect business contact information. Wholesale customer data is handled under this same policy.
Your photographs and film
When we process your film, we create digital scans of your images. We also retain technical metadata associated with your image files (such as file characteristics, frame information, and order association). Your photographs may themselves contain personal information — images of people, places, and moments — and we treat them as the most sensitive information we hold. See “Your Photographs” below for a full description of how they are stored, who can access them, and how long we keep them.
Information collected automatically
When you use our website, we and our service providers automatically collect device and usage information: IP address, browser type, operating system, device identifiers, pages viewed, time spent, referring links, and interactions with our site. This is collected through cookies, pixels, and similar technologies. See “Cookies and Tracking Technologies” below.
Information from third-party sources
We obtain limited information about our customers from third-party sources:
- Data providers. We may supplement our customer records with demographic information licensed from third-party data providers — such as approximate age range, household income range, and general interest categories — matched using information like name, email, or postal address. We use this to understand our customer community in aggregate and improve our products and marketing. This information may include inferences drawn from the data described above.
- Public reviews. If you post a public review of The Darkroom on Google, we may display your review text, name, and profile image on our website as a testimonial.
- Social media. If you publicly post about The Darkroom on social media and tag or mention us, the platform may make that content and your public profile information visible to us, and we may reshare your post on our own social media accounts with attribution. If you’d like a reshared post taken down, contact us and we will remove it.
Your Photographs
This section describes our practices for the photographs you trust us with.
Where they’re stored.Your digital scans are stored on servers we operate, located at our California facility and with established cloud infrastructure and storage providers, including encrypted backups at a geographically separate backup facility. All storage is located in the United States.
How long we keep them.
- If you subscribe to our photo storage service, we store your photos for as long as your subscription remains active.
- For all other orders, your photos are stored free of charge for a minimum of 60 days from delivery of your order. After that period, files are permanently deleted during routine server maintenance cycles, typically within 180 days of delivery.
- If you subscribe within 6 months of a past order, we may be able to restore photos from orders placed during that window, where they have not yet been permanently deleted.
- After permanent deletion, we cannot recover your images. Please download your photos promptly.
Who can access them. Access to customer photographs is limited to trained lab staff and the engineering contractors who maintain our systems, and only for the purposes of processing your order, quality control, technical troubleshooting, and customer support. Our cloud storage providers process your files on our behalf as service providers. We do not license, sell, or provide your photographs to anyone else.
Automated processing. Our scanning equipment automatically analyzes each image for color, density, and contrast as part of producing a quality scan, and we run automated checks on our own self-hosted systems to detect technical defects (such as frame-line errors) that may require a rescan. We may develop additional automated defect-detection tools that run locally on our own systems. We do not use facial recognition, and we do not analyze the content of your images to identify people or build profiles.
Marketing. We do not use the photographs you process through our lab in our marketing, advertising, or social media. If we ever wanted to feature your work, we would ask for your express permission first. Separately, if you choose to post your photos publicly on social media and tag us, we may reshare that public post as described under “Information from third-party sources” above.
Photos that include other people. Your photographs will often include images of people other than you. When you send us film or share your delivered photos with others, you are responsible for ensuring you have any necessary permission from the people in your images. We process the content of your film solely to fulfill your order, as described in this section.
Information you provide about others. If you ask us to ship an order to someone else (for example, a gift), we use the recipient’s name and address only to fulfill that delivery and for the other purposes described in this policy.
Physical media. We return your negatives and prints to you by mail. Physical media that is undeliverable or unclaimed is held for at least 30 days and then securely destroyed.
Legal obligations. Like all U.S. image-hosting providers, we are required by federal law (18 U.S.C. § 2258A) to report apparent child sexual abuse material to the National Center for Missing & Exploited Children if we become aware of it.
How We Use Your Information
We use the information we collect to:
- Process, develop, scan, print, and ship your orders, and provide our subscription storage service;
- Create and maintain your account and authenticate you;
- Process payments and prevent fraud;
- Communicate with you about your orders, including transactional email and opt-in SMS updates;
- Provide customer support;
- Send marketing communications about our products, promotions, and film-community content, which you can opt out of at any time;
- Run contests and surveys you choose to participate in;
- Understand our customer community and improve our products, services, website, and marketing, including through aggregated analysis of demographic information;
- Maintain the security of our systems and Services;
- Comply with legal obligations and enforce our Terms.
We do not use your personal information for automated decision-making that produces legal or similarly significant effects about you.
Cookies and Tracking Technologies
We use cookies and similar technologies for:
- Essential functions — keeping you logged in, maintaining your shopping cart, and site security. These cannot be disabled.
- Analytics — we use Google Analytics to understand how visitors use our site so we can improve it.
- Advertising — we use advertising pixels from Google Ads, Meta (Facebook/Instagram), and TikTok to measure our advertising and to show ads for The Darkroom to people who have visited our site. These partners may use the data for their own purposes as described in their privacy policies.
You can manage cookies through your browser settings, including blocking or deleting them (note that blocking essential cookies may prevent parts of our site from working). To opt out of advertising cookies, you can use the industry opt-out tools at the NAI opt-out page and the DAA opt-out page, the Google Analytics opt-out, and the privacy controls offered by Google, Meta, and TikTok in your accounts with those platforms. You may also submit an opt-out request by emailing [email protected]. Our website does not currently respond to “Do Not Track” browser signals, for which no industry standard exists.
How We Share Information
We do not sell your personal information for money, and we never sell or share your photographs. We share personal information only as follows:
Service providers that process data on our behalf under contract:
| Purpose | Categories of providers |
| Payment processing | Payment processors |
| Shipping and fulfillment | Order fulfillment software providers and postal/parcel carriers |
| Hosting and cloud storage | Cloud hosting, storage, and backup providers |
| Email delivery | Email delivery providers (marketing and transactional) |
| SMS order updates | SMS delivery providers |
| Analytics | Google (Google Analytics) |
| Customer data enrichment | Third-party consumer data providers |
Advertising partners. As described above, our use of advertising pixels means that Google, Meta, and TikTok receive information about your visits to our site. Under California law, this is considered “sharing” personal information for cross-context behavioral advertising, and you have the right to opt out.
Technical contractors. Engineering contractors who maintain our systems, located in the United States and abroad, may access customer data, including photographs, solely to perform their work for us, under confidentiality obligations and the transfer safeguards described in this policy.
Legal and safety. We may disclose information to comply with law, subpoenas, or court orders; to protect the rights, safety, and property of our customers, the public, or The Darkroom; or to investigate fraud or violations of our Terms.
Business transfers. If The Darkroom is involved in a merger, acquisition, or sale of assets, customer information may be transferred as part of that transaction, subject to this policy’s commitments.
Data Retention
- Photographs: as described in “Your Photographs” above.
- Account and order records: retained while your account is active and thereafter as needed for tax, accounting, warranty, and legal purposes.
- Support correspondence: retained to maintain service history and quality.
- Paper order forms containing payment information: shredded within 30 days of order completion.
- Marketing data: until you opt out or ask us to delete it.
When personal information is no longer needed, we delete or de-identify it.
Your Rights and Choices
Everyone. Regardless of where you live, you may email [email protected] to request access to, correction of, or deletion of your personal information, and you can opt out of marketing email via the unsubscribe link in any message or SMS updates by replying STOP. We may need to verify your identity (typically via your account email) before fulfilling requests. Note that deleting your data may make it impossible for us to complete open orders or restore photos.
California and other US state residents
Under the California Consumer Privacy Act (CCPA/CPRA), you have the right to:
- Know the categories and specific pieces of personal information we collect, the sources, our purposes, and the categories of third parties we disclose it to;
- Delete personal information we collected from you, subject to legal exceptions;
- Correct inaccurate personal information;
- Opt out of the “sharing” of your personal information for cross-context behavioral advertising, by emailing [email protected] or using the opt-out tools described in “Cookies and Tracking Technologies” above;
- Limit the use of sensitive personal information. We use any sensitive personal information (such as the content of your photographs) solely to provide the services you request, and we do not use it to infer characteristics about you. Because we make no other use of it, there is no additional use to limit and a separate “Limit the Use of My Sensitive Personal Information” link is not required;
- Non-discrimination for exercising any of these rights.
Residents of other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Texas, and Oregon) may have similar rights of access, correction, deletion, and opt-out of targeted advertising under their state’s law, and may exercise them the same way. If we decline a request, you may appeal our decision by replying to our response or emailing [email protected] with the subject “Appeal,” and we will respond within the timeframe your state’s law requires.
To exercise these rights, email [email protected] or write to us at the address below. You may use an authorized agent with written permission.
Categories of personal information (as defined by the CCPA) we collect: identifiers (name, email, address, phone, IP address); commercial information (orders and purchases); internet activity (site usage); audio/visual information (your photographs); professional or demographic information obtained from data providers; and inferences (customer segments and preferences). We collect them from you, automatically, and from the third-party sources described above; we use and disclose them for the purposes described in this policy. We do not sell personal information for money; we share identifiers and internet activity with advertising partners as described. We do not knowingly sell or share the personal information of consumers under 16.
Residents of the EEA, United Kingdom, and Switzerland
Where the GDPR or UK GDPR applies, The Darkroom is the data controller. Our legal bases for processing are: performance of a contract (processing your film, delivering your order, providing storage); legitimate interests (service improvement, security, fraud prevention, first-party marketing to customers); consent (non-essential cookies, optional communications), which you may withdraw at any time; and legal obligation.
You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your local supervisory authority.
International transfers: we are located in the United States and process data there. Where we transfer personal data from the EEA/UK/Switzerland to the United States or other countries (including access by technical contractors located in other countries), we rely on appropriate safeguards such as Standard Contractual Clauses.
Canadian residents
We handle personal information in accordance with PIPEDA. You may access or correct your information, or withdraw consent to optional uses, by contacting us; note that our servers and service providers are located in the United States and your information will be processed there.
Security
We protect your information with TLS encryption in transit, access controls that restrict most staff data access to our facility’s network, role-limited access to customer photographs, encrypted backups, and physical, electronic, and procedural safeguards. No system is perfectly secure, but we work to protect the confidentiality of your information and your images.
Children
Our Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it. If you believe a child has provided us personal information, contact us at [email protected].
Changes to This Policy
We may update this policy from time to time. We will post the updated version with a new “Last updated” date, and for material changes we will provide notice on our website or by email. We review this policy at least annually.
Contact Us
The Darkroom (Swan Photo Labs, Inc.) 946 Calle Amanecer #A San Clemente, CA 92673