Plan the private handoff before uploading
A boudoir photography client gallery needs a clear agreement about recipients, image selection, downloads and retention. Passwords and gallery settings can help control access, but they cannot stop an authorized viewer from photographing a screen or sharing a file they already have.
Begin with the client's preferences, not a standard invitation template. Confirm a suitable contact address and communication channel, whether anyone else may view the images, and whether a notification containing a gallery title or preview could cause unwanted disclosure.
This is a practical delivery checklist, not a guarantee of confidentiality or a legal consent template. If the required level of confidentiality cannot be met by the platform and the client's devices, discuss another agreed review method before uploading sensitive photographs.
Separate delivery permission from public use
Record who will receive the private gallery and who will confirm the final image list. Do not assume a partner, purchaser or person who booked the session should automatically receive access.
Keep private delivery separate from permission for portfolio, advertising, social media, competitions or other public use. If more than one person appears in the photographs, clarify the relevant permissions rather than treating one person's selection as approval on behalf of everyone.
Ask which images, if any, may be used for each agreed purpose. Keep that record outside a changing favorites list. The wording and legal requirements depend on the jurisdiction and circumstances; get qualified advice for your agreement rather than copying a universal release clause.
Keep retouching preferences separate too. Discuss what the client wants changed and what should remain as photographed. An image being selected for retouching does not by itself authorize public use or every possible alteration.
Choose the simplest proof-to-final arrangement
You can separate proof review and final delivery without building a complicated approval system. The important distinction is what the client can see and do at each stage.
- Proof review: upload only the intended previews, explain how to identify chosen files, and configure downloads for that stage.
- Written confirmation: record the agreed file identifiers, requested edits and version of the selection before preparing finals.
- Final delivery: verify the finished files against that record, enable the intended download options and send clear instructions.
A single gallery can be convenient if the platform's actual controls fit the workflow. Separate galleries may make stages clearer but create more links and access settings to manage. Neither approach is automatically more confidential: test what is exposed in each one.
Do not assume that putting files in another collection makes them private from the same viewer. Upload only material appropriate for that audience and stage. Check the platform's real visibility rules before relying on a folder or collection name.
Agree a selection date and a delivery window that suit the job. Two revision rounds, seven days or a fortnight can be contractual choices, but they are not universal privacy requirements. Use the review and approval checklist to make responsibilities explicit.
Configure access and test the recipient's view
Use the platform's access controls rather than relying on an obscure URL alone. Choose a unique gallery password where supported, and agree how the client will receive it. Sending a link and password through separate agreed channels can reduce the chance that forwarding one message reveals both; it does not protect against a compromised device or both channels being accessed.
Use a neutral gallery title and filenames that do not include unnecessary personal details. Check the cover image, invitation and any link preview before sending. Do not assume that a password on the full gallery hides every title, cover or notification preview.
SendPhoto provides gallery password protection and download controls. Verify the chosen settings with a non-sensitive test gallery before using the same workflow for intimate images.
Open the test link in a signed-out browser. Check what appears before access is granted, then enter the expected credentials and inspect the visible files. Test the wrong-password path and every download option you intend to offer or withhold.
Repeat on a phone. Confirm that filenames, image orientation and instructions are clear without asking the client to troubleshoot the platform. Use test images for these checks, not another client's private photographs.
Treat likes as working choices, not final authorization
SendPhoto's likes can be changed by the viewer. Treat them as working favorites, not an irreversible submission or a signed approval record. Do not promise a minimum-selection rule, automatic selection lock or formal sign-off unless you have verified that exact feature in the system you use.
Ask the client to confirm the final identifiers through the agreed private channel. For example, an illustrative reply could say: “Please prepare files 014, 027 and 031 from proof set B, with the edits in my previous message.” The identifier and set version make that decision more precise than “the three I liked.”
Record the confirmation and check the file count yourself. If selections change, clarify which list replaces the earlier one before continuing. You do not need to pretend the gallery enforces a rule that is actually part of your studio process.
Avoid copying intimate thumbnails into reminders or project-management tools merely to track progress. The identifiers and status may be sufficient. Limit access to the people who actually need to perform the work.
Explain what previews and watermarks can do
A visible watermark can identify a proof and discourage casual reuse, but it is not a confidentiality control. Disabling download buttons or right-click menus also does not prevent screenshots, screen recording or other copying of a displayed image.
If your workflow calls for previews, export only the resolution and content needed for review. Do not upload originals solely because you expect a hidden button to make them unreachable. Understand what files the service stores and serves for the settings you choose.
SendPhoto offers watermark controls. Inspect the actual preview result, including on a small screen, and choose a mark that leaves the client's selection task possible. No particular diagonal placement or body location is mandatory.
Label proof and final sets plainly. Explain which edits are still pending so the client does not mistake an unfinished preview for the delivered result.
Check finals before announcing delivery
Compare the export against the confirmed list: identifiers, requested edits, file format, dimensions and orientation. Open a sample of the downloaded result, not just the image inside your editing application.
Verify that only the intended final set is available to that recipient. If you replace or remove proofs, check the resulting gallery rather than assuming the file operation preserved every permission. If you use a new link, explain which previous link is no longer intended for use.
Send a discreet message through the agreed channel. State what is ready, how to download it, the access end date if applicable, and how to report a problem. Let the client choose a suitable time and device to view the images.
Do not interpret an email open or gallery visit as proof that the client has downloaded and safely stored the finals. Ask for confirmation when it matters to your handoff.
Close access without promising instant erasure
Agree the access end date separately from the retention of originals, previews, exported finals and business records. In SendPhoto, share expiry and gallery auto-deletion are separate controls. Closing a gallery is not a promise that all stored copies or backups disappear at that instant.
At close-out, verify that the shared gallery can no longer be opened as a recipient. Test both a fresh browser session and an existing session where practical. Ask the provider about cached previews, previously issued file links and deletion behavior before making stronger claims.
Closing access cannot recall files already downloaded or copied by a recipient. State that limitation plainly; do not describe an expired page as proof that all copies have been destroyed.
Keep a purpose-based retention schedule covering your own working devices, exports, archives and backups as well as the gallery service. Remove unnecessary copies through the appropriate process while preserving anything you are required to retain.
For UK GDPR purposes, the ICO explains that retention depends on purpose, not a universal fixed period. Other jurisdictions and obligations may differ. Do not invent a standard thirty-day deletion promise or a blanket right to keep every original forever.
Use a final privacy checklist
Before sending the real gallery, confirm:
- Recipient and channel: the client has confirmed where to receive the link and who may view the images.
- Visible information: title, cover, filenames, invitation and link previews have been checked for unnecessary disclosure.
- Access and downloads: the recipient test matches the intended proof or final stage.
- Selection record: the exact file list and requested edits are confirmed outside a reversible favorites list.
- Timing and retention: the access date, retained categories and contact route for questions are clear.
- Public use: any portfolio or marketing permission is separate from private delivery.
If a link goes to the wrong person or access appears unexpected, stop further sharing, restrict access through the available controls and investigate promptly. Follow the incident obligations that apply to your situation; do not assume changing a password removes copies already obtained.
SendPhoto can support the gallery portion of this process. Start with a non-sensitive test set, verify its password, preview and download behavior, and use the result to decide whether it meets the client's needs before uploading the real session.