Privacy Policy

This Privacy Policy explains how The Synergy Experience LLC, operator of Still Mill™ (“Still Mill,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects personal information when people use the Service. It applies to visitors, account holders, contributors, identifiers, institutional contacts, and people who communicate with us. It does not apply to third-party websites or services we do not control.

We may collect:

• account and contact information, such as name, email address, display name, role, organization, authentication information, and communication preferences;
• submitted content, such as photographs, scans, captions, names, dates, locations, relationships, collection details, source citations, evidence, research notes, proposed identities, comments, messages, and reports;
• role and verification information, such as invitations, approvals, training or qualification records, permissions, moderation history, and account status;
• institution inquiry information, such as contact name, institution, work email, organization type, collection size, services of interest, and message;
• transaction information after paid services begin, such as plan, billing status, renewal dates, refunds, and limited payment-related records. Payment processors, rather than Still Mill, are expected to process complete card or bank-account details;
• technical and usage information, such as IP address, browser and device information, approximate location derived from IP address, pages viewed, search terms, referring pages, timestamps, errors, security events, and cookie or similar-technology data; and
• communications and support information, including correspondence, requests, complaints, copyright notices, and customer-support history.

We collect information directly from you; automatically from your browser or device; from other members who collaborate on photographs and research; from institutions or account administrators; from service providers; and from public or licensed historical sources used in research. A person named or depicted in submitted content may not be the person who submitted it.

We may use information to:

• provide, maintain, authenticate, secure, troubleshoot, and improve the Service;
• display public photographs, metadata, collections, proposed identities, evidence, comments, and research histories according to applicable visibility settings;
• support collaboration, messaging, moderation, role administration, case management, and verification workflows;
• respond to inquiries, rights requests, copyright notices, reports, complaints, and support needs;
• process subscriptions and transactions after paid services are launched;
• protect users, rights holders, the public, and the Service; enforce policies; prevent fraud and misuse; and comply with law; and
• analyze aggregate usage and develop new features. We will not use submitted historical photographs to train facial-recognition or biometric-identification models without separate notice, an appropriate legal basis, and any required consent.

Public photographs, public collections, contributor display names, case numbers, status labels, public comments, public research activity, evidence descriptions, and proposed identities may be visible to anyone. Public information may be indexed by search engines, copied, downloaded, quoted, archived, or shared by other people outside our control.

Private messages are intended for their participants, but authorized administrators and service providers may access them when reasonably necessary for support, safety, moderation, security, legal compliance, or investigation of reported misuse. Do not submit sensitive personal information unless it is necessary and you are authorized to do so.

We may disclose information:

• to the public or other members according to the feature and selected visibility settings;
• to vendors and service providers that help with hosting, databases, authentication, storage, security, analytics, communications, customer support, and future payment processing;
• to an institution or account administrator responsible for an organizational workspace;
• when required by law, legal process, or a valid governmental request;
• to protect rights, safety, security, research integrity, users, rights holders, or the Service;
• in connection with a merger, financing, reorganization, bankruptcy, sale, or transfer of some or all of the business; or
• with your direction or consent.

We do not sell personal information for money. We do not currently use personal information for cross-context behavioral advertising or targeted advertising. If our practices materially change, we will update this Policy and provide any legally required choices.

Still Mill and its providers may use essential cookies and similar technologies for authentication, session continuity, preferences, security, performance, and basic analytics. Browser settings may allow you to block or delete cookies, but essential features may not work correctly without them. Any nonessential advertising or analytics technology introduced later will be addressed through updated disclosures and consent controls when required.

We retain information for as long as reasonably necessary to operate the Service, maintain research history and provenance, fulfill the purposes described in this Policy, resolve disputes, enforce agreements, protect the archive, and meet legal, accounting, and security obligations. Retention depends on the type of information, its sensitivity, the visibility and collaborative history of the content, legal requirements, and whether deletion would damage the integrity of an identification record.

We may retain de-identified, aggregated, backup, fraud-prevention, moderation, transaction, and legal-compliance records after account closure. Removal of a photograph does not necessarily require deletion of every citation, case number, audit record, or de-identified research event associated with it.

We use administrative, technical, and organizational measures designed to protect information. No transmission, storage, or security system is guaranteed to be completely secure, and we cannot promise that unauthorized access, loss, or misuse will never occur. Notify us promptly at sce@thesynergyexperience.co if you believe an account or information has been compromised.

Depending on where you live and whether a privacy law applies to Still Mill, you may have rights to confirm processing; access, correct, delete, or obtain a copy of personal information; opt out of certain sale, targeted advertising, or profiling activities; withdraw consent where processing relies on consent; or appeal our response.

To make a request, email sce@thesynergyexperience.co with “Privacy Request” in the subject line and describe the request. We may verify your identity and authority before acting. An authorized agent may submit a request where applicable law permits. We will not unlawfully discriminate against you for exercising a privacy right. Some information may be exempt, and some collaborative, archival, legal, security, or research-integrity records may be retained as allowed by law.

Photographs and research may contain information about people other than the contributor, including living people. Contributors must consider privacy, publicity, sensitivity, family impact, and legal rights before publishing a photograph or claim. If you are depicted or identified in the Service and wish to raise a concern, email sce@thesynergyexperience.co with the photograph or case URL and an explanation. We will review the request; removal or correction is not automatic when competing legal, historical, evidentiary, or public-interest considerations apply.

The Service is not directed to children under 13, and we do not knowingly allow them to create accounts. Historical photographs may depict children, but that does not mean the Service is directed to children. If you believe a child under 13 submitted personal information through an account, contact us so we can investigate and take appropriate action.

Still Mill is operated from the United States. Information may be processed in the United States and other locations where our service providers operate. If international services are offered later, we will add legally required international-transfer disclosures and mechanisms before targeting those markets.

We may update this Privacy Policy to reflect changes in the Service, law, or our practices. We will post the revised Policy with a new effective date and provide additional notice or obtain consent when required.

Privacy appeals should use the same address with “Privacy Appeal” in the subject line. Include the original request and the reason you believe the response should be reconsidered.