Privacy Policy

Dammy5ive Photography ("we", "us", "our") is a professional photography studio operating in Saskatchewan, Canada, including Regina and Saskatoon. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website at dammy5ive.com or book a photography session with us.

We are committed to protecting your privacy and complying with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

We collect the following information when you submit a booking request:

• Full name
• Email address
• Phone number
• Preferred session date, time, and type
• Any notes or special requests you provide

We do not collect payment information directly through our website. Payments are processed separately via invoice.

We may also automatically collect limited technical data such as your IP address and browser type for security and analytics purposes.

We use your personal information to:

• Process and manage your booking request
• Send booking confirmations, reminders, and status updates by email
• Send invoices upon session completion
• Communicate with you about your session (date, location, preparation)
• Maintain accurate booking records for our studio operations
• Improve our website and services

We will not use your information for unsolicited marketing without your explicit consent.

By submitting a booking request, you consent to receiving transactional emails related to your booking, including: booking confirmation, status updates, session reminders, and invoice delivery. These emails are sent via Resend and are necessary to fulfill your booking.

You may opt out of non-essential communications at any time by contacting us at info@dammy5ive.com.

With your consent, booking information (your name, session date, time, and type) may be added to our team's Google Calendar to coordinate scheduling. This is used solely for internal scheduling purposes and is not shared with third parties.

Staff members connect their Google Calendar accounts using Google OAuth 2.0. We store only the OAuth refresh token required to create and manage calendar events on their behalf. We request only the minimum Calendar access scope necessary.

We do not sell, trade, or rent your personal information. We may share it with:

• Resend — our email delivery provider, to send transactional emails on our behalf
• Vercel — our hosting and storage provider, where booking data is securely stored
• Google — for calendar synchronisation via OAuth 2.0 (with staff consent)

All third-party providers are bound by their own privacy policies and applicable data protection legislation. We only share the minimum data necessary for each service.

We may disclose your information if required by law, court order, or regulatory authority.

We retain booking records for up to 3 years following your session date for accounting and dispute resolution purposes. After this period, records are securely deleted. You may request earlier deletion by contacting us (subject to any legal retention requirements).

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. Our admin panel is password-protected and hosted on secure infrastructure.

While we take security seriously, no method of electronic storage or transmission over the internet is 100% secure. We encourage you to contact us immediately if you suspect any unauthorised use of your information.

Under PIPEDA, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Withdraw consent to the use of your personal information (subject to legal restrictions)
• Request deletion of your personal data
• File a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, contact us at info@dammy5ive.com. We will respond within 30 days.

Our website uses only a single session cookie to maintain your admin login state. We do not use tracking cookies, advertising cookies, or third-party analytics cookies that identify you personally.

Our services are not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has submitted information through our website, please contact us and we will promptly delete it.

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a revised "Last updated" date. Continued use of our website or services after changes constitutes acceptance of the updated policy.

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us: