Privacy
What we collect when you visit this site or send an inquiry, why, and your choices.
This website is operated by Alice Kusyn Photography, an independent portrait and lifestyle photography practice working in Vienna and Prague. We are responsible (the controller) for the personal data described here. You can reach us about privacy at alicekusyn.photo@gmail.com.
This notice covers the personal data we process through this website — mainly the inquiry form and basic visitor analytics. Photographs taken during a booked session, and any booking or invoicing details, are handled separately under the agreement we make with you for that session.
When you submit the inquiry form we collect what you choose to enter: your name and email address (required), and optionally your phone or WhatsApp number, preferred city, session type, preferred date and your message. We also record that you ticked the consent box. Please don't include sensitive personal details in your message — they aren't needed to plan a session.
To keep the form usable and free of spam, we process a small amount of technical data when you submit it. We compute a one-way, irreversible hash of your IP address and use it only as a short-lived key to limit repeated submissions — we never store your raw IP address. When the anti-spam check (Cloudflare Turnstile) is enabled, Cloudflare also processes your IP address and basic browser information to confirm you are a person and not a bot. So we can see which pages lead to inquiries, we also note the page or link from which you arrived at the form — without cookies and without tracking you across other sites.
We use Lovable's built-in, privacy-friendly analytics to understand how the site is used — for example how many people visit, which pages they view, where they arrive from and the general device or browser type. This information is aggregated; it is not used to build a profile of you or to track you across other websites. The public site sets no advertising or marketing cookies. If we ever add non-essential cookies, we will ask for your consent first.
We use your inquiry details only to reply to you and to discuss and plan a possible session — based on your consent and on taking steps at your request before any agreement (Article 6(1)(a) and (b) GDPR). The anti-spam measures (the hashed-IP limit and Cloudflare Turnstile) and the aggregate analytics rely on our legitimate interest in keeping the site secure and understanding how it is used (Article 6(1)(f) GDPR). We do not sell your data, and we will not use it for unrelated marketing without asking you first.
So that we can respond promptly, a notification email containing your inquiry is sent to us when you submit the form. That email is delivered through Resend, an email provider acting on our behalf.
We rely on a small number of trusted providers that process data on our behalf and only on our instructions: Supabase (the database and image storage that holds inquiries and portfolio photos), Lovable (the platform that builds, hosts and provides analytics for this site), Cloudflare (hosting, content delivery and the Turnstile anti-spam check) and Resend (sending the inquiry notification email). Some providers may process data on servers outside the European Economic Area; where that happens, the transfer is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.
The public website does not set advertising or marketing cookies and does not track you across other sites. Any browser storage for visitors is limited to what the privacy-friendly analytics and the basic functioning of the site need. Site administrators who log in to the private dashboard have an authentication session stored in their own browser — this is strictly necessary and applies only to us, not to visitors.
We keep inquiry submissions for as long as we are in contact about a possible session and for a reasonable period afterwards — by default up to 24 months from our last exchange — after which they are deleted, unless we are required to keep certain records longer to meet legal obligations. The hashed-IP values used for spam limiting are removed automatically within minutes. Analytics data is retained only in aggregate form.
Under the GDPR you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to certain processing and to receive it in a portable form. Where we rely on your consent you can withdraw it at any time. To exercise any of these, email alicekusyn.photo@gmail.com. You also have the right to complain to a data protection authority — in Austria the Datenschutzbehörde (dsb.gv.at), and in the Czech Republic the Office for Personal Data Protection, Úřad pro ochranu osobních údajů (uoou.gov.cz).
Inquiries are stored in a database protected by row-level security and are not publicly readable, and data is sent over encrypted (HTTPS) connections. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.
We may update this notice as the site or our providers change; the date above shows when it was last revised. For any privacy question or request, contact Alice Kusyn Photography at alicekusyn.photo@gmail.com.