Privacy
We are a small photography studio, not a data business. We collect the minimum needed to show you the gallery, take your order and get a print to your door, and we do not sell or rent personal information to anyone. This page says exactly what we hold and why. The business responsible is [LEGAL ENTITY NAME], [BUSINESS ADDRESS], Great Falls, Montana; you can reach us at [email protected].
What we collect
- When you browse. Our host, Cloudflare, processes the technical data any web request carries: your IP address, browser type, the pages requested and the time. It is used for security, to serve the site quickly, and for aggregate, cookie-free statistics. We do not use advertising trackers, social media pixels or fingerprinting.
- When you buy a print. Your name, email address, shipping address, what you ordered and how much you paid. Payment is handled entirely by Stripe on Stripe's pages; your card number never touches our systems. Stripe may also collect information to prevent fraud under its own privacy policy.
- When you have a login. A few of our folders are shared with friends and family. If we have given you an account we hold your chosen username, a hashed password (we cannot read it), and which folders you may see.
- When you email us. Whatever you send, so we can reply.
Why we use it
To make and deliver what you ordered, to answer your questions and handle refunds, to keep the records tax law requires, to keep the site secure, and to comply with the law. That is the full list. We do not build profiles, and we do not send marketing email unless you have asked for it, in which case every message has an unsubscribe link.
Who we share it with
- Stripe processes payments and sends your receipt.
- Our print partner (currently Prodigi) receives your name, shipping address and the artwork file so it can produce and ship your print. Its carriers receive your name, address and, if provided, phone number for delivery.
- Cloudflare hosts the site and stores the photographs and order data.
- Accountants, tax authorities and courts where the law requires it.
Each of these providers is bound to use your data only to do the job we have given them. We never sell personal information and we never share it for anyone else's advertising.
Cookies and local storage
The site sets no cookies for ordinary visitors. If you log in, a single session cookie keeps you logged in, and your browser may store small preferences locally, such as your light or dark theme. Stripe's checkout pages set their own cookies for fraud prevention. Because we do no tracking, there is no banner to click through.
How long we keep it
Order records are kept for as long as tax and accounting law requires, generally seven years, then deleted. Account details are kept until you ask us to remove them. Email correspondence is kept for as long as it is useful for helping you, then deleted. Server logs are held by Cloudflare for a short rolling window.
Your rights
Wherever you live, you can ask us what personal information we hold about you, ask us to correct it, ask us to delete it (we will, except for order records we must keep by law), or ask us to stop using it. Email [email protected] and we will respond within 30 days. We will never treat you differently for exercising these rights.
Where we are and which law applies: we are based in Montana. Montana's Consumer Data Privacy Act applies only to businesses handling the personal data of tens of thousands of Montana residents a year, which we are far below, and we do not sell personal data in any case. If you live in a state or country with its own privacy law that gives you rights to know, correct, delete or opt out, we honour those requests for everyone as a matter of course, so you do not need to check whether the law covers us.
Residents of the United Kingdom and European Economic Area: we process your data to perform our contract with you and for our legitimate interest in running a secure site. You have the rights described above, and the right to complain to your local data protection authority.
Children
The site is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has given us personal information, email us and we will delete it.
Security
The site is served only over HTTPS, passwords are stored hashed, payment details are held by Stripe and never by us, and access to order data is limited to the people who run the studio. No system is perfect; if we ever suffer a breach affecting your information, we will tell you.
Changes
If we change how we handle personal information, we will update this page and the date at the top. Significant changes will be announced on the site.