Privacy Policy

1. Information We Collect

We collect information from clients, prospective clients, account holders, gallery visitors, photo purchasers, downloaders, and individuals whose information is provided to us in connection with an event or gallery.

Contact and account information

• Name, email address, phone number, company, event location, and inquiry details you submit to us.
• Account information such as your name, email address, password hash, email-verification status, and last sign-in time.
• Authentication-related records, such as password-reset requests, email-verification tokens, and Google sign-in identifiers when you choose Google OAuth.

Gallery and photo-related information

• Gallery access details, including your email address when downloads require verification, a whitelist check, or a code.
• Download activity, including email address, project, photo identifiers, filenames, and timestamps.
• Purchase history and download history shown in your account, including orders, paid licenses, and previously downloaded galleries or photos.
• Photo metadata and gallery organization data, including project titles, album names, and people or brand tags attached to gallery images.

Payment and transaction information

• Order records, purchase totals, selected license types, Stripe checkout session identifiers, and download tokens.
• We do not store full payment card numbers or security codes on our servers.

Technical and device information

• IP address and standard request metadata used for security, fraud prevention, abuse prevention, and rate limiting.
• Browser or device storage used to keep cart contents and certain gallery-access preferences.
• Server-side cookies used for sign-in and gallery download authorization.

Event-related information from clients and collaborators

• Clients may provide information about attendees, team members, vendors, speakers, photographers, or other event participants.
• Photos themselves may depict event attendees and may be organized or searched using names or other tags entered by us or by authorized users.

Information from third-party data providers

• Business-context information about prospective clients, such as name, work email address, company, job title, professional background, and other business-directory details, obtained from third-party data providers and enrichment services.
• Verification and deliverability data, such as email validity and standard business contact metadata, used to maintain accurate records and reduce invalid outreach.

2. How We Collect Information

• Directly from you when you contact us, create an account, sign in, request a download, make a purchase, or otherwise use the site.
• Automatically from your browser or device when you use the site, such as through cookies, browser storage, and server logs.
• From our clients or event partners when they provide event-related information or authorize access to a gallery.
• From third-party providers you choose to use with us, such as Google for OAuth sign-in and Stripe for payment processing.
• From third-party data providers and enrichment services that supply or verify business-context contact information about prospective clients.

3. How We Use Information

We use personal information to operate, secure, and improve our services, including to:

• Respond to inquiries and communicate about bookings, projects, and services.
• Create and manage user accounts, authenticate users, verify email addresses, and reset passwords.
• Provide access to galleries, enforce gallery restrictions, verify download eligibility, and maintain download history.
• Process purchases, create orders, deliver licensed images, and send transactional emails such as receipts, verification messages, password resets, and download notices.
• Operate our photo and video delivery systems, including hosted media, original-file downloads, and ZIP download jobs.
• Send marketing communications about our services, events, and related offerings, where permitted by law. You can opt out of marketing emails at any time by using the unsubscribe link in any marketing email or by contacting us with the details in Section 12.
• Prevent fraud, abuse, credential stuffing, and unauthorized access using rate limiting, logging, and access controls.
• Comply with legal obligations, enforce our terms, resolve disputes, and protect the rights, safety, and property of SF Event Photo, our clients, and others.

4. How We Share Information

We do not sell personal information. We share personal information only with the categories of recipients described below, subject to appropriate contractual or operational safeguards.

Service providers

We rely on third-party service providers that act on our behalf to help us operate our services. These providers fall into categories that include:

• Website hosting, content delivery, and server execution.
• Content management for gallery and project data.
• Media storage and file delivery for photos and videos.
• Application databases, authentication support, logging, and rate-limit data.
• Payment processing and checkout.
• Transactional email delivery.
• Background job processing, such as ZIP generation for bulk downloads.
• Marketing email delivery, email campaign management, and data enrichment or verification of business-context contact information.

Third parties you interact with directly

• Payment processors that handle your payment details under their own privacy terms when you complete a purchase.
• Identity providers, such as Google, if you choose a single sign-on option.
• Third-party video platforms, such as Vimeo, when a project or gallery embeds a video hosted on their service.

Clients and event partners

We may share information with the client who hired us where reasonably necessary to run a gallery, fulfill contractual obligations, investigate misuse, or report on gallery activity.

Legal and safety

We may disclose information to attorneys, accountants, insurers, regulators, law enforcement, or other third parties when required by law or when reasonably necessary to protect rights, safety, or property.

5. Accounts, Galleries, and Downloads

User accounts

If you create an account, we store the information needed to authenticate you and maintain your access, including your email address, password hash for local sign-in, verification state, and account activity such as last login. If you use Google sign-in, we receive basic identity information from Google necessary to create or link your account.

Download access

Some galleries are open, some require an email address, some require a code, and some are limited to approved email domains. When you request access or download content, we may store your email address, project identifiers, and related download records so we can authorize access, prevent abuse, and show download history in your account.

Purchases and licensing

If you purchase a license, we create an order record containing your email address, purchased items, license type, payment status, order number, download token, and related transaction details. Stripe handles checkout and payment processing on our behalf.

People tags and gallery search

Authorized users may add names of people or other tags to gallery images. Those tags may be used to make images easier to find within a gallery or to personalize account-based access to previously downloaded content.

6. Cookies and Similar Storage

We use cookies and similar browser storage to support essential site functions, including:

• HTTP-only authentication cookies for signed-in users.
• Gallery download authorization cookies for approved access windows.
• Browser storage such as local storage for cart contents.
• Browser storage such as session storage for gallery-access convenience features.

If you disable cookies or browser storage, parts of the site may not function correctly, including sign-in, cart persistence, and some gallery-access flows.

7. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this policy, including providing services, maintaining accounts, fulfilling transactions, preserving download access, meeting legal or tax obligations, resolving disputes, and enforcing our agreements.

• Inquiry and communication records may be retained for ongoing client-service, operational, and business recordkeeping purposes.
• Order and payment-related records may be retained as needed for accounting, legal, tax, and customer-service purposes.
• Download logs, access logs, and account history may be retained to support gallery access, security, and fraud prevention.
• Rate-limit and security-related logs may be retained as needed to detect and prevent abuse.

8. Your Privacy Rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, or additional information about certain personal information we hold about you. California residents may have rights under the CCPA/CPRA, subject to applicable exceptions.

We may need to verify your identity before honoring a request. We may also retain certain information where permitted or required by law, such as for security, fraud prevention, accounting, or recordkeeping.

Marketing email opt-out

You can opt out of marketing emails at any time by using the unsubscribe link included in any marketing email we send, or by emailing privacy@sfeventphoto.com with the address you want removed. We honor opt-out requests promptly, and in any event within the time frames required by applicable law. Opting out of marketing emails does not stop transactional or service-related messages tied to an account, a booking, an order, or a download.

To submit any other privacy-related request, including an access, correction, deletion, or opt-out request under applicable law, contact us using the information in Section 12.

9. Security

We use administrative, technical, and organizational measures designed to protect personal information, including access controls, authentication checks, rate limiting, and secured service-provider infrastructure. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

10. Children’s Privacy

Our site and services are not directed to children under 13. We do not knowingly collect personal information directly from children under 13 through this site. If you believe we have inappropriately collected personal information from a child, please contact us and we will investigate.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and revise the “Last updated” date above.

12. Contact Us

If you have questions about this Privacy Policy or would like to make a privacy-related request, please contact us: