Privacy Policy

The enquiry form on this website asks for six things: your name, your email address, your mobile number, a message, and — optionally — your event date and its location. That is the whole of it. Nothing else on this marketing site collects personal information, and no account is needed to browse it.

If you create a client portal account, the Studio holds your name, email address, mobile number, and either a password (stored only as a one-way cryptographic hash, never as the password itself) or, if you choose to sign in with Google, the account identifier Google gives us. Signing in with Google does not give the Studio access to your Google account, your contacts or your mail. If you set a profile picture, it is stored privately by the Studio rather than linked from elsewhere.

If you go on to book, the Studio additionally holds what it needs to quote, contract, invoice and deliver: the event type, dates, venue and running order; the package, deliverables and add-ons you agreed; the quotation, signed agreement, invoices and receipts for the engagement; and any documents the Studio prepares or that you send it for the booking.

The Studio does not ask for and does not store a billing address or a tax registration number for you. The tax details printed on an invoice are the Studio's own.

You are not required to give us anything beyond what is needed to answer your enquiry or perform the agreement. If you would rather not use the form, the Studio's email address and phone number are published on this site.

The Studio does not collect, see or store your card number, CVV, expiry date, UPI PIN, or net-banking password. When you pay, you are handed to the payment gateway's own secure page and those details are entered there.

What the Studio records afterwards is the outcome of the payment and enough detail to answer a question about it later: the amount, the date, whether it succeeded or failed, the payment method used, the reference number the gateway assigns, and the bank reference — a UTR for UPI and net-banking, or an acquirer reference for a card. Where the gateway returns a label for the instrument it is already masked at source, such as a UPI address, a bank name, or a partly hidden account number. A full card number never reaches the Studio and cannot be reconstructed from what it holds.

If a payment fails, the Studio records a reason code so that it can tell you what happened and whether to try again.

Should anyone contact you claiming to be the Studio and ask for a card PIN, a UPI PIN, an OTP or a net-banking password, it is not the Studio. Do not provide it, and please tell us.

To reply to your enquiry, prepare a quotation, and discuss dates and requirements. An enquiry automatically opens a record in the Studio's internal system so that it is followed up rather than lost.

To perform a booking: issuing quotations, agreements, invoices and receipts, taking payment, coordinating on the day, and delivering the finished photographs.

To operate your client portal account, authenticate you, and show you your own documents and nothing else.

To keep the accounting and tax records a business is required by law to keep, and to investigate a payment dispute or a suspected fraud.

We do not use your information to build advertising profiles, we do not sell it, and we do not share it with advertising networks.

When you submit the enquiry form, the Studio sends you an acknowledgement to the email address you provided, and may also send it by WhatsApp to the number you provided, so that you know the enquiry arrived. Replying is not required.

Booked clients receive transactional messages tied to the engagement: quotation and agreement links, the one-time code used to sign an agreement, invoices with their payment links, payment receipts, and delivery notices. These are part of performing the agreement rather than marketing, and they stop when the engagement ends.

The Studio does not run a newsletter and does not send promotional campaigns from this website. If that ever changes it will be a separate opt-in, and not a consequence of having enquired.

This marketing website sets no cookies of its own, uses no advertising or tracking cookies, and runs no third-party tracking scripts. There is no consent banner because there is nothing to consent to.

Page views are counted using a privacy-preserving analytics service that is cookieless and does not build a cross-site profile of you. It records aggregate figures only. The Studio does not use Google Analytics or any tag manager.

Cookies are set in two places, and every one of them is strictly functional: when you sign in to the client portal, and when Studio staff sign in to the private administration application. They hold a session token that keeps you signed in, or a short-lived value that protects the sign-in process itself against cross-site request forgery. All of them are inaccessible to scripts in your browser. None is used for tracking, advertising or analytics, and none follows you to other websites.

The enquiry form and the portal sign-up form are protected by a bot-check service, which runs a challenge in your browser to confirm a person is submitting the form. It receives your IP address for that check. The Studio also uses your IP address transiently to rate-limit abusive traffic.

Paying an invoice takes you to the payment gateway's own page, which sets its own cookies under its own privacy policy — necessarily, since that is how it keeps a payment session secure.

The Studio uses a small number of service providers to run the business. Each processes information only to provide its service to the Studio, under contract, and none is permitted to use it for its own purposes:

PhonePe, the Studio's payment gateway. It processes your payment and is the party that receives your card or UPI credentials — the Studio never does. To take a payment it receives the amount, the invoice reference, and the contact details needed to identify the transaction. It handles that information under its own privacy policy as well as its contract with the Studio, and is regulated in India.

A managed database service, which stores the Studio's records; cloud object storage, which holds website imagery in a public store and client documents and delivered photographs in a separate private store; an email delivery service, for transactional email; a WhatsApp business messaging provider, where WhatsApp messages are used; a bot-protection service, for the two forms named above; a website hosting and analytics provider; and a sign-in provider used where you choose to sign in with Google.

Beyond these, the Studio discloses personal information only where the law requires it — to a court, a regulator or a law-enforcement agency acting within its powers — or to the Studio's accountants and legal advisers where necessary. Some of these providers operate outside India, so information may be processed outside India under appropriate safeguards.

The Studio has no group companies, affiliates or partner businesses to share your information with, and does not participate in any reward or marketing programme that would involve doing so.

Delivered galleries, uploaded documents and client photographs are held in a private store, separate from the website's public imagery, and are served only through short-lived links that expire. They are not indexed by search engines and are not publicly browsable.

Whether the Studio may show your photographs in its portfolio, on social media or in competition entries is decided by your signed agreement, not by this policy. If your agreement restricts that use, the Studio honours it. You may also ask the Studio at any time to withdraw a specific image from public display, and we will do so.

Enquiries that do not lead to a booking are kept for 24 months from the last contact with you, so that a conversation picked up a season later still has its history, and are deleted after that. You can ask for one to be deleted sooner, and it will be.

Records relating to a booking — agreements, invoices, receipts, payment and refund records, and the accounting entries behind them — are kept for 8 years from the end of the financial year they relate to, which is the period Indian tax and company law requires business records to be retained for, and are deleted after that. Payment records in particular cannot be deleted on request while those 8 years are running, because keeping them is a legal obligation rather than a choice.

Client portal accounts are kept for as long as the account is in use. If you ask for yours to be closed, the sign-in credentials and the profile picture are deleted within 30 days, and the booking records behind it are kept for the 8 years described above.

Delivered photographs are kept as archive material unless you ask us to delete them, subject to any archival period stated in your agreement. A deletion request is carried out within 30 days.

You may ask the Studio for a copy of the personal information it holds about you, ask for inaccurate details to be corrected, ask for information to be deleted where it is no longer needed for the purposes above or for a legal obligation, and withdraw a consent you previously gave.

In the client portal you can update your own contact details, change your password, remove your profile picture, and disconnect a linked Google account.

Deleting your client record is not a self-service action in the portal. To have your information deleted, email the Studio at the address at the foot of this page and it will be done manually, subject to the retention periods in clause 8. We would rather say that plainly than offer a button that could not honour a legal retention obligation anyway.

There is no charge for any of these requests. The Studio acknowledges a request within 3 working days of receiving it and answers it in full within 30 days — including telling you, where a retention period in clause 8 prevents a deletion, which period applies and when it ends. Where a request is unusually wide and needs longer, the Studio will say so within those 30 days and give you a date.

By sending an enquiry, creating a portal account or booking the Studio, you consent to your information being used as this policy describes.

You may withdraw that consent at any time by writing to the Grievance Officer named at the foot of this page. A withdrawal takes effect from when the Studio receives it and does not undo processing already carried out lawfully.

Where you withdraw consent for information the Studio needs to perform an agreement — your contact details for a booked event, for instance — the Studio may be unable to continue providing the service, and will tell you so rather than continue silently.

If you give the Studio someone else's personal details, such as a family member's phone number for coordination on the day, please make sure you are entitled to do so.

Access to client records is limited to Studio staff who need it, each with their own account and their own permissions. Passwords are stored only as one-way hashes. Private files are stored separately from public website media and are reachable only through expiring links. Traffic to this site, to the client portal and to the Studio's systems is encrypted in transit.

Because payments are taken on the gateway's own page, your card and UPI credentials never enter the Studio's systems and cannot be exposed by a breach of them.

No system is perfectly secure, and information sent over the internet always carries some inherent risk. If a breach affecting your personal information occurs, the Studio will notify you and the relevant authority as required by law. Please keep your portal password to yourself; anyone holding it can see your documents.

The Studio's services are offered to adults, and this website is not directed at children. Where children appear in commissioned photographs, the Studio acts on the instructions of the commissioning adult and on the terms of the signed agreement.

This policy may be updated as the Studio's practices or the law change. The effective date and the last-updated date at the top of this page always reflect the version you are reading. Material changes affecting existing clients will be notified directly.

If you are not satisfied with how the Studio has handled your information or your request, write to the Grievance Officer named in the identity block at the foot of this page, whose name, designation, postal address, email address and phone number are published there along with the hours during which the Studio is reachable.

The Grievance Officer acknowledges a grievance within 24 hours of receiving it and resolves it within 15 days, as required by the Information Technology (Intermediaries Guidelines) Rules, 2011. If you remain unsatisfied, you may escalate to the relevant data protection authority in India.