Boudoir culling: consent, privacy and control

A boudoir client is trusting you with files they would not want seen by anyone they did not name. Most of that trust is kept or broken between the card coming out of the camera and the gallery going out, which is exactly the stretch nobody writes a process for. This is that process: storage, access, consent notes, delivery controls, and what happens to everything you did not pick.

The selection is where the promise is kept

Booking a boudoir session is a decision the client thought about. By the time they arrive they have asked themselves who might see the pictures, what happens if your laptop is stolen, and whether they can change their mind later. You answered some of that in the consultation. The rest gets answered by what you do with the files afterward.

That stretch, from the card coming out of the camera to the gallery going out, is the part most photographers run on habit. Files land in a folder named after the client. A contact sheet gets opened on a laptop in a coffee shop. A retoucher gets sent the whole take because it was easier than making a subset. None of that is malicious, and all of it is a gap between what was promised and what is happening.

So treat the selection pass as part of the service, not as admin that happens after it. Which frame is strongest is a question you can already answer. This article covers the other ones: where the files sit, who can open them, what the client decides, and when everything you did not pick stops existing. A privacy failure here is almost always a workflow failure rather than a security breach.

Decide the storage rules before you copy anything

Every decision below is cheaper to make on a Tuesday than at eleven at night with a full card in your hand. Write them down once, then run the same routine every session.

Where the files live. An encrypted working drive and one encrypted backup, with full disk encryption on, not a folder with a password on it. If the backup runs to a cloud service, check the account has two factor authentication. The general routine is our 3-2-1 backup workflow. The boudoir version differs in one way: encryption is not optional, and neither is knowing where the second copy is.

What the folder is called. Use a client ID or a neutral job code rather than a full name plus the word boudoir. A folder name is visible on a shared screen, in a backup log, in a file dialog while you are screen sharing with an accountant. Keep the mapping from code to client in your business system. This is the easiest change on the list and the one most studios have not made.

How long anything is kept. Pick a retention period, put it in the contract in plain words, and set a calendar reminder for the date. A promise you cannot demonstrate you kept is worth less than a shorter promise you can. Our photography contract guide covers where that clause sits.

Pick against the consent notes, not only against the frame

The most useful document in a boudoir cull is not a shot list. It is a short record of what the client agreed to, written during the consultation and read again before you rate anything. It covers four things: what they do not want emphasized, what they do not want shown online, how much retouching they want, and whether any image may be considered for your portfolio later.

Read that record first, because it changes what a good frame is. An image can be technically excellent and still sit outside what the client agreed to make. That frame does not go into a proof gallery to see what they think. It does not go in at all.

Two categories get flagged the moment you see them rather than judged on merit: any sequence the client said felt uncomfortable, and accidental captures around wardrobe changes. So does anything carrying an identifier they may not have noticed, such as a document on a side table, an address on a package, or a reflection showing more of a room than they expected.

A small set of private labels keeps this manageable. Something like approved direction, client sensitive, do not proof and portfolio question is enough. Two rules about them: they live in the working catalog only, and you check they are not travelling in exported files. Labels, keywords and ratings leak into exports more often than people expect, so inspect one export before you send fifty. Our guide to photo metadata covers what rides along and how to strip it.

Retouching belongs in the same record. Sort your notes into three buckets as you select: routine cleanup, an adjustment the client specifically asked for, and anything that needs a conversation first. Nothing in the third bucket gets done on assumption.

Access, stage by stage

Write your version of this once. The point is not the specific tools. It is that every stage has a named answer to who can open the files, and to what the client decides at that moment. Anyone new on that list gets agreed in writing before the shoot, not discovered afterward.

A second pair of eyes is useful. Another professional catches a crop edge, a stray background object or an inconsistent retouch you have looked at so often you no longer see it. Run it on a need to know basis: name the role in the consultation, and send that person the smallest set that lets them work. Extra eyes is never a reason for loose folder permissions. If you work alone, time does the same job: look again the next morning at normal viewing size.

Where the picking happens is a privacy decision

Culling software comes in two shapes, and for this genre the difference matters more than the feature list. Desktop tools like Aftershoot and Narrative Select analyze files on your own machine, so nothing leaves the building. Cloud tools require you to upload the take first, so a copy of the session sits on a third party's servers under that company's terms rather than yours. Imagen's culling add-on works that way. It is a reasonable design and a different risk profile from a local app.

Neither shape is wrong. What is wrong is not knowing which one you are using, or promising a client their photos never leave your computer while a background sync quietly disagrees. We worked through the trade in local versus cloud culling. For boudoir, ask a vendor two questions: how long do uploaded originals persist, and can a support engineer open them.

There is also a limit worth naming. Software can rank sharpness, catch closed eyes and group near identical frames, and it does that well. It cannot know what the client asked to keep off the internet, or that one sequence became uncomfortable. Ranking is a sorting aid, never a permission. The frames a machine should never be allowed to decide are listed in what AI should never choose, and consent is the clearest case on that list.

Delivery, with the controls actually switched on

Most gallery platforms can be locked down properly. Most galleries are not, because the defaults are built for a family session everyone wants to share.

• Unique password. One per client, never a studio standard, sent the way you said it would arrive.
• Search indexing off. Check the setting rather than assuming it. This is the one that turns a private gallery public.
• Downloads decided on purpose. Off until selections are approved is a reasonable default if it matches your service. Say which it is.
• Neutral filenames. Exported files carry the job code, not the client's name.
• Check it on a phone. Open the finished gallery on a phone before you send it, because that is where it will be viewed, often somewhere not private.
• Removal without explanation. Any image comes out of the gallery on request, and they never have to say why. Make it a one line email, not a form.

Keep the proofing threshold aligned with what you agreed. Some clients want the full set to choose from. Others asked for a curated reveal and would find a large unpolished gallery upsetting rather than generous. Confirm which before the shoot, along with how many images they may pick. Our gallery delivery guide covers the mechanics for both.

Portfolio permission is its own decision, made after the images exist, in a separate document, image by image. A yes given in the excitement of the reveal is not a durable yes. Give people a way to withdraw it later without an argument.

What happens to the frames you did not pick

This is the question boudoir clients ask more than any other, and the honest answer is a policy, not a feeling.

Start with the distinction that clears up most of the confusion. Selecting is marking. Whatever tool you use, picking a shortlist should not touch the files it did not pick, and it is never the same action as erasing them. Retention is a separate, deliberate step on a date you named. Clients often assume the unpicked frames are already gone, or already published, and the plain language for that conversation is in explaining the cull to clients.

Then decide the policy. Keeping the originals for a stated period protects reorders, a lost gallery and a reprint two years later, and we argued the general case in should you keep rejected RAW files. Boudoir is the genre where the counterweight is real: some clients want a shorter window, or want everything erased once they have their finals, and that request should be easy to make and cost nothing.

So offer both: a default retention period in the contract, and an early erasure option the client triggers by asking. When the date arrives, run it on every copy including backup and archive, then send one line confirming it is done. Two things to guard. Backups outlive intentions, and anything released for portfolio use needs separating first, so honoring the policy does not destroy a file you had permission to keep.

The five minute review before you press send

Run the same check every time, in the same order. It takes minutes and catches almost everything that turns into an apology later.

1. Reread the consent record against the final set. Anything flagged do not proof is out, visibly.
2. Open one exported file and inspect it. No internal labels, no private keywords, no working notes riding along in the metadata.
3. Scan every frame for identifiers rather than for quality. Documents, packages, reflections, a name on a bag.
4. Check the gallery settings yourself: password set, indexing off, downloads set the way you agreed.
5. View the gallery in order, on a phone. You are checking pacing and whether it feels made for one person, not pixels.
6. Confirm the retention date is in your calendar and matches the delivery email.

A gallery that arrives with a note saying who has seen the files, what happens to the rest and when, tells the client this was handled by someone who thought about it in advance. That is what they describe to a friend, and in this genre most of the work arrives that way.

FAQ