Privacy Policy

Last Updated: October 17, 2025

Welcome to Moment Mappers

At Moment Mappers, we respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and protect your data when you use our photography services.

1. Information We Collect

Personal Information

When you use our services, we collect:

• Name — To identify your photo session
• Email Address — To send you your photos and order confirmation
• Phone Number (optional) — For session coordination and SMS notifications (only if you opt in)
• SMS Consent — Whether you agreed to receive text message notifications
• Location Data — Where your photo session took place
• Session Date & Time — When your photos were taken
• Payment Information — Credit card details processed securely through Square/Stripe

Photos & Media

• Photographs — Images captured during your session
• Order Details — Number of photos, pricing, and delivery preferences

Technical Information

• Device Information — Browser type, operating system
• Access Logs — IP address, access times (for security purposes)

2. How We Use Your Information

We use your information to:

• Provide Our Service — Capture, process, and deliver your photos
• Process Payments — Handle transactions securely through Square
• Send Communications — Email your photos and order confirmations
• Improve Our Service — Analyze usage patterns and customer feedback
• Legal Compliance — Meet tax, accounting, and regulatory requirements
• Customer Support — Respond to your questions and requests

3. Data Retention & Deletion

Photos

• Retention Period: 60 days from order creation
• Automatic Deletion: Photos are automatically deleted from our servers after 60 days
• Early Deletion: You can request early deletion at any time (see Section 7)

Order Records

• What We Keep: Customer name, email, session details, and payment information
• Retention Period: Indefinitely for business, accounting, and tax purposes
• Why: Required by law for financial record-keeping (typically 3–7 years depending on jurisdiction)

4. How We Protect Your Information

We implement industry-standard security measures:

• Encryption — All data transmitted using SSL/TLS encryption
• Secure Storage — Photos stored on secure Supabase servers
• Access Controls — Limited employee access on a need-to-know basis
• Payment Security — Credit cards processed by PCI-compliant Square payment system (we never store full card numbers)
• Regular Security Audits — Ongoing monitoring and security updates

5. Third-Party Services

We use trusted third-party services to operate our business:

Supabase (Data Storage)

• Purpose: Store photos and order information
• Location: United States
• Privacy Policy: https://supabase.com/privacy

Square (Payment Processing)

• Purpose: Process credit card payments
• Location: United States
• Privacy Policy: https://squareup.com/us/en/legal/general/privacy

Email Service Providers (Resend)

• Purpose: Send order confirmations and photo delivery emails
• Information Shared: Email address, name, order details
• Privacy Policy: https://resend.com/legal/privacy-policy

SMS Service Provider (Twilio)

• Purpose: Send SMS notifications for photo orders (only if you opt in)
• Information Shared: Phone number, name, order notifications
• Privacy Policy: https://www.twilio.com/legal/privacy
• Note: Your phone number is only used to send you order notifications that you consented to receive

6. Your Privacy Rights

Depending on your location, you have the following rights:

Right to Access

Request a copy of the personal information we hold about you.

Right to Correction

Request corrections to inaccurate or incomplete information.

Right to Erasure (Right to be Forgotten)

Request deletion of your photos and, where legally permissible, your order information.

Right to Data Portability

Request a copy of your data in a machine-readable format.

Right to Object

Object to certain types of processing of your information.

Right to Withdraw Consent

Where we rely on consent, you can withdraw it at any time.

7. How to Delete Your Photos

Automatic Deletion

All photos are automatically deleted after 60 days.

Early Deletion Request

If you want your photos deleted before 60 days:

1. Email us: help@momentmappers.com
2. Subject line: "Photo Deletion Request"
3. Include: Your order ID or name and session date
4. Processing time: We will delete your photos within 30 days and send confirmation

8. International Users

Moment Mappers operates in the United States. If you are accessing our services from outside the U.S., please be aware that your information may be transferred to, stored, and processed in the United States where our servers are located.

By using our services, you consent to this transfer and processing.

9. Children's Privacy

Our services are not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately at help@momentmappers.com.

10. Cookies & Tracking

We use minimal cookies for essential functionality:

• Session Cookies — Keep you logged in during your visit
• Authentication Tokens — Secure your account access

We do not use advertising cookies or sell your data to advertisers.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes:

• We will update the "Last Updated" date at the top
• Significant changes will be communicated via email (if we have your email address)
• Continued use of our services after changes means you accept the updated policy

12. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your data under these legal bases:

• Contract Performance — To provide our photography services (Art. 6(1)(b) GDPR)
• Legal Obligation — To comply with tax and financial regulations (Art. 6(1)(c) GDPR)
• Legitimate Interest — To improve our services and prevent fraud (Art. 6(1)(f) GDPR)
• Consent — For marketing communications (where required by law)

13. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

Right to Know

Request information about the categories and specific pieces of personal information we've collected.

Right to Delete

Request deletion of your personal information (subject to legal exceptions).

Right to Opt-Out

We do not sell personal information, so there is nothing to opt out of.

Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

14. Data Breach Notification

In the unlikely event of a data breach that affects your personal information, we will:

• Notify affected users within 72 hours (where required by law)
• Inform you of what information was compromised
• Explain steps we're taking to resolve the breach
• Provide guidance on protecting yourself

15. Business Transfers

If Moment Mappers is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our website of any change in ownership or use of your personal information.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information:

17. Complaints & Regulatory Authority

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection authority.

For EU Users:

Find your local Data Protection Authority: https://edpb.europa.eu/about-edpb/board/members_en

For UK Users:

Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/

For California Users:

California Attorney General's Office: https://oag.ca.gov/contact/consumer-complaint-against-business-or-company

Summary

Thank you for trusting Moment Mappers with your precious memories.

This privacy policy is designed to comply with GDPR, CCPA, and other major privacy regulations. However, it should be reviewed by a legal professional to ensure full compliance with your specific business operations and jurisdiction.