Privacy Policy
Last updated June 4, 2026
This Privacy Policy describes how JM Photography LLC, doing business as The Picture Day Rig, handles information collected through this website and related online services.
This page is written to match the current website behavior: parent access-code lookup, picture day schedules, picture day orders, digital product purchases, Stripe Checkout, Resend email, Vercel Postgres, Vercel Blob, and password-protected admin operations.
Information We Collect
- Booking and inquiry information, including organization name, contact name, email, phone number, sport, athlete count, preferred dates, and notes you submit.
- Parent and athlete order information for Picture Day Special orders, including parent or guardian name, email, phone number, athlete name, jersey number, league, team, selected payment method, order number, payment status, and order amounts.
- Parent access-code lookup information, including athlete name, parent or guardian name, email address, and league submitted to look up a gallery access code.
- Photographer store purchase information, including customer name, email address, selected digital products, order number, payment status, download tokens, download counts, and download timestamps.
- Picture day schedule images and related metadata displayed on the parent page.
- Technical and security information such as IP-derived rate-limit keys, admin audit events, error logs, request timing, and browser/device information provided by standard hosting logs.
Parent And Athlete Access-Code Lookup
The parent lookup flow is server-side. The browser submits the lookup fields to the website API, and the API returns an access code only when the submitted athlete name, parent or guardian name, email address, and league match the private lookup data.
The lookup API does not return a roster, team list, parent list, or shared CSV to the browser. Lookup attempts are rate-limited. Hit and miss audit logs are designed to avoid storing raw parent, athlete, email, or access-code values.
Payments
Card payments are processed through Stripe Checkout. This website creates Stripe Checkout sessions on the server and receives payment status from Stripe webhooks.
We do not store raw credit card numbers, card security codes, or full payment card details on our servers. Stripe may collect and process payment information according to its own terms and privacy policy.
How We Use Information
- To respond to booking, contact, beta, and waitlist requests.
- To help parents find gallery access codes and view picture day schedules.
- To create, process, reconcile, and support Picture Day Special orders.
- To create digital product orders, send download links, verify download tokens, and record download activity.
- To send transactional emails such as order confirmations, payment confirmations, store delivery emails, admin summaries, and support responses when email services are configured.
- To operate protected admin tools, audit important admin actions, prevent abuse, troubleshoot errors, and maintain site security.
How Information Is Shared
- With Stripe for payment checkout, payment status, and related payment operations.
- With Vercel services used by the site, including hosting, Vercel Postgres, and Vercel Blob file storage.
- With Resend when transactional or operational email is sent.
- With gallery or delivery platforms that you choose to visit from our site, such as GotPhoto, where those platforms have their own policies.
- With authorized business operators or service providers who need access to run picture day, fulfill orders, provide support, or maintain the website.
- When required to comply with law, enforce our terms, prevent fraud or abuse, or protect our rights, customers, or services.
The site may send transactional emails related to inquiries, picture day orders, payment status, digital download delivery, and operational summaries. Some waitlist or beta forms may also add a contact to a Resend audience when that service is configured.
You can contact us to update an email address or ask to be removed from non-transactional updates. Transactional emails may still be sent when needed to complete an order or respond to a service request.
Children And Athlete Information
The Picture Day Rig provides youth sports photography services. Athlete information may be submitted by a parent, guardian, league, coach, or authorized organizer so that we can run picture day, identify galleries, fulfill orders, and support families.
This website is not designed for children to create accounts. Parents, guardians, and league organizers should contact us with questions about athlete information, marketing opt-outs, corrections, or deletion requests.
Data Retention, Correction, And Deletion
The current codebase does not implement an automatic public deletion workflow or a fixed automated retention schedule. We retain operational records for as long as needed to provide services, process orders, support customers, prevent fraud or abuse, comply with tax/accounting obligations, and maintain business records.
Access-code lookup data is intended to live in a private data source and not in public website files. Digital store download links expire after 7 days, but order records, download counters, and audit records may remain for support, abuse prevention, and accounting purposes.
To request correction, deletion, or a copy of information connected to you or your athlete, email support. We may need to verify the request and may keep information when retention is required for legal, tax, fraud-prevention, order fulfillment, or dispute-resolution reasons.
Security
We use practical safeguards such as private data paths for access-code lookup, server-side validation, rate limiting, password-protected admin routes, HMAC session cookies, and protected admin API checks. No website or storage system can be guaranteed completely secure.
If you believe information has been exposed or used incorrectly, contact us promptly.
Questions about these policies? Email support@thepicturedayrig.com.