Privacy Policy

Who we are

Elite Captures, doing business as Elite Captures (“we”, “us” or “our”), is a photography and videography company. We serve clients across the United States.

This Privacy Policy explains what personal information we collect, how we use and share it, how long we keep it, how we protect it, and the choices and rights you have. “Personal information” means information that identifies you or can reasonably be linked to you.

We are responsible for the personal information described in this policy. You can contact us about privacy at any time:

• Email: privacy email
• Mail: [business address]
• Phone: [business phone]

What this policy covers

This policy applies to personal information we collect through:

• our website at https://elitecapturesny.com, including the inquiry form;
• the client portal and the crew portal;
• our Elite Captures app for iPhone, iPad and Android;
• email, phone calls and other messages you exchange with us; and
• our photography and film services, before, during and after a shoot or event.

It does not cover websites, apps or services run by other companies, even when we link to them. That includes social media platforms where we post our work and Stripe’s payment pages. If a gallery link we send you opens a service run by another company, that company’s privacy policy also applies. When a business client gives us information about its employees, customers or guests, we use it to perform our agreement with that business, and the business’s own privacy policy may also apply.

Information we collect

Information you give us

• Inquiries. Our inquiry form asks for your name, email address, the service you are interested in, the location and a message. You may also give us your event or shoot date (and whether it is flexible), phone number, company or organization, approximate budget, guest or attendee count, how you heard about us, and whether you prefer email or phone.
• Client portal. If you have a client portal account, you sign in with your email address and a password. The portal holds your proposals, agreements, invoices, payment records, documents and links to your galleries, along with files you upload, such as mood boards, timelines and family photo lists.
• Project details. To plan and deliver your project, we collect details such as your mailing address, the names and roles of the people involved, schedules, venue and vendor contacts, shot lists and special requests.
• Signatures. Proposals, agreements and releases are signed with our own built-in electronic signing system. When you sign, it records your name, email address, typed or drawn signature, the date and time, your IP address, your browser’s user agent (a short description of your browser and device) and a fingerprint (hash) of the document. Sometimes we email you a one-time code to confirm your identity before you sign. Together these details form a signing certificate that shows who signed what, and when.
• Payments. Stripe processes our card and bank payments. You enter your payment details with Stripe, and we never see or store full card numbers. Stripe tells us the payment status, the last four digits of your card or bank account, the card brand, and the billing details you give Stripe, such as your name, email and billing address.
• Crew information. Photographers and videographers who work with us give us their name, contact details and availability, the payment details they choose to provide for payouts, and tax forms such as IRS Form W-9, which include a taxpayer identification number (such as a Social Security number or employer identification number). The crew portal also holds their assignments.
• Messages. When you email, call or message us, we keep what you tell us.

Information about other people. If you give us details about other people, such as a family photo list, wedding party names or vendor contacts, please share only what we need and only when you are allowed to share it. We use it only for your project.

Information collected automatically

• Sign-in and security records. When you sign in to a portal, we record the IP address and browser user agent for your session and the time of your last sign-in. Our systems keep audit logs of key actions, such as signing documents and recording payments.
• Our app. When you sign in to our app, we record the device name and platform (for example, “iPhone” and “iOS”) so you can see where you are signed in, and your sign-in is kept on that device in its secure storage (the iOS Keychain or Android Keystore). If you turn on notifications, we store a push token issued by Apple or Google so we can send the notifications you choose, and you can switch each kind off in the app. Face ID, Touch ID and fingerprint unlock happen entirely on your device, and we never receive biometric data. The app contains no advertising, analytics or tracking software.
• Spam protection. When you send an inquiry, we store a one-way hashed version of your IP address and your browser user agent, to block spam and repeated automated submissions.
• Server logs. Our hosting provider keeps standard technical logs of requests to our website and portals, such as IP address, date and time, the page requested, browser type and errors. We use them to run, secure and fix our systems.
• Cookies and local storage. We use a few cookies to keep you signed in, remember your light or dark mode choice and show confirmation messages. We do not use advertising cookies, third-party analytics, social media pixels or cross-site tracking. Our Cookie Policy lists every cookie we use.
• Email delivery events. Our email delivery provider tells us whether an email was delivered, bounced or marked as spam, so we can correct addresses and stop sending to addresses that do not work. We do not use tracking pixels in marketing emails.

Information from others

• The person who booked us. If you are a guest, family member, member of a wedding party, employee or other participant at a shoot or event, the client who booked us may give us your name, role, contact details or other details we need, such as a family photo list or a schedule.
• Planners, venues and other vendors. Planners, venues and other vendors may share schedules, logistics and contact details with us so we can coordinate.
• Referrals. A past client, vendor or friend may give us your name and contact details when they refer you to us.
• Service providers. Stripe tells us the status of payments and the billing details described above, and our email delivery provider tells us about deliveries, bounces and spam complaints. App notifications are delivered through Expo’s push service, Apple Push Notification service and Google’s Firebase Cloud Messaging, which receive the push token and the notification text.

Images and video of you

Our work produces photographs and film, including video, audio and any drone footage (together, “Images”). Images show our clients and often guests, family members, attendees, employees, performers and members of the public who are present at a wedding, event or shoot. An Image of an identifiable person is personal information.

We make Images to deliver the project the client booked. Images are our work product, and the client’s agreement governs how they are delivered and used.

Portfolio use. We show selected Images on our website, on our social media accounts and in our portfolio only as the client’s agreement allows. We do not use an identifiable person’s Image in paid advertising without that person’s written permission (or a parent’s or guardian’s, for a minor).

Minors. We photograph and film minors only with the involvement of a parent or guardian, for example at a session a parent booked or at an event a child attends with family. We do not feature a minor as the main subject of a portfolio Image without a parent’s or guardian’s permission.

Asking us to remove an Image. If you appear in an Image on our website or social media accounts and want it taken down, email privacy email with a link or screenshot, and tell us whether you are the person shown or the parent or guardian of a child shown. You do not need to give a reason. We will remove the Image from our website and our own social media accounts, normally within 10 business days, and confirm when it is done. We cannot remove copies that other people have saved or reposted, or Images a client has posted on their own accounts, but we will tell you who to contact if we know. Removing an Image from our website and social media does not remove it from the gallery delivered to the client who booked us, which the client’s agreement governs.

How we use information

We use personal information to:

• reply to inquiries, check availability and prepare proposals;
• plan, schedule, photograph, film, edit and deliver the services a client books;
• set up and run client and crew portal accounts;
• prepare agreements, collect electronic signatures and keep signing certificates as a record of what was signed;
• send invoices, take payments and issue refunds through Stripe, and keep financial records;
• send transactional messages about inquiries, projects, assignments, documents, payments and accounts;
• assign crew, give them the project details they need, pay them and meet tax reporting duties, such as filing IRS Form 1099-NEC;
• show our work in our portfolio, on our website and on social media as client agreements allow;
• send marketing emails to people who have agreed to receive them;
• learn how people find us from the optional “how did you hear about us” answer, and improve our services;
• protect our website, systems, clients and crew, including preventing spam, fraud and unauthorized access;
• comply with the law, respond to lawful requests, and establish, exercise or defend legal claims; and
• meet any other purpose we tell you about when we collect the information, with your consent where the law requires it.

We do not use personal information for profiling that produces legal or similarly significant effects, and we do not make decisions about you based solely on automated processing.

How we share information

We share personal information only as described below.

• Service providers. Companies that provide our cloud hosting, managed database, file storage, email delivery (currently Resend) and payment processing (Stripe) handle personal information for us under written contracts. They may use it only to provide their services to us, keep those services secure and meet their legal duties. Stripe also processes payment information under its own privacy policy, available at stripe.com/privacy, including to prevent fraud.
• Crew assigned to your project. Photographers and videographers working on a project receive the details they need for the work, such as names, contact details, schedules, locations and shot lists. Their agreements with us require them to keep this information confidential and use it only for the project.
• Other vendors, at your direction. We share details with your planner, venue or other vendors when you ask us to coordinate with them.
• Professional advisors. We may share information with our lawyers, accountants and insurers, who must keep it confidential, when we need their advice or services.
• Legal requests and safety. We may disclose information when we believe in good faith that the law requires it, such as to respond to a subpoena or court order, or when needed to protect the rights, property or safety of our clients, crew, the public or us.
• Business transfers. If we are involved in a merger, acquisition, reorganization or sale of all or part of our business, personal information may transfer to the new owner, who must protect it as this policy describes. We will tell you before your information becomes subject to a different privacy policy.
• At your request or with your consent. We share information when you ask us to, for example by sending Images or documents to a family member, a venue or a publication you name.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising (targeted advertising). We do not let advertising networks or data brokers collect information through our website.

How long we keep information

We keep personal information only as long as we need it for the purposes in this policy. When a period ends, we delete the information or de-identify it so it can no longer be linked to you.

We may keep information longer when the law requires it, or when we need it to resolve a dispute, enforce an agreement or respond to a legal claim, and then only for as long as that need lasts.

How we protect information

We use reasonable safeguards for the information we hold, including:

• encryption in transit (HTTPS) for our website and portals;
• passwords stored only as hashes, never in readable form;
• access controls that limit each person to the information their role requires;
• audit logs of key actions;
• private file storage, with documents and media available only through signed links that expire; and
• one-time codes sent by email to confirm identity before some signatures.

No system is perfectly secure, and we cannot promise that information will never be accessed, disclosed or lost without permission. Please keep your password private and tell us right away if you think someone else has used your account. If a security incident affects your personal information, we will notify you and the authorities as the law requires.

Children’s privacy

Our website and portals are not directed to children under 13. We do not knowingly collect personal information online from children under 13, consistent with the Children’s Online Privacy Protection Act (COPPA). Inquiries, bookings and portal accounts are for adults.

If you believe a child under 13 has given us personal information through our website or portals, email [privacy email] and we will delete it. Images of minors taken at sessions and events are covered under “Images and video of you” above.

Your privacy rights

Many states give their residents rights over their personal information. We extend the following rights to all US residents, whether or not a state law requires us to:

• Access. Confirm whether we hold your personal information and get access to it, including the categories we hold, where it came from, why we use it, and the categories of third parties we disclose it to (or, where your state’s law provides, a list of those specific third parties).
• Correction. Correct personal information that is inaccurate.
• Deletion. Delete personal information we hold about you, including information you gave us and information we received from others. If you have a client or crew account, you can close it yourself in our app or on the website; our account deletion page explains how.
• Portability. Get a copy of your personal information in a portable and readily usable format.
• Opt out. Opt out of the sale of your personal information, its sharing for cross-context behavioral advertising, targeted advertising, and profiling that produces legal or similarly significant effects. We do none of these, but you may still submit an opt-out request and we will record it.
• Withdraw consent. Where we rely on your consent, such as for marketing emails, withdraw it at any time.

These rights have limits. We may keep information where the law allows, for example to complete a service or contract, to keep tax and financial records, to protect security, to comply with the law, or to establish or defend legal claims. If you appear in Images from a client’s project, we will remove them from our portfolio, website and social media on request, but we may not be able to delete them from the client’s delivered project or from copies the client already has. If we cannot fully meet a request, we will tell you what we kept and why.

How to make a request

Email privacy email with the subject “Privacy request”, or call us at [business phone]. Tell us which right you want to use, and give your name and the email address or phone number you used with us. You do not need an account to make a request.

How we verify requests

To protect your information, we verify requests to access, correct, delete or copy it before we act. We match information you give us with information we already hold, such as your email address, phone number and project details. If you have a portal account, we may ask you to confirm the request from that account. For a copy of specific pieces of information, or to delete sensitive records, we may ask for more matching details. We use information you give us for verification only for that purpose. Opt-out requests do not need verification, although we may ask for enough detail to find your records.

Authorized agents

You may ask an authorized agent to make a request for you. The agent must give us written permission signed by you. Unless the agent holds a valid power of attorney, we may also ask you to verify your identity with us directly or to confirm that you gave the permission. A parent or guardian may make a request for their minor child.

Our response

We will confirm that we received your request within 10 business days and respond within 45 days. If we need more time, we may extend this once by up to 45 more days, and we will tell you why within the first 45 days. Requests are free. If requests from the same person are clearly unfounded, excessive or repetitive, we may decline them or charge a reasonable fee where the law allows, and we will explain why.

Appeals

If we decline all or part of your request, we will explain why. You may appeal by replying to our decision or by emailing [privacy email] with the subject “Privacy appeal”. We will review the decision and tell you in writing, within 45 days of receiving your appeal, what we did or did not do and why. If we deny your appeal, we will tell you how to contact your state attorney general to submit a complaint, where your state’s law gives you that right.

No discrimination

We will not deny you services, charge you a different price, give you a different level or quality of service, or retaliate against you as a client or crew member because you used your privacy rights. We do not offer financial incentives in exchange for personal information.

California residents

This section applies to California residents and adds to the rest of this policy. It is our notice at collection under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”).

Personal information we collect. In the last 12 months, we have collected the categories of personal information below. We keep each category for the periods in “How long we keep information” above.

No sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

Sensitive personal information. We use and disclose sensitive personal information only for purposes the CCPA permits, such as providing the services you request, keeping accounts secure and meeting legal duties, and never to infer characteristics about you. Because of this, California law does not require us to offer a right to limit its use.

Your rights. California residents have the rights described in “Your privacy rights”, including the rights to know, delete and correct personal information and to opt out of its sale or sharing, and the right not to be discriminated or retaliated against for using these rights. Use the process described there to make a request, including through an authorized agent.

Shine the Light. California Civil Code § 1798.83 lets California residents ask, once a year, what personal information a business disclosed to third parties for those third parties’ own direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. You may still send this request to [privacy email].

Other state privacy laws

Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island have comprehensive consumer privacy laws. Residents of these states have the rights described in “Your privacy rights”, including the right to appeal our decision on a request.

The table in the California section describes, for residents of every state, the categories of personal information we process, why we use them and who receives them. If your state’s law gives you an additional right or protection that applies to us, we will honor it.

Nevada residents

Nevada law (Chapter 603A of the Nevada Revised Statutes) lets Nevada consumers direct a website operator not to sell certain covered information. We do not sell covered information as Nevada law defines it. You may still submit an opt-out request to [privacy email], and we will record it.

Global Privacy Control and Do Not Track

Global Privacy Control (GPC) is a setting in some browsers and browser extensions that tells websites you want to opt out of the sale and sharing of your personal information. We treat a GPC signal as a valid request to opt out of sale, sharing and targeted advertising, for that browser and for any account or records we can link to it. We already do none of these things, so the signal confirms your choice rather than changing how the website works.

Do Not Track is an older browser setting. There is no common standard for how websites should respond to it, so we treat GPC as the opt-out signal we follow. Our website does not track you across other websites, and we do not allow other companies to collect information about your activity across websites through our website. Stripe’s checkout page, where you pay, sets its own cookies for fraud prevention under Stripe’s policies.

Email communications

• Transactional messages. We email you about your inquiry, project, assignments, documents, signatures, invoices, payments, account and security. You cannot opt out of these while you have an active project with us, because they are part of the service.
• Marketing. We send marketing emails, such as news, offers or available dates, only if you have agreed to receive them. Every marketing email includes our postal address and a one-click unsubscribe link, and we process unsubscribe requests promptly, within the 10 business days the federal CAN-SPAM Act allows.
• Text messages. We do not send marketing text messages. If you give us your phone number, we use it only to contact you about your inquiry or project.

International visitors

Our services are offered in the United States, and our website is intended for people in the United States. We store and process personal information in the United States, using hosting, database and file storage providers located there. If you contact us from another country, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live.

Changes to this policy

We may update this policy when our practices or the law change. We will post the updated policy on this page with a new “Last updated” date. If we make a material change, we will also email clients and crew who have an active project or portal account before the change takes effect. We will not use personal information we already hold in a materially different way without telling you first and getting your consent where the law requires.

Contact us

For questions about this policy, or to make a privacy request, contact:

• Elite Captures, doing business as Elite Captures
• Email: privacy email
• Mail: [business address]
• Phone: [business phone]