Privacy Policy

HVR Photography
Oshawa, Ontario, Canada
Email: [email protected]
Phone: (647) 571-3324
WhatsApp (Ayra): (647) 571-3324
Website: hvrphotography.ca

We collect only what we need to provide photography services. Specifically:

• Contact details — your name, email address, phone number, WhatsApp number.
• Event details — date, location, service type, guest count, budget, and any notes you share.
• Portal account data — if you register for our client portal: email, display name, phone, password (stored hashed by Firebase Authentication), and optional company name.
• Communication — messages you send us on WhatsApp, through the website chat, through the portal, or via email, including any voice messages (audio is transcribed by our AI assistant to respond to you).
• Project artifacts — photos and videos we deliver to you, stored securely in our Google Drive or Vercel Blob storage and shown to you through our portal.
• Payment — we do not store credit card numbers. Interac e-Transfer payments are processed through your bank. If Stripe is enabled on your invoice, Stripe collects and stores card data under their own privacy policy.
• Technical data — minimal server logs (IP address, user agent, timestamps) for security and debugging, retained 30 days.

• To provide photography services you've booked.
• To communicate with you about your inquiry, booking, quote, invoice, or delivery — via email, WhatsApp, and the portal.
• To send booking confirmations, payment receipts, delivery notifications, and status updates (transactional emails).
• To send occasional marketing emails, only if you have an existing business relationship with us (implied consent under CASL) or have explicitly opted in. Every marketing email includes a one-click unsubscribe link.
• Our WhatsApp AI assistant ("Ayra") reads messages you send us and replies on our behalf. Ayra uses third-party AI services (Groq and Google Gemini) to process the text of your messages; those services do not retain your data for training. Voice messages are transcribed by Groq's Whisper model.
• To improve our services — looking at aggregated usage patterns, not individual profiles.

We rely on the following processors. Each has their own privacy policy and security commitments:

• Google Firebase — authentication, Firestore database, and hosting-adjacent services. (policy)
• Vercel — website hosting and serverless functions. (policy)
• Meta / WhatsApp Business Cloud API — client communication on WhatsApp. (policy)
• Google — Calendar (event scheduling), Gmail (email sending), Drive (photo/video delivery storage). (policy)
• Resend — transactional and marketing email delivery. (policy)
• Groq — AI text generation and voice transcription for the Ayra assistant. (policy)
• Google Gemini — fallback AI text generation for Ayra. (policy)
• Stripe (optional, per-invoice) — card payment processing. (policy)
• Instagram Graph API (when configured) — to display our public portfolio feed on this site. (policy)

Most of these processors are based in the United States. By using our service you acknowledge that your personal information may be processed outside of Canada, subject to protections under each provider's policy and contractual safeguards.

• Inquiry and project records: retained for 7 years to comply with Canadian tax recordkeeping rules.
• Photos and videos we deliver: kept in our Google Drive indefinitely unless you request deletion.
• WhatsApp conversation history: retained for as long as the relationship is active; you can ask us to purge your conversation at any time.
• Portal account data: deleted on request (see "Deletion" below).
• Server logs: automatically purged after 30 days.
• Unsubscribed email addresses: retained on a suppression list indefinitely so we don't accidentally contact you again.

Under PIPEDA you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Withdraw consent (subject to legal or contractual obligations).
• Request deletion of your data — see the Data Deletion page.
• File a complaint with the Office of the Privacy Commissioner of Canada: priv.gc.ca.

To exercise any of these, email us at [email protected]. We respond within 30 days.

We protect your data through: TLS encryption for all web traffic, hashed passwords (never stored in plaintext), authenticated and access-controlled storage, server-side signature verification on webhooks, and the principle of least privilege for internal access. No system is 100% secure; we'll notify affected users promptly of any breach that puts personal information at risk.

Our services are not directed at children under 18. We photograph children at events only under a contract with their parent or guardian, who has the right to request deletion of any images.

We use strictly necessary cookies set by Firebase Authentication to keep you signed in to the portal. We do not use third-party advertising cookies, behavioural tracking pixels, or cross-site analytics. Basic server-side analytics (counts of page views) are fully anonymous.

We may update this policy occasionally — the "Last updated" date at the top will change when we do. For material changes, we'll email active clients.

Questions, concerns, or requests about your data: email [email protected] or message us on WhatsApp at (647) 571-3324.