How it works
How picture day runs, start to finish
The program follows a clear sequence, built around the roster the school already keeps and a lab relationship the school already trusts.
- The roster is imported once. The school’s existing roster — name, grade, and homeroom — becomes the anchor record for the whole program. It is imported a single time; every downstream product reads from the same record rather than a re-typed list.
- Picture day is scheduled and staffed with scoped roles. Staff are granted only the access their role requires — a front-desk volunteer checking students in does not need the same access as the business office reconciling the order catalog.
- Portraits are captured and bound to the roster. Each portrait is associated to a student through the roster record already on file — by name, grade, and homeroom — not by a face match. No biometric template is computed at capture or afterward.
- Consent is checked before a gallery or a sale is offered. A family gallery is opt-in and off by default. Consent is recorded per subject; without a consent record on file, a portrait does not appear in the family gallery and is not offered for sale. A guardian can withdraw consent at any time, and withdrawal removes the portrait from the gallery immediately.
- Families reach a private gallery by a link. A guardian reaches their child’s gallery by a private link tied to the roster record. There is no public browsing of the school’s photo set; a guardian sees only their own child’s portraits.
- Portraits feed the directory, ID cards, team composites, and memory mates. One consented portrait is composited into the class directory, the ID-card layout, any team or club composite the student belongs to, and a memory mate — all from the school’s own template. Fail-closed print preflight blocks the print job if a portrait or a consent record is missing.
- Press-ready output routes to the school’s own lab. The finished files are press-ready and route to the lab the school already uses, so the print run matches the school’s expected paper stock, color, and finish, with delivery tracked once the order is placed.
What is built and what is in early access
The capture pipeline, the roster lookup, the consent gate, the private galleries, and the composite products are live today. The parent order rails are built to the school’s own catalog and pricing; the live payment leg is the one honest early-access item, named plainly.
Press-ready output to your own lab
The finished portrait routes to the school’s own lab as press-ready output, so the paper stock, the color, and the finish match what an independent-school family already expects — not a generic vendor print run. The directory, the ID cards, the team composites, and the yearbook all draw from the same press-ready file. Shipped
One roster, imported once
The school’s roster is imported once and becomes the anchor for the whole picture-day program: every portrait, every gallery, and every composite ties back to the same roster record, so there is no second data-entry pass for the ID cards or the team photos. Shipped
Roster-lookup find-my-child, not face match
A family finds their child by name, grade, and homeroom — a database lookup against the roster the school already trusts. There is no face match on that standard path, and it computes and stores no biometric template. Face matching is a capability we are building and is not turned on today — the recognizer is not yet wired: it holds no face-recognition model weights, and no face template is computed from a photo. Photo finding uses a permission-checked roster lookup instead. Photos and any face data are never sent to an outside AI or photo company; processing runs on our own private system. Shipped
Private, tenant-isolated family galleries
Each family reaches a gallery by a private link, sees only their own child’s portraits, and cannot browse another family’s photos. A gallery is opt-in and off by default: consent is per subject, can be withdrawn at any time, and withdrawal removes the portrait from the gallery immediately. Shipped
Directory, ID, and team composites from one portrait
One consented portrait feeds the class directory, the ID-card composite, the team and club composite, and a memory mate — the school’s template, the student’s name and grade, and the same file used everywhere. Fail-closed print preflight blocks a print job rather than shipping a directory page with a missing portrait or an absent consent record. Shipped
Parent order rails
The order flow and the school’s own catalog and pricing are built: a family can browse products, select sizes and quantities, and see the school’s set price at every item. The live payment rail that charges a card is early access. No card is charged today. Early access -- live payment rails