Privacy Policy

Introduction

This Privacy Policy explains how Kronstadt-Image photo studio collects, uses, discloses, and safeguards your information when you use our photo studio booking service and website. We are committed to protecting your privacy and complying with GDPR (General Data Protection Regulation) and Romanian data protection laws.

Information We Collect

We collect the following personal information when you use our services:

• Personal identification: Full name
• Contact information: Email address and phone number
• Booking details: Selected date, time slot, session duration, number of people, and photobook selections
• Payment information: Prepayment confirmation details and remaining balance records (payments processed via WhatsApp coordination)
• Technical data: IP address, browser type, device information, and user agent for security, fraud prevention, and abuse detection
• Additional information: Special requests, notes, or preferences you provide during booking or contact form submissions
• Account data: If you create an account, we store your login credentials and authentication tokens (hashed passwords, OAuth tokens from Google)

How We Use Your Information

• Process and confirm your photo studio booking reservations
• Send booking confirmations, payment instructions, and reminders via email (using Resend email service)
• Coordinate payment arrangements via WhatsApp (manual payment processing)
• Contact you regarding your booking, session details, or service inquiries
• Prevent fraudulent bookings and abuse through rate limiting, IP tracking, and security measures (max 3 pending bookings per IP per 24 hours)
• Automatically cancel expired unpaid bookings (bookings not paid within 4 hours)
• Manage your user account and authentication (NextAuth with Google OAuth support)
• Respond to contact form submissions and customer inquiries
• Improve our services, website functionality, and user experience
• Comply with legal and regulatory obligations

Data Sharing and Third Parties

We share your information only with the following trusted service providers necessary for our operations:

• Resend: Email service provider for sending booking confirmations, payment instructions, and account-related emails
• WhatsApp (Meta): For coordinating payment arrangements and booking-related communications
• Google OAuth: If you choose to sign in with Google, we receive basic profile information (name, email) from Google
• Prisma ORM with PostgreSQL: Your data is securely stored and managed through Prisma ORM in our PostgreSQL database
• We do NOT sell, rent, or trade your personal information to any third parties
• We only share data necessary for service delivery, security, and legal compliance

Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this policy, including legal, accounting, and reporting requirements. Booking data is retained for 3 years after your session date for accounting and tax compliance. Account data is retained until you request account deletion. You may request deletion of your data at any time by contacting us or using the account deletion feature, subject to legal retention requirements.

Your Rights Under GDPR

Under GDPR and Romanian data protection laws, you have the following rights regarding your personal data:

• Right to access: Request a copy of all personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure ('right to be forgotten'): Request deletion of your data when no longer necessary
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format (JSON/CSV)
• Right to object: Object to certain types of processing, including marketing communications
• Right to withdraw consent: Withdraw your consent at any time for consent-based processing
• Right to lodge a complaint: File a complaint with the Romanian data protection authority (ANSPDCP)

Data Security

We implement industry-standard technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Our security measures include: HTTPS/SSL encryption for all data transmission, secure password hashing (bcrypt), HTTP-only cookies for session management, rate limiting and IP-based abuse detection, automated cleanup of expired bookings, and secure database access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Contact Us

For any questions about this Privacy Policy, to exercise your data protection rights, or to request data deletion, please contact us using the contact form on our website or via the email/phone information provided in the footer. We will respond to your request within 30 days as required by GDPR.