Privacy Policy
I'm Zachary Routsong, a solo photographer based in Valdosta, Georgia. This page explains what information I collect when you book a session, why I need it, and who else sees it. I've tried to keep it short and plain.
It applies to everyone who uses this site, anywhere in the United States and its territories.
Important: children under 13
This site is not for children under 13. If you're booking a session for a child, you — the parent or guardian — must be the one filling out the form and providing your own contact information. I do not knowingly collect personal information directly from children under 13. If you believe that happened by mistake, contact me and I'll delete it immediately. This is required by federal law (COPPA).
I may collect a subject's name or similar details (for sports sessions, that can include a jersey number or position) as part of coordinating the shoot. That information is used only to find and photograph the right person at the session — nothing else.
What I collect and why
When you submit a booking request, I collect:
- Your name, email, and phone — to confirm your booking and send your gallery
- Session date, time, type, and location — to show up at the right place at the right time
- Package and add-on selections — to calculate your session estimate
- Optional notes — anything extra you want me to know
All of it comes straight from you, on the booking form. I don't buy information about you, and I don't collect it from data brokers, social media, or public records.
Cookies and browser storage
This site doesn't use cookies. No tracking cookies, no advertising cookies, no analytics of any kind — no Google Analytics, no Meta pixel, nothing counting your visit.
It does save three small things in your own browser, none of which are sent to me or anyone else:
- Your light/dark choice — so the site looks the way you left it. Stays until you clear your browser data.
- That you dismissed the notice bar — so it doesn't nag you on every page. Stays until you clear your browser data.
- A login token — only on the admin pages, and only for me. Visitors never get one.
All of that lives on your device. You can wipe it anytime by clearing your browser's site data for zrphotos.net; the only thing you'll lose is your theme choice.
Because nothing here tracks you, there's no cookie banner to click through and nothing to opt out of. The bar you see on your first visit is a heads-up about booking information, not a cookie consent form.
One caveat I can't control: the companies that host and protect this site (Cloudflare) may set a strictly necessary security cookie to block bots or attacks. None are being set right now, and they'd never be used to advertise to you or build a profile.
Who else sees your information
I don't sell your data. I don't share it with advertisers. A few services touch it as part of running the site:
- Supabase — stores booking data securely. Privacy policy →
- Resend — sends booking and confirmation emails. Privacy policy →
- Google Drive — stores client photographs and folders named with the client's name, session date, and session type. Private galleries retrieve previews and original downloads from Drive. Privacy policy →
- Cloudflare — hosts and delivers this site; standard server logs (IP, browser type) are collected by them. Privacy policy →
I may also disclose information if required by law or a valid court order.
How long I keep it
I keep booking records for as long as needed to deliver your photos and handle any questions afterward — generally a few years for basic business records. Client galleries remain available until you ask me to remove them. You can ask me to delete your information sooner at any time.
Your rights — every state and territory
States have passed a patchwork of privacy laws, and most of them only cover companies far larger than a one-person photography business. Rather than sort out who is covered where, I give everyone the same rights, wherever you live:
- Know — ask what information I have about you, where it came from, and who has seen it
- Get a copy — receive it in a portable format
- Correct — fix anything that's wrong
- Delete — have it erased (I'll keep only what tax and business-record law requires me to)
- Opt out — of any sale of your information, targeted advertising, or automated profiling. As below, I don't do any of those
- No penalty — using any of these rights never changes your price, your session, or your photos
How to make a request
Reach out any of these ways:
- Email: zac@zrphotos.net
- Phone: 229-300-1006
- Instagram: @zacharyroutsongphotos
What happens next:
- Timing — I'll confirm I got it and respond within 45 days. If it's genuinely complicated I may need another 45, and I'll tell you why before that happens.
- Checking it's you — I'll match what you tell me against the booking record, usually the email or phone you booked with. For deletions I may ask one more question before erasing anything, since I can't undo it.
- Someone acting for you — an authorized agent, or a parent or guardian, can make a request on your behalf. I'll ask for written permission from you first.
- If I turn a request down — you can appeal by replying and telling me why. I'll look again and answer within 60 days. If you still disagree, you can take it to your state attorney general.
What I don't do
- I don't sell your information — not for money, not for anything else of value.
- I don't share it for targeted or cross-context behavioral advertising.
- I don't run advertising trackers or ad cookies on this site.
- I don't use your information for automated decision-making or profiling.
- I don't use facial recognition or pull face geometry, fingerprints, or any other biometric identifier out of photographs. (Worth stating plainly if you're in Illinois or Texas, which have their own biometric laws.)
- I don't offer discounts or perks in exchange for your data.
- I don't collect sensitive information — no Social Security numbers, government IDs, financial account numbers, precise location tracking, health details, or anything about race, religion, or sexual orientation.
Since none of that happens, there's nothing for you to opt out of. If your browser sends a Global Privacy Control signal anyway, it's honored by default.
A few state-specific notes
- California — you have every right listed above under the CCPA and CPRA. You can also ask once a year, under the "Shine the Light" law, what personal information I gave third parties for their own marketing. The answer is none.
- Nevada — you can tell me not to sell your covered information. I don't sell it in the first place.
- Colorado, Connecticut, Virginia, Texas, Oregon, Montana, and every other state with its own privacy law — the rights above already match or exceed what those laws require, including the appeal process.
- Washington DC, Puerto Rico, Guam, the US Virgin Islands, American Samoa, and the Northern Mariana Islands — same rights, same process.
If I make any meaningful changes to this policy, I'll update the date at the top. Questions? Just reach out.