Privacy Policy

Who We Are

SA Picture Day (“we”, “us”, “our”) operates the Booksa booking portal at booksa.sapicture.day. This policy explains what data we collect when you book a photo session or purchase prepay credits, how we use it, and who we share it with.

Contact: support@sapicture.day

Legal Basis for Processing

We collect and process your personal data because it is necessary to fulfill the booking contract you enter into with us when you reserve a session or purchase prepay credits. Without this information we cannot confirm your booking, deliver credit codes, or provide customer support. All data collected is limited to what is strictly necessary for these purposes.

Data We Collect

• Guardian information: first name, last name, email address, phone number
• Child information: first name, last name, team/class name
• Payment metadata: Stripe checkout session ID, amount paid — we never see or store raw card numbers
• Booking details: session date, time slot, group, booking reference number
• Analytics: anonymised usage data via PostHog and Microsoft Clarity heatmaps (no personal identifiers)
• Priority List: when you ask for future complimentary-session updates, your name, email, phone number, consent choice, source page, query-free referral path, campaign parameters, browser/language/timezone families, device/operating-system class, and coarse country/region metadata supplied by our host
• Personal Gallery: finished portrait files, the email addresses explicitly authorized to receive each gallery, access and publication records, download activity, and any gallery problem you report

Children's Privacy (COPPA)

SA Picture Day does not collect personal information directly from children. All information about minors is provided by a parent or legal guardian during the booking process. We do not knowingly collect or retain personal data from children under 13 beyond what is necessary to fulfill the booked session.

If you are a parent or guardian and believe we have inadvertently collected information about your child without your consent, contact us at support@sapicture.day and we will delete it promptly.

How We Use Your Data

• Confirm and fulfill your booking
• Send booking confirmation and prepay credit codes by email
• Respond to support requests
• Privately deliver finished portraits to authorized recipients and contain incorrect access or photos
• Detect and prevent fraud or abuse
• Improve the booking experience (aggregate analytics only)

If you join the Priority List, we use your email for complimentary-session updates and occasional SA Picture Day promotions. We do not send text messages from this list, do not sell your data, and do not store raw IP addresses, raw user agents, advertising click IDs, viewport dimensions, city, device fingerprints, or precise location data for this program.

Gallery pages do not load our product analytics, heatmaps, live chat, or browser session replay. Gallery access is checked on every request and may be revoked or contained when a recipient reports a problem.

Sub-Processors

We share data with the following trusted third-party services only to the extent necessary to fulfil your booking:

• Stripe — payment processing. Card data is handled entirely by Stripe and never passes through our servers. Stripe Privacy Policy
• Supabase — database and authentication hosting (US region). Supabase Privacy Policy
• Brevo — transactional email delivery. Your email address is used to send booking, purchase, cancellation, and video access emails. Brevo Privacy Policy
• PostHog — product analytics (anonymised; no personal identifiers). PostHog Privacy Policy
• Microsoft Clarity — session heatmaps and click analytics. Clarity may record anonymised mouse movements and interactions on this site. No personally identifiable information is sent to Microsoft. Microsoft Privacy Statement
• Chatwoot — live chat support widget hosted on our own infrastructure. If you initiate a chat, your messages and basic session metadata (IP address, browser) are stored in our Chatwoot instance to facilitate support. Chatwoot Privacy Policy
• Vercel — hosting and serverless infrastructure. Vercel Privacy Policy
• Cloudflare — private object storage for encrypted-at-rest Personal Gallery portrait files; the bucket is not public and browsers receive photos only through Booksa authorization checks. Cloudflare Privacy Policy

Data Security

We use industry-standard encryption (TLS) for all data in transit and rely on access-controlled, encrypted infrastructure for data at rest. Access to personal data is restricted to personnel who require it to operate the service. While we take reasonable measures to protect your information, no system is completely secure and we cannot guarantee absolute security.

Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you as required by applicable law, including the Texas Identity Theft Enforcement and Protection Act. Notifications will be sent to the email address associated with your booking as promptly as reasonably possible.

Legal Disclosure

We may disclose your personal information if required to do so by law, court order, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of SA Picture Day, our users, or the public. We will notify you of such a disclosure where legally permitted to do so.

Data Retention

Booking records are retained for 3 years for accounting and dispute resolution purposes. You may request deletion of your personal data at any time by emailing support@sapicture.day. Deletion requests are fulfilled within 30 days, subject to legal retention obligations.

Priority List contacts remain while subscribed. If you unsubscribe, marketing stops immediately; direct name and phone details are minimized after 30 days. Individual signup events are retained for up to 13 months, then replaced with coarse, non-contact aggregate analysis.

Your Rights

You may request to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (subject to legal retention requirements)
• Receive a copy of your data in a portable format

Email support@sapicture.day to exercise any of these rights.

Cookies

We use strictly necessary cookies to maintain your session during the booking flow (e.g., access verification). No advertising or tracking cookies are set without your consent.

Changes to This Policy

We may update this policy from time to time. Material changes will be communicated by updating the “Last updated” date at the top of this page. Continued use of the booking portal after a policy update constitutes acceptance.