Alex Claudio Photography
Privacy & cookie notice
Draft for owner and legal review · September 17, 2026. This notice describes the implemented controls; it does not guarantee legal compliance. Confirm the business controller’s legal name, postal address, applicable legal bases, international transfer arrangements and provider retention before publishing.
When you inquire
We store the names, contact details, wedding date, venue, collection, budget and message you submit so the studio can respond and provide photography services. Submitting an inquiry does not subscribe you to marketing. Inquiries work whether you accept or reject analytics.
Inquiry information is stored in the studio’s database hosted with Railway. Configured notifications may send your submitted details to Resend for email and selected contact fields to Google Sheets. These service providers process this information to deliver and manage your inquiry. The studio can retain private planning notes and manual financial records. No card payments are processed by this website.
Your optional analytics choice
Analytics is off until you choose to enable it. The site uses first-party analytics only: Google Analytics, Google Ads and Meta pixels are disabled. We count page views and inquiry actions and use broad device/browser groups, selected campaign labels and referrer categories. Only approved public page paths and selected referring domains are stored; other referrers are recorded as “other.” We do not record full URLs, form contents, names, email addresses, phone numbers, keystrokes, replay recordings, raw IP addresses or location in analytics. We do not link analytics identifiers to customer records.
Approximate browsers are not people. Sessions expire after 30 minutes without an event; separate tabs may create separate sessions. The system reduces obvious bots and excludes signed-in admin activity, but reports cannot represent all visits.
Global Privacy Control disables optional analytics. Do Not Track does not change consent automatically because its meaning varies; use Cookie settings to reject or withdraw. Withdrawing stops future requests and clears known analytics storage. An event already received by the server cannot be unsent. Existing anonymous events expire under retention.
Storage and retention
| Item / provider | Purpose | Expiry |
|---|---|---|
| ac_consent · first-party localStorage | Necessary: choice and notice version, no visitor identifier | 180 days, then ask again |
| ac_browser · first-party localStorage | Optional approximate browser identifier after consent | 90 days or withdrawal |
| ac_analytics_session · first-party sessionStorage | Optional random session identifier and last activity | 30 minutes inactivity, tab close, or withdrawal |
| ac_admin · first-party HttpOnly cookie | Necessary private studio sign-in / CSRF session | 8 hours inactivity or logout; created only on sign-in page access |
Raw analytics is retained for up to 90 days by default. The scheduled cleanup replaces it with daily totals without identifiers or attribution, retained for up to 12 months. The owner may shorten these periods. Customer records use separate retention and remain until deleted by the studio, subject to applicable bookkeeping and service obligations. The owner must establish a customer retention schedule before launch.
Hosting and delivery providers may process network addresses in operational logs even though the analytics database does not retain them. Confirm provider logging periods and backup retention with the account owner. Public photo delivery and essential static assets remain available without analytics consent. Third-party fonts and advertising embeds have been removed.
Requests and choices
Use Cookie settings at any time. To request access, correction, export or deletion of customer information, email contact@alex-claudio.com. The studio will verify the request appropriately. Active database deletion does not automatically erase provider email, Google Sheets, previous exports or backups; those require separate removal or expiry. A restored backup must have deletions reapplied before use. We do not invent tracking identifiers for visitors who declined analytics.