Privacy, in plain sight.

What this product stores

Account email is handled by Supabase Auth. Photographer introductions, categories, country, city, time zone, service areas, packages and permissioned portfolio images support your listing. Booking requests contain your selected package, shoot time, currency, service location and brief. Private messages and booking events support the conversation and scheduling history.

Who can see what

Approved photographer profiles and their published work are viewable without an account. Owners can manage their drafts. Administrators review applications. Booking details, messages and events are restricted to the booking participants by database access policies. No public customer directory is provided.

Reviews and reports

Review ratings, text, publication dates and photographer replies are public on published profiles. Customer names, account identifiers, booking dates, prices, meeting areas and messages are not included in public review records. Text you choose to publish can still reveal personal details, so do not include them. The private booking link and customer confirmation snapshot are retained for attribution and eligibility; they do not verify payment or attendance.

Reports are private to the reporter and administrators. Moderation decisions retain an audit reason visible to the reporter; moderators do not gain access to private bookings. Hidden content and its eligibility record remain accessible to the booking participants. No automatic retention period or self-service deletion of reviews is promised in this release.

Images and local storage

Portfolio uploads are decoded and re-encoded on the server after private staging, before being saved to private storage. Approved portfolio images use short-lived signed URLs; previously loaded images may remain in browser caches. Booking drafts are saved in this browser’s local storage for up to 24 hours to preserve them across email sign-in tabs, then discarded on their next read or after a matching successful request. Do not use a shared browser or put sensitive information in drafts. Claimed drafts are bound to the signed-in account and cleared on account change or sign-out. Pending message retry details remain in this browser until verified or signed out; do not use a shared device for private conversations. Sign-in uses cookies to maintain your authenticated session.

Infrastructure and communications

The application uses Supabase for authentication, data and portfolio storage, Vercel for hosting, and Resend for authentication and minimal booking/message notification emails. Notification emails link to your dashboard without including private message bodies or booking details. Delivery can fail or be delayed by limits; check your dashboard. No third-party advertising trackers or payment-card collection are implemented in this milestone.

Optional public analytics

Google Analytics 4 is optional. Use Analytics preferences in the footer to allow, decline or withdraw consent. Before you allow it, we do not load Google Analytics or send analytics requests, including consent pings. Declining does not affect site features. Your preference is stored in this browser for up to 180 days; clearing site storage resets it to off.

For signed-out visitors who opt in, we measure a small set of public pages using fixed page labels, visible search-result count ranges, and clicks into profiles from the directory. A click is not a booking or a completed transaction. We do not send search words or locations, profile names or identifiers, URL queries or fragments, referring URLs, account identities, booking briefs, messages, names or email addresses. Profile detail, account and private pages are not measured.

The Google tag runs in a separate empty same-origin document, not in the page containing your forms or profile details. Enhanced Measurement is limited to that empty document, not the application’s forms, searches, clicks or navigation. This is not a security sandbox against Google code. Advertising storage, advertising user data, personalization and Google signals are disabled in our tag. After consent, the tag can use scoped session cookies, which we clear when measurement stops. A random analytics identifier is created per document. This limits returning-visitor and cross-page reporting. Automatic empty-document engagement is not a measure of your activity in the application.

Google provides the analytics service and processes the requests it receives, including network and browser information such as IP address and device information. Processing may occur outside your country under Google’s applicable terms. See how Google uses information from partner sites. Withdrawing stops future collection from this site; it does not erase information already sent to Google. The owner has not yet verified the property’s event-data retention period. GA4 offers retention settings for detailed event data; standard aggregated reports are not governed by the same deletion period. We do not promise a verified deletion deadline or blanket legal compliance.

Your controls and data retention

You can edit your profile and remove portfolio images through your dashboard. Account deletion and data export are not self-service; contact the address above. Account, booking and moderation records are retained unless removed through an operator-reviewed request; there is no automatic deletion schedule. Moderation history is append-only, and some records may need to be retained for other participants or audit integrity. Do not put sensitive personal information in the pilot. These limitations do not waive your applicable rights.