Privacy Policy

When you make a booking we collect:

• Personal details — full name, email address, and phone number.
• Session details — chosen package, date, time, guest count, and any add-ons.
• Payment information — the amount you paid, your chosen payment channel, an optional reference number, and an uploaded proof-of-payment image (screenshot or receipt).
• Custom booking fields — optional information such as shoot purpose, referral source, or special requests.
• Photo delivery — if we generate a QR/link delivery for your session files, your name and booking reference are stored with that delivery record.

We do not collect payment card numbers. All payments are made directly through your preferred e-wallet or bank — we only receive proof of the transaction.

• Process and manage your booking reservation.
• Verify your proof of payment and confirm or reject your booking.
• Send booking-related emails: confirmation, reminder, access instructions, completion notice, and any photo delivery links.
• Manage rescheduling or cancellation requests you initiate.
• Maintain an internal record for accounting and dispute resolution.

We do not use your information for marketing purposes without your explicit consent, and we do not sell or share your data with third parties for their own marketing.

Upload images (screenshots or receipts) are stored in a private, access-controlled cloud storage bucket (Supabase Storage). They are accessible only to studio staff for the sole purpose of verifying your payment. Images are not publicly accessible and are not shared outside our team.

If your session package includes digital file delivery via our QR/link system, your files are stored temporarily in a private storage bucket. Delivery links expire after a set number of days (shown on the download page). After expiry, your files are permanently deleted from our storage. We recommend downloading your files promptly after receiving them.

By providing your email address you consent to receive transactional emails related to your booking (confirmations, reminders, access instructions, cancellation notices). You may contact us to opt out of non-essential follow-up emails at any time.

Booking records and associated personal information are retained for a minimum of two (2) years for business and accounting purposes. Proof-of-payment images are retained for the same period. Photo delivery files are deleted automatically upon link expiry. You may request earlier deletion of your personal data by contacting us (see Section 9), subject to any legal retention obligations.

Your data is stored in a PostgreSQL database and cloud storage hosted on Supabase, which applies encryption at rest and in transit. Access to the admin system is protected by password authentication and role-based permissions. No system is completely immune to breach; we take reasonable technical precautions to protect your information.

The booking system relies on the following third-party services, each governed by their own privacy policies:

• Supabase — database and file storage.
• Resend / email provider — transactional email delivery.
• Google Calendar — availability management and session scheduling (optional integration; no client data is written to Google Calendar beyond session date/time and booking reference).
• Vercel — application hosting.

You may request to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your personal data, subject to retention requirements.

To exercise any of these rights, please contact us using the details in Section 10. We will respond within a reasonable timeframe.

For questions about this Privacy Policy or your personal data:

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of our booking system after changes are posted constitutes acceptance of the revised policy.