Your scans belong with you.

Last updated: 6 November 2026.

Who is responsible and how to contact us

Roll is supplied by James Harrison Rushworth, a sole trader trading as Resolvia in New Zealand.
For purchase, refund or privacy enquiries, including requests for our Privacy Officer, email contact@resolvia.net or contact support.

Resolvia collects and holds the information described here to operate Roll, this website and purchaser services.

Your photographs and local tools

Roll edits scans on your computer. Your photographs are not uploaded to this website as part of desktop editing, and exports are separate files. The website’s preset checker and unsigned-in support draft tool process their input locally in your browser. A draft does not send a support request; downloading it saves a file on your device. Do not include photographs, licence keys or payment card details in support messages or community submissions.

Information we collect and why

• Account email, display name, sign-in tokens and sessions: to verify your identity, sign you in and manage your profile.
• Support requests, preset submissions, comments, revisions, reports and moderation decisions: to provide support, publish approved contributions and keep the community safe.
• Purchase email, order and payment references, amounts, currency, tax, payment/refund/dispute status and licence records: to fulfil purchases, recover keys, handle payment problems and meet accounting obligations.
• Request information such as IP address, user agent, timestamps and security events: to deliver the site, diagnose errors and prevent abuse. Rate-limit identifiers in our database are hashed using a secret key.

You choose whether to provide information. You can browse public pages without an account; without an email we cannot sign you in or deliver a licence, and without request details we may be unable to provide support. A public display name and contribution are needed to publish community content. Payment and billing information requested by Stripe is needed to complete payment and applicable tax checks. We do not sell personal information or use it for advertising.

Information from other sources

Stripe sends us purchase and payment updates, including purchaser email and refund or dispute information, so we can fulfil and reconcile orders. Other users may submit reports about your public contributions; moderators record review decisions. These are the purposes and recipients described in this policy. If we collect personal information about you indirectly in other circumstances, we will take reasonable steps to notify you as soon as reasonably practicable, unless an exception under the Privacy Act applies.

What is public and who can access private records

Approved presets, settings, display names and comments are public and may be copied or indexed by others. Account email addresses are not displayed on community posts. Support requests, revisions and reports are private to their owner and authorised staff as appropriate; they do not become public on approval. Moderators review community and support content. Financial support permissions are granted separately for purchase and licence records.

Service providers, payments and overseas processing

Hosting, database, backup and email providers process information to run the service and deliver sign-in and purchase messages. Stripe hosts payment collection: this website does not collect or store your full card number or card security code. Stripe also processes data for its own payment, fraud prevention and legal purposes; see Stripe’s privacy policy. We may share necessary information with professional advisers, or where disclosure is required or permitted by law. We otherwise use and disclose information only for the purposes described here or another lawful basis under the Privacy Act.

Providers may process information outside New Zealand. We remain responsible for information held by providers acting only on our behalf and require appropriate protection. Where an overseas recipient uses information for its own purposes, we must have a lawful basis under information privacy principle 12, such as comparable safeguards. If relying instead on your express authorisation after warning that comparable safeguards may not apply, we will seek that separately; using this website is not blanket consent to unprotected disclosure. Contact our Privacy Officer for details about providers and processing locations relevant to your information.

Cookies and security

Essential authentication and security cookies support sign-in and request protection. Disabling them can prevent account features from working. This website does not use advertising trackers or third-party analytics. We use access controls, restricted staff permissions and encrypted stored licence keys and backup files to protect information. No system is completely secure. If a privacy breach has caused or is likely to cause serious harm, we will notify the Privacy Commissioner and affected people as soon as practicable, unless a legal exception applies.

Retention and account deletion

We keep personal information only as long as needed for its lawful purpose. Routine cleanup removes support requests after 180 days without activity, resolved reports after 180 days and audit events after 365 days, together with expired sessions, sign-in tokens and obsolete rate-limit records. Community contributions remain until removed or your account is deleted.

Deleting your account removes your profile, sessions, submissions, revisions, reports and associated discussion threads, including others’ replies in those threads. Minimal audit records can remain without your email or message content. Purchase and licence records are held separately so that you can recover a purchase using the same verified email after account deletion. Tax records must generally be kept for at least seven tax years; we retain necessary financial records for that period and longer only where law requires it or a dispute needs resolution. Licence recovery records are retained while needed to support your entitlement. Contact us to discuss deletion of records that are no longer needed. Deleted data may remain in restricted backups until those backups expire, and providers may retain records they are legally required to keep.

Access, correction and complaints

You can ask our Privacy Officer whether we hold information about you, request access, and ask us to correct inaccurate, incomplete or misleading information. We may verify your identity proportionately before releasing it. We will respond to access and correction requests as soon as reasonably practicable and within 20 working days unless the Act permits an extension; we will explain any extension or lawful refusal and your complaint rights. If we decline a correction, you can ask us to attach a statement of the correction you sought.

Contact us first with a privacy concern so we can investigate. If unresolved, you can complain to the Office of the Privacy Commissioner.

Policy changes and demonstration images

We update this page and its date when our practices change, and give notice of material changes where appropriate. New uses of existing information must still be permitted by law. Screenshots use a synthetic demonstration scan based on Rachel Michetti’s CC0 café photograph, not customer photographs or measured film calibrations. Read the image credits.