Privacy Policy

What we collect

• Booking details: your name, email, optional phone number and notes, and your session details.
• Payment records: the amount, any refunds and Stripe's payment reference. Card details go straight to Stripe; we never see or store them.
• Your agreement to our Terms: the date and version.
• Site usage: visit statistics collected with Matomo, analytics we host ourselves: pages viewed, time on page, links followed, the steps you take while booking (for example picking a time or opening payment, never your name or contact details), the amount of completed bookings, browser and device type, and approximate location. Your IP address is shortened before it's stored. This data stays on our own server; it isn't sold or shared with advertisers.
• Abuse protection: Google reCAPTCHA runs on our pages and looks at your browser and how you use the site, so that when you continue to payment it can tell people from bots. We also use your IP address to limit repeated attempts.
• Cookies: studio_hold, used during checkout so you don't open two payments by accident (expires after one hour). Our analytics sets first-party cookies to recognize a returning visit: _pk_id (13 months), _pk_ses (30 minutes) and _pk_ref (6 months, only when you arrive from another site). They're used only for our own statistics. When the payment form opens, Stripe sets __stripe_mid (1 year) and __stripe_sid (30 minutes) to help prevent fraud. Google reCAPTCHA may set its own when you visit. You can clear or block cookies in your browser at any time; the site still works.

How we use it

To run and take payment for your booking, contact you about it, deliver your recordings, handle refunds and disputes, meet legal and accounting obligations, and understand how the site is used. We don't sell your information or use it for advertising.

Who receives it

• Stripe processes payments and receives your email and session details (Stripe's privacy policy).
• Google stores recordings we share with you through Google Drive, runs reCAPTCHA on our pages, and provides the map, which loads from Google when you view the page (Google's privacy policy).
• Our hosting provider runs the servers that store your booking and our analytics.
• Authorities, only where the law requires it.

How long we keep it

• Unfinished checkouts: deleted after 30 days.
• Your name, email, phone and notes: erased 180 days after your session, which leaves time to resolve card disputes. We keep the payment record for accounting and tax.
• Recordings: deleted from Google Drive 30 days after your session.
• Database backups: deleted after 30 days.
• IP addresses used for rate limits: held in memory only, never saved, and gone within 24 hours.

Do Not Track

We honor Do Not Track: if your browser sends it, our analytics doesn't record your visit or set its cookies. We don't track you across other websites. The embedded Google Map is Google's service and follows Google's policy.

Your choices

Email hello@example.com to see, correct or delete your information. We'll do so unless we need it for an upcoming session, an open refund or dispute, or a legal obligation.

Staff accounts

Studio staff sign in with Google. We use their Google profile to identify them and their Google Calendar access only to add and update booking events. Access tokens are stored encrypted and revoked when a staff member is removed.

Children

Our services aren't directed at children under 13. Minors should book through a parent or guardian.

Changes

We'll post any changes here with a new effective date.