Privacy & GDPR
Who can see which files in Obelism media, how originals and shares are protected, what media stores about files and people, and where your files are kept.
media runs for you as a processor: the files belong to your Organization, and you decide who may open them.
Who sees what
| Who | What they can do |
|---|---|
| A member with any role in the Space | See its library, open originals, read files through the agent API or MCP |
| Admins, developers and editors of the Space | Also upload, change details, replace, delete, make private, share, and edit upload rules and imports |
| A member kept to other Spaces | Nothing of this Space |
| Someone with a share's link and password | That share's files, while its window is open |
| Anyone with a file's Content URL | The optimized version Content serves, unless the file is private |
Originals are protected
An original keeps everything the camera or the editing software put in it: the location a photo was taken, the camera, the author. So raw files are protected by default: only members of the Space, links signed for 15 minutes, and shares open them, and nothing on files.obelism.studio is cached publicly.
What sites show comes from Content's optimized URLs, which strip the metadata. Those are public for files that aren't private; a private file is only served with a signed link that lasts a day.
What media stores
- The files as uploaded, and their details: name, type, size, dimensions, title and alt text per language, focal point, tags, folder and Shopify products.
- Who uploaded a file, as a user id.
- Shares: the files or folder, the window, who created it, and the password as a PBKDF2 hash, never the password itself. Each opening is recorded with its time and the visitor's country, not their IP address.
- Imports: each row of a CSV and its outcome, for the report.
- MCP connections: OAuth grants and hashed tokens for agents connected at
/mcp, in Cloudflare KV. - Rate limit counters: agent API calls per user, and wrong share passwords per share and per IP address, per minute.
Product suggestions
With a Shopify store connected, images are sent to Cloudflare Workers AI to suggest products, and the store's products are described and indexed in Cloudflare Vectorize. Suggestions don't leave Cloudflare. A file only goes to Shopify when someone adds it to a product.
Retention
Files stay until someone deletes them. Deleting a file deletes its stored bytes; deleting a Space deletes all its files. Files imported into a Shopify store are the merchant's, and stay in Shopify.
Sub-processors & data residency
| Service | Used for | Where |
|---|---|---|
| Cloudflare Workers | Runs the library, its API and files.obelism.studio; request logs | Cloudflare's global network, at the location nearest the request |
| Cloudflare R2 | The files | Cloudflare |
| Cloudflare KV | The session cache, upload and share sessions, MCP OAuth grants | Cloudflare's global network |
| Cloudflare Queues | CSV import rows and product suggestions waiting to run | Cloudflare's global network |
| Cloudflare Workers AI | Product suggestions, and answers in these docs' Ask | Cloudflare's global network |
| Cloudflare Vectorize | The index of a connected store's products, for suggestions | Cloudflare's global network |
| PlanetScale | The PostgreSQL database: the files' details, folders, shares and imports | Frankfurt, Germany (AWS eu-central-1) |
media shares its database with Content, Improve, numbers and www.obelism.studio, and its file storage with Content. For a signed DPA, contact us at hello@obelism.studio.