Privacy Policy

1. Introduction

This Privacy Policy explains how Bhagvat Daraji ("Photographer," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with the photography portfolio website operated by the Photographer (the "Site").

This Policy is published in accordance with the California Online Privacy Protection Act (Cal. Bus. & Prof. Code § 22575 et seq.) and applies to all visitors, customers, and booking clients.

It should be read together with the Terms of Use and the Photography, Media Credentials, Copyright & Public Event Notice ("Photography Notice"). Photographs of individuals are addressed both here (Section 8) and, more fully, in the Photography Notice.

Contact: bhagvatdaraji1@gmail.com

---

2. Information We Collect

2.1 Information you provide directly

We do not ask for, and you should not send us, government identification numbers, Social Security numbers, health information, or other sensitive personal information.

2.2 Information collected automatically

When you visit the Site, certain information is collected automatically by our hosting provider, analytics tools, and similar technologies:

• IP address and approximate location derived from it (city or region level)
• Browser type and version, operating system, and device type
• Referring URL and exit pages
• Pages viewed, galleries opened, time on page, and click behavior
• Date and time of access
• Cookie and similar identifiers

2.3 Information from third parties

• Stripe provides us with transaction confirmations, the last four digits of a payment card, card brand, billing name and address, and fraud-related signals. Stripe does not provide us with your full card number, expiration date, or security code.
• Analytics providers provide aggregated and pseudonymous statistics about Site usage.
• Our gallery or hosting platform may provide operational logs and delivery statistics.

2.4 Information we do not collect

• We do not collect biometric identifiers. Facial-recognition, face-grouping, and automated face-tagging features are not enabled on this Site. If we ever enable such a feature, this Policy will be updated in advance and appropriate consent will be obtained where required by law, including under the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, and comparable statutes.
• We do not knowingly collect personal information from children under thirteen (13). See Section 12.
• We do not sell or share personal information for cross-context behavioral advertising. See Section 13.

---

3. Cookies and Similar Technologies

3.1 The Site uses cookies and similar technologies for the following purposes:

3.2 We do not use advertising, retargeting, or cross-site tracking cookies.

3.3 — How to control cookies. Most browsers allow you to refuse or delete cookies through their settings. Disabling strictly necessary cookies may prevent checkout from working. If we use Google Analytics, you may also install the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.

3.4 — Do Not Track. Web browsers may transmit a "Do Not Track" signal. There is currently no uniform industry standard for responding to such signals. The Site does not currently respond to Do Not Track signals. We do not track users across third-party websites, and we do not permit third parties to do so through the Site.

3.5 — Global Privacy Control. Because we do not sell or share personal information, there is no sale or sharing to opt out of. We nonetheless honor Global Privacy Control (GPC) signals as an opt-out request where applicable law requires.

---

4. How We Use Personal Information

We use personal information for the following purposes:

1. To operate the Site — hosting, displaying galleries, maintaining security, and diagnosing problems.
2. To fulfill orders — processing payment, producing and shipping prints, delivering digital downloads, and providing order support.
3. To respond to inquiries — answering questions, providing quotes, and scheduling sessions.
4. To provide photography services — planning, delivering, and invoicing commissioned work.
5. To handle image removal requests — verifying the requester's relationship to a depicted individual and acting on the request (Section 14 of the Photography Notice).
6. To handle copyright complaints — processing notices and counter-notices under 17 U.S.C. § 512.
7. To improve the Site — analyzing aggregate usage.
8. To prevent fraud and abuse — detecting fraudulent orders, chargebacks, scraping, and unauthorized access.
9. To meet legal and accounting obligations — tax records, business records, and responding to lawful requests.

We do not use personal information for automated decision-making that produces legal or similarly significant effects, and we do not build advertising profiles.

---

5. Legal Bases (for visitors in the EEA and UK)

Where the GDPR or UK GDPR applies, we rely on:

• Contract — to fulfill orders and provide services you request;
• Legitimate interests — to operate and secure the Site, prevent fraud, understand aggregate usage, and pursue documentary and journalistic photography, balanced against your rights and freedoms;
• Legal obligation — to meet tax, accounting, and legal-process requirements; and
• Consent — where you provide it, for example for non-essential cookies or a published testimonial. You may withdraw consent at any time.

---

6. Payment Processing

6.1 Payments are processed by Stripe, Inc. We do not receive, transmit, process, or store full payment card numbers, expiration dates, security codes, or bank account credentials. Card data is transmitted directly from your browser to Stripe.

6.2 Stripe acts as an independent controller of the payment data it collects and processes it in accordance with Stripe's own privacy policy, available at stripe.com/privacy. Stripe may use that data for fraud prevention and for its own compliance obligations.

6.3 Stripe is a PCI-DSS Level 1 certified service provider.

6.4 We retain order records — including your name, email, shipping address, order contents, amount, and the last four digits of the card used — for accounting, tax, warranty, and dispute-resolution purposes. See Section 10.

---

7. How We Share Personal Information

We do not sell personal information. We disclose it only as follows:

Service providers are permitted to use personal information only to perform services for us, and not for their own independent purposes, except where they act as independent controllers (as Stripe does).

---

8. Photographs and Personal Information

8.1 A photograph of an identifiable person can constitute personal information under some privacy laws. Photographs displayed on the Site are created and published under the framework described in the Photography Notice, which is the controlling document for image-related rights.

8.2 We collect photographic images at events in the circumstances described in Sections 3 through 7 of the Photography Notice.

8.3 Location metadata (including GPS EXIF data) is removed from photographs before publication.

8.4 We do not publish, alongside a photograph, an individual's contact information, home address, date of birth, or comparable identifying details. Where a name appears in a caption, it is drawn from information already publicly announced in connection with the event.

8.5 Removal requests. Any depicted individual, or the parent or legal guardian of a depicted minor, may request removal, restriction, or modification of a photograph by writing to bhagvatdaraji1@gmail.com with the subject line Image Removal Request. The full procedure, verification process, and response timelines are in Section 14 of the Photography Notice.

8.6 Because photographs also carry journalistic, documentary, artistic, and copyright interests, a request to erase a photograph is evaluated against the exemptions applicable law provides for freedom of expression, journalism, and artistic expression, and against our need to retain records for legal and accounting purposes. We nonetheless act on reasonable requests as a matter of policy, as described in the Photography Notice.

---

9. Security

9.1 We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including HTTPS/TLS encryption in transit, access controls on accounts and archives, and reliance on PCI-compliant processors for payment data.

9.2 No method of transmission or storage is completely secure. We cannot guarantee absolute security, and you transmit information to us at your own risk.

9.3 Email is not a secure channel. Do not send sensitive personal information by email.

9.4 If a breach affecting your personal information occurs, we will notify affected individuals and applicable authorities as required by law, including Cal. Civ. Code § 1798.82.

---

10. Data Retention

We keep personal information only as long as necessary for the purposes described in this Policy:

When a retention period ends, information is deleted or de-identified.

---

11. Your Rights

Subject to applicable law and to verification of your identity, you may:

• Access — request a copy of the personal information we hold about you;
• Correct — request correction of inaccurate information;
• Delete — request deletion, subject to the exceptions below;
• Opt out — of marketing communications at any time;
• Portability — request a copy in a portable format, where applicable law provides;
• Withdraw consent — where processing is based on consent; and
• Non-discrimination — exercise these rights without receiving inferior service or pricing.

How to exercise. Email bhagvatdaraji1@gmail.com with the subject line Privacy Request. We will acknowledge within 10 business days and respond substantively within 45 days, extendable once by a further 45 days where permitted, with notice to you.

Verification. We will ask you to provide information sufficient to match you to our records — typically the email address used for an order or inquiry. We will not request a government identification number. An authorized agent may act on your behalf with written authorization.

Exceptions. We may decline a request where retention is required for tax, accounting, legal-claim, fraud-prevention, or security purposes, or where the request concerns photographic works protected by exemptions for journalism, artistic expression, or freedom of expression. If we decline, we will tell you why.

---

12. Children's Privacy

12.1 The Site is not directed to children under thirteen (13), and we do not knowingly collect personal information from them, consistent with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506.

12.2 Purchases and bookings require a person aged eighteen (18) or older.

12.3 Photographs are different from account data. The Site displays photographs of individuals including minors, taken at public-facing events. That is addressed in the Photography Notice, not in this section, which concerns information collected from users of the Site.

12.4 If we learn that we have collected personal information from a child under thirteen through a form, message, or account, we will delete it promptly. A parent or guardian who believes this has occurred should contact bhagvatdaraji1@gmail.com.

12.5 Parents and guardians may exercise removal rights on behalf of a depicted minor under Section 14 of the Photography Notice.

---

13. California Privacy Rights

13.1 — CalOPPA. This Policy is provided in accordance with Cal. Bus. & Prof. Code § 22575 et seq. It identifies the categories of personal information collected (Section 2), the categories of third parties with whom it is shared (Section 7), how you may review and request changes (Section 11), how changes to this Policy are announced (Section 16), and its effective date (top of page).

13.2 — CCPA/CPRA. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, imposes obligations on businesses meeting specified thresholds. We do not currently meet those thresholds. Nonetheless, as a matter of policy, we extend the rights described in Section 11 — access, correction, deletion, portability, and non-discrimination — to California residents.

13.3 — No sale or sharing. We have not sold, and do not sell, personal information. We have not shared, and do not share, personal information for cross-context behavioral advertising. We do not sell or share the personal information of minors under sixteen (16).

13.4 — Sensitive personal information. We do not collect sensitive personal information as defined by the CPRA, and therefore do not use or disclose it for purposes requiring a right to limit.

13.5 — Shine the Light. Under Cal. Civ. Code § 1798.83, California residents may request information about disclosures of personal information to third parties for their direct-marketing purposes. We make no such disclosures. Requests may be sent to bhagvatdaraji1@gmail.com.

13.6 — Minors' removal right. Under Cal. Bus. & Prof. Code § 22581, a registered user under eighteen (18) who is a California resident may request removal of content they posted on the Site. The Site does not currently accept user-posted content; requests concerning photographs are handled under Section 14 of the Photography Notice.

---

14. Other U.S. State Privacy Rights

Residents of states with comprehensive privacy laws — including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others — may have rights to access, correct, delete, and obtain a portable copy of their personal information, and to appeal a denied request.

We extend the rights in Section 11 to all U.S. residents regardless of state. To appeal a decision, reply to our response with the subject line Privacy Appeal; we will respond within 45 days. If your appeal is denied, you may contact your state Attorney General.

We do not process personal information for targeted advertising, sale, or profiling in furtherance of decisions producing legal or similarly significant effects.

---

15. International Visitors

15.1 The Site is operated in the United States. If you access it from outside the United States, your information will be transferred to, stored in, and processed in the United States, where data-protection laws may differ from those in your jurisdiction.

15.2 By using the Site, you understand that your information will be processed in the United States.

15.3 Visitors in the EEA and UK may contact bhagvatdaraji1@gmail.com to exercise rights under the GDPR or UK GDPR, and may lodge a complaint with their local supervisory authority.

---

16. Changes to This Policy

We may update this Policy from time to time. The "Last Updated" date will reflect the most recent revision. Material changes will be announced on the Site before they take effect, and — where we hold your email address and the law requires it — by email. Continued use of the Site after a revision constitutes acceptance.

---

17. Contact

Bhagvat Daraji Email: bhagvatdaraji1@gmail.com