What the Site Collects on Its Own
Nothing about you. There are no advertising cookies, no tracking pixels, no social media widgets and no embedded maps, and the fonts are served from this site rather than from Google, so there is no cookie banner: there is nothing to consent to. If analytics are turned on, they are Cloudflare Web Analytics, which counts page views without cookies and without identifying you. Like every website, the site is delivered by servers (here, Cloudflare’s) that see your IP address for a moment in order to send you the page.
The Forms
When you send a form (contact, or the newsletter sign-up), what you typed, the time, the page you sent it from, your IP address and your browser’s name are stored on Cloudflare’s network, which may be outside Canada, and sent to me by email through Resend, the service that delivers my mail. I use a message for the conversation it belongs to and nothing else, and I delete it when the conversation is finished, or after a year, whichever comes first. A field hidden from people catches automated spam; a real person never fills it in. If a form shows a spam check, it is Cloudflare Turnstile, which is used only to tell people from bots.
Meeting Me Outside
When we meet outside and you use the Hello page, the site keeps the photo you took of yourself on your phone, your name, your email, your phone number if you gave it, where we met, the time, and a record of the box you ticked and when, on Cloudflare’s network, which may be outside Canada. The photo exists so I can match you to your photographs. The three emails that follow (the confirmation, the copy for you and the notice for me) are sent through Resend, the service that delivers my mail. The site keeps the IP address of the phone for a day, only to limit how many sign-ups one place can make. The photo you took and these details are deleted from this site fourteen days after you uploaded them. I delete them sooner if you ask. The emails stay in our two mailboxes. Cloudflare keeps its own restore copies of the database for a time after a deletion. Nothing is sold, lent or shared beyond the service that delivers the emails.
The Newsletter
You are added to the list only when you tick the box, which is never ticked for you, and send the form. I keep a record of that consent (the words you agreed to, the time and the page) for as long as you are subscribed and for three years after, so I can show it was given. Every email says who sent it and carries a one-click unsubscribe link; you can also reply “stop”. A few times a year, not more. The addresses are held by Resend, which sends the letters for me. The list is never shared, sold or lent to anyone.
Buying Something
Payment happens on Stripe’s own pages. I never see your card number. Stripe sends me your name, your email and what you bought, and keeps a customer record of your purchases with me under its privacy policy. For a gift certificate, the buyer’s name and email, the recipient’s name and email and the gift message are kept online, in this site’s database on Cloudflare, which may be outside Canada, so the certificate can be made and emailed at the time you choose, and re-sent if it is lost. They pass through Resend, which delivers the certificate email and its PDF. The message is printed on the certificate and used for nothing else. The same goes for the name and email you give when you spend a certificate. For Three Pictures, the photographs you upload are kept in this site’s file storage on Cloudflare, which may be outside Canada, and deleted 60 days after you upload them. The site deletes these names, emails and messages a year after the last email about the order goes out, and at once if the payment is not completed. The certificate’s code, its value and its balance are kept as sales records, for as long as tax and accounting law require.
Photographs of People
A photograph of an identifiable person is personal information. I publish a portrait of an adult only with their agreement, and anyone who appears in a photograph here can ask me to take it down at any time; it comes down. Children appear only with a parent’s or guardian’s written consent, are never named, and come down the moment a parent asks.
Children
No child’s personal information is collected on this site. The forms are for adults; if a child sends one, I delete it.
Your Choices
Write to hello@wildphoton.ca to see what I hold about you, to correct it, or to have it deleted. I answer within two business days and finish the request within the time the law allows. If you are not satisfied with my answer, you can contact the Office of the Information and Privacy Commissioner of Alberta.
The Law
Wild Photon Photography Inc. is an Alberta corporation, so Alberta’s Personal Information Protection Act applies to the personal information it holds; Canada’s PIPEDA applies where information crosses a provincial or national border.