What we collect, and why.

The booking inquiry form is the short form on the home page. We use it to start a conversation with you about a session — no payment is taken at this step, no account is created. The fields below are everything the form writes or attaches:

• Name — so we know what to call you in replies.
• Email — the only address we send a confirmation to.
• Phone (optional) — left blank unless you choose to share it.
• Session type — so we can quote against the right pricing tier.
• Preferred date — so we can check the calendar.
• Notes (optional) — anything you want to add about the session.
• Package (optional, URL-driven) — set automatically if you came from the pricing page.
• created_at — the timestamp, written by the database.

When you submit the form, the studio receives your message by email through the Polsia email proxy, and you receive an automatic confirmation to the address you entered. The same fields are also written to the inquiries table in a Postgres database hosted on Neon.

The /share form is for couples we have already worked with who want to leave a public testimonial. The required fields are just what we need to publish your story; everything else is optional. These are the fields the form writes:

• Couple names — shown on /testimonials alongside your quote.
• Wedding month and wedding year — shown as the descriptor.
• Testimonial — your story, edited only by you.
• Email (optional) — only used if we need to follow up before publishing.
• Headshot photo (optional, max 4MB) — uploaded to public/uploads/testimonials/ if you choose to attach one.
• Permission checkbox — required, confirms you are happy for us to publish.
• Submission timestamp — recorded when the form is saved.

Submissions are stored locally in data/past-client-submissions.json and reviewed by hand before any appear on the public /testimonials page. Nothing is published automatically and nothing is sent to a third-party moderation service.

Inquiries. Booking inquiries are kept while the conversation is active and then archived as needed for tax and contract reasons. We do not auto-delete inquiries on a timer.

Testimonial submissions. Submissions live in a pending queue until reviewed. Approved submissions go live on /testimonials; rejected submissions are removed from data/past-client-submissions.json.

Uploaded photos. Any headshot uploaded with a testimonial stays in public/uploads/testimonials/ while the testimonial is published. When a testimonial is retired, the matching photo file is removed alongside it.

Google Analytics 4. Page views and the generate_lead conversion event (fired when an inquiry is submitted successfully) are reported to GA4 via the GOOGLE_ANALYTICS_ID measurement ID. GA4 uses standard cookies and does not receive form field values.

Polsia email proxy. The Polsia email service delivers confirmation emails to you and a notification email to the studio on inquiry submission. The Polsia email proxy does not retain message content beyond delivery.

Polsia Analytics. A single anonymised pixel is fired from views/layout.ejs on every page load. It assigns a random visitor ID stored in localStorage and reports aggregated page-view counts to the Polsia platform.

Postgres on Neon. Inquiry rows are stored in a managed Postgres database hosted by Neon. The data is not sold, shared, or replicated to any other system.

To view, correct, or delete your data — for both the inquiry form and the testimonial form — email chris@photocrb.com from the address you originally submitted with. Deletion requests are typically processed within seven days.