Privacy Policy

1. Introduction

Ellis Creek Photography LLC ("Company," "we," "us," or "our") operates the Capture photo delivery platform ("Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this policy carefully. By using the Service, you consent to the practices described herein.

2. Information We Collect

2.1 Information You Provide

When you create an account or interact with the Service, we may collect:

• Contact information: first name, last name, email address, phone number
• Account credentials: email and password (passwords are stored using industry-standard one-way hashing and are never stored in plain text)
• Project-related information: property addresses, project names, and notes associated with photography sessions
• Communication data: messages and correspondence sent through the Service

2.2 Information Collected Automatically

When you access the Service, we may automatically collect:

• Usage data: pages visited, features used, download activity, and gallery viewing history
• Device information: browser type, operating system, and device identifiers
• Log data: IP addresses, access times, and referring URLs
• Session data: cookies and session identifiers used to maintain your login state

2.3 Payment Information

When you make a payment through the Service, your payment information (credit card numbers, bank account details) is collected and processed directly by our third-party payment processor, QuickBooks Payments (Intuit Inc.). We do not receive, store, or have access to your full payment card or bank account numbers. We receive only transaction confirmation data such as payment status, amount, and date.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Create and manage your account
• Deliver photographs and project files to you
• Process invoices and facilitate payments
• Send transactional communications (gallery invitations, invoice notifications, password resets)
• Respond to your inquiries and provide customer support
• Monitor usage patterns to improve the Service
• Protect against unauthorized access and ensure security
• Comply with legal obligations

We do not sell your personal information. We do not use your information for behavioral advertising or profiling.

4. How We Share Your Information

We may share your information only in the following circumstances:

4.1 Third-Party Service Providers

We use trusted third-party services to operate the platform. These providers have access to your information only as needed to perform their functions and are obligated to maintain its confidentiality:

• Amazon Web Services (AWS): Cloud infrastructure and secure image storage. Data is stored in the United States (us-east-1 region).
• QuickBooks Payments (Intuit Inc.): Invoice and payment processing. Subject to Intuit's Privacy Statement.
• Brevo (Sendinblue): Transactional email delivery (gallery invitations, invoice emails, password resets). Subject to Brevo's Privacy Policy.

4.2 Photography Companies

If you are a client of a photography company that uses Capture, the photographer or company that invited you has access to your contact information, gallery activity, and invoice data within their account. This access is necessary to deliver photography services to you.

4.3 Legal Requirements

We may disclose your information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption in transit via TLS/SSL (HTTPS) for all data transmitted between your browser and our servers
• Passwords hashed using Argon2id, a modern and secure one-way hashing algorithm
• Photos stored in Amazon S3 with access controlled by signed URLs that expire after a limited time
• Role-based access controls that limit data access to authorized personnel
• Regular security updates to our application framework and server infrastructure

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Cookies and Session Data

The Service uses essential cookies and session identifiers to:

• Maintain your authenticated session (keep you logged in)
• Remember your preferences within the application
• Protect against cross-site request forgery (CSRF) attacks

We do not use tracking cookies, advertising cookies, or third-party analytics cookies. The cookies we use are strictly necessary for the operation of the Service.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Service. Specifically:

• Account data: Retained for the life of your account and for a reasonable period afterward for record-keeping purposes
• Photographs: Retained according to our storage policies; galleries may be archived after project completion
• Invoice and payment records: Retained for a minimum of seven (7) years to comply with tax and accounting obligations
• Server logs: Retained for up to ninety (90) days for security and debugging purposes

You may request deletion of your account and associated personal data by contacting us (see Section 11). Note that we may retain certain information as required by law or for legitimate business purposes.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate personal information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Data portability: Request your data in a structured, commonly used format
• Opt-out: You may update your account settings or contact us to manage communications

To exercise any of these rights, please contact us using the information in Section 11.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will take steps to delete that information promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the email address associated with your account. The "Last updated" date at the top of this page indicates when the policy was most recently revised. Continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

Ellis Creek Photography LLC
2 Live Oak Ave
Charleston, SC 29407
Email: josh@elliscreekphotography.com
Phone: (843) 732-6111