# Privacy & GDPR (/docs/privacy)

media runs for you as a processor: the files belong to your Organization, and you decide who may open them.

## Who sees what [#who-sees-what]

| Who                                         | What they can do                                                                                     |
| ------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| A member with any role in the Space         | See its library, open originals, read files through the agent API or MCP                             |
| Admins, developers and editors of the Space | Also upload, change details, replace, delete, make private, share, and edit upload rules and imports |
| A member kept to other Spaces               | Nothing of this Space                                                                                |
| Someone with a share's link and password    | That share's files, while its window is open                                                         |
| Anyone with a file's Content URL            | The optimized version Content serves, unless the file is private                                     |

## Originals are protected [#originals-are-protected]

An original keeps everything the camera or the editing software put in it: the location a photo was taken, the camera, the author. So [raw files](/docs/files/raw-files) are protected by default: only members of the Space, links signed for 15 minutes, and [shares](/docs/library/shares) open them, and nothing on files.obelism.studio is cached publicly.

What sites show comes from Content's optimized URLs, which strip the metadata. Those are public for files that aren't private; a [private file](/docs/library/details#private-files) is only served with a signed link that lasts a day.

## What media stores [#what-media-stores]

- **The files** as uploaded, and their details: name, type, size, dimensions, title and alt text per language, focal point, tags, folder and Shopify products.
- **Who uploaded a file**, as a user id.
- **Shares**: the files or folder, the window, who created it, and the password as a PBKDF2 hash, never the password itself. Each opening is recorded with its time and the visitor's country, not their IP address.
- **Imports**: each row of a CSV and its outcome, for the report.
- **MCP connections**: OAuth grants and hashed tokens for agents connected at `/mcp`, in Cloudflare KV.
- **Rate limit counters**: agent API calls per user, and wrong share passwords per share and per IP address, per minute.

## Product suggestions [#product-suggestions]

With a Shopify store connected, images are sent to Cloudflare Workers AI to [suggest products](/docs/shopify#suggestions), and the store's products are described and indexed in Cloudflare Vectorize. Suggestions don't leave Cloudflare. A file only goes to Shopify when someone [adds it to a product](/docs/shopify#in-the-shopify-admin).

## Retention [#retention]

Files stay until someone deletes them. Deleting a file deletes its stored bytes; deleting a Space deletes all its files. Files imported into a Shopify store are the merchant's, and stay in Shopify.

## Sub-processors & data residency [#sub-processors--data-residency]

| Service                   | Used for                                                                 | Where                                                            |
| ------------------------- | ------------------------------------------------------------------------ | ---------------------------------------------------------------- |
| **Cloudflare Workers**    | Runs the library, its API and files.obelism.studio; request logs         | Cloudflare's global network, at the location nearest the request |
| **Cloudflare R2**         | The files                                                                | Cloudflare                                                       |
| **Cloudflare KV**         | The session cache, upload and share sessions, MCP OAuth grants           | Cloudflare's global network                                      |
| **Cloudflare Queues**     | CSV import rows and product suggestions waiting to run                   | Cloudflare's global network                                      |
| **Cloudflare Workers AI** | Product suggestions, and answers in these docs' Ask                      | Cloudflare's global network                                      |
| **Cloudflare Vectorize**  | The index of a connected store's products, for suggestions               | Cloudflare's global network                                      |
| **PlanetScale**           | The PostgreSQL database: the files' details, folders, shares and imports | **Frankfurt, Germany (AWS `eu-central-1`)**                      |

media shares its database with Content, Improve, numbers and www.obelism.studio, and its file storage with Content. For a signed DPA, contact us at [hello@obelism.studio](mailto:hello@obelism.studio).