Privacy policy

This privacy policy explains what personal data Manet Photography collects, why we collect it, who it is shared with, how long we keep it, and how you can ask us to delete it.

What we collect

• When you book a shoot or send an enquiry we collect your name, email address, phone number, the date and details of the shoot you're requesting, and your location or postcode where relevant (for example, to estimate travel).
• If you choose to pay your deposit online, the payment is handled by Stripe on their own secure systems. We never see or store your card details — we store only the booking amount, a payment status and Stripe's payment reference.
• Our server keeps your IP address for a short security window to rate-limit spam bookings and protect the site.
• We do not collect payment card details, and we do not run advertising trackers.

Why we collect it

• To respond to your enquiry, confirm your booking, calculate your price (including any travel surcharge) and send you a receipt.
• To contact you about your booking by phone, text or email.
• With your optional consent, to send you marketing about future offers.

Third-party services we use (data processors)

We use a small number of trusted providers to run this website. We never sell your data, and each provider only receives what it needs to provide its service:

• Supabase (database hosting) — stores booking and enquiry records (name, email, phone, booking details) on secure, access-controlled infrastructure. Privacy policy: supabase.com/privacy
• Stripe (online payments) — receives your email address and payment details when you choose to pay a deposit online, and processes the payment on our behalf. Card details are entered on Stripe's own pages and never pass through this website. Privacy policy: stripe.com/privacy
• Vercel (website hosting) — serves the website and processes standard technical logs (including IP addresses) to operate and secure it. Privacy policy: vercel.com/legal/privacy-policy
• OpenStreetMap services — Nominatim and OSRM (travel estimates) — when you enter a postcode for a travel estimate, the postcode is sent to these free public mapping services to work out the distance. Only the postcode is sent — never your name or contact details. Policy: osm.org/privacy
• Resend (email delivery, only if/when email sending is enabled) — used to deliver booking confirmations; your email address is passed to the email service for that purpose. Privacy policy: resend.com/privacy

How long we keep it

• Booking records are kept while your booking is active and for a reasonable period afterwards for accounting and records purposes.
• Enquiries are kept until they have been dealt with.
• IP addresses kept for rate limiting are used only for security — never for marketing or profiling.

Your rights

• You can request a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Contact us using the email address on the contact page and we will action your request promptly.
• You can withdraw marketing consent at any time.
• If you are in the UK, you can also complain to the Information Commissioner's Office (ico.org.uk).

Data security

• Data is sent over encrypted connections (HTTPS) and stored on secure, access-controlled systems. Only the business owner can view customer bookings and enquiries; all admin actions require a login.
• Access to customer data can be revoked and deleted on request — see “Your rights” above.

This is a starter template provided for convenience. It is not professional legal advice. Please review it with the needs of your business in mind and seek independent legal advice if you have any doubts.