Straight answers on galleries, consent, and who gets paid.

After picture day, portraits are bound to the roster and published to permission-gated galleries. A family opens a gallery and sees only their own child’s photos — a tenant-isolated view, never a school-wide or vendor-wide pool. The gallery is the proof: parents review the shots, and the studio can gate, re-crop, or hold a frame before anything is offered. Galleries shipped Ordering storefront in early access

A guardian proves their student with a claim code or a match against the school’s roster — the same record the gradebook trusts — and that resolves which portraits are theirs. Access is scoped to that student: a parent never sees another family’s child, and a studio rep or sales account reads zero student rows. Reps see order totals, adult contacts, and reconciliation; never a child’s record. It is a permission the school already trusts, checked in code — not a link anyone with the URL can open. Roster-scoped access shipped

“Find my child” is a roster lookup, not a face match. A family finds their student by name, grade, and homeroom — a database query the school already trusts — so for the core flow no face-recognition template is ever computed. There is no faceprint to leak, subpoena, or sell, because it does not exist. Photos and any face data run on our own private system and are never sent to an outside AI or photo company, an ad network, or an enrichment vendor. Facial recognition is off unless a parent turns it on. Shipped

Honestly: the normal picture-day workflow takes portraits off-site to the studio or lab to cull and edit before they are uploaded, so we do not claim a photo never moves. What we do guarantee is where it never goes: the editing and storage run on our own private system, and a portrait is never sent to an outside AI or photo company, a model-training pool, or a data broker. The school — not a photo vendor — stays the controller of its students’ images. Shipped

Consent is a constraint in the data model, not a checkbox in a sales flow. A portrait is offered only when a valid consent record permits it; if consent is missing, the system blocks the photo by default. A non-consented sale is impossible by construction, not merely against policy — and a do-not-publish or opt-out student is suppressed end to end. Consent gate shipped Parent storefront in early access

Selling a likeness is a commercial use, which a school’s educational COPPA attestation does not cover — so a portrait of an under-13 or unknown-birthdate student is unsellable until verifiable parental consent, captured naturally when the guardian claims their student. Every gate blocks by default: no consent on file, no sale, enforced in code. This is not legal advice; your counsel sets policy and we describe how the system is built to support it. The binding terms and the data-controller relationship live in the in-app policy your administrator agrees to, and the Data Processing Addendum is an engineering-grounded draft in counsel review.

This is not legal advice. Because the core flow computes no face-recognition template, there is no biometric identifier generated for a student in the first place. If a parent opts in to face-assisted cropping, it is permission-checked and returns only boxes and key points — not a face signature — and any enrolled template is kept on our own private system and destroyed when consent is withdrawn or at the end of the retention schedule, a year by default. How biometric data is handled and consented to under BIPA and similar laws is configured for your deployment and your counsel’s requirements; we describe the architecture and let your counsel set policy.

The images a studio or photographer shoots are theirs; a school’s student images stay under the school’s control as the data controller. The exact ownership and license terms are set in the agreement for your program — a line the self-managed model keeps clearer, because the files sit on infrastructure you control rather than locked inside a vendor’s account. We do not claim rights to your work, and we do not resell it.

Your roster and your content are yours to take, and there is no contract, no minimum order, and no forced overprint to strand you — print-on-demand means no leftover inventory to move if you ever walk. We were built against exactly the lock-in the incumbent model runs on, so we are not going to reintroduce it on the way out. No-contract, no-minimum shipped

Every portrait order settles on the net amount and splits four ways — studio, photographer, school, and platform — with each share locked in when the payout is created, on an exact-penny, add-only ledger. The school takes a real, named leg where the incumbent model gives it nothing. Honest on the money: the ledger routes the school’s leg and the order flips paid, but the school-leg payout wiring is the launch-critical fast-follow — we do not claim dollars reach a school’s bank today. The specific percentages are set for your program and are not published here; ask for a quote and we’ll give you the real numbers. Four-way split in early access

Live today: roster-bound portraits, directory pages, ID-card composites, and team photos; consent-gated, roster-scoped galleries; roster-lookup “find my child” with no biometric template; the consent gate that blocks a sale by default; and the single-school FERPA wall plus the sales-rep PII wall. In early access, building now on that foundation: the parent-facing portrait storefront and the four-way split that pays the school — with the school-leg payout wiring the fast-follow behind them. These describe what the platform does today; they are not a regulator’s certification, and the binding policy lives in-app. Pipeline & galleries shipped Storefront & split in early access

Pholio is the school-photography brand from Stanley Studios — its own brand, not a feature of something else. It runs on the same platform underneath as the school records product and the yearbook, on one consented student record, so a portrait flows straight into the directory, the ID cards, and the yearbook without a re-import or a second identity. On its own site Pholio stands alone; where it sits inside the wider school platform it is the photography leg of it. We keep the record single and the relationship honest, and we don’t dress one brand up as the other.

Not yet, and we won’t fabricate them. We’re early; as the first studios and schools go live, real references will appear — until then, the demo is the proof, and we publish no customer counts or logos we can’t stand behind.