Privacy
What we do with your details.
Last updated 29 July 2026
Caught At The Surface is a home photography studio in the Philippines. To photograph you we have to hold a few things about you, and this page says exactly what, why, and for how long. We do not sell any of it, and we do not use it for advertising. If anything here is unclear, email caughtatthesurface@gmail.com and a person will answer.
When you book a session
The booking form asks for your name, your mobile number, and optionally your email address, along with the package you picked, the date and time you want, and anything you tell us in the notes. We need your name and number to hold the date and to reach you about it, and your email only to send confirmations. No account and no password: your bookings are keyed to your mobile number. We also keep a record of what you paid, meaning the amount, the method (GCash, bank transfer or cash) and any reference number you send us. We never see or store card details.
Your photos
Photos from your session go into a private gallery that only opens with the QR link or the code and PIN we give you. Galleries are not listed anywhere, are not indexed by search engines, and expire after a while. We keep the originals so we can re-send them if you lose yours. Nothing from your session appears on this website unless you have told us it can. We note down that you said yes, and until you have, our own tools will not let us publish a photo of yours at all. Even then we choose them one by one, never a whole gallery. A photo we do publish is copied into the public part of the site, so it stays up when your private gallery expires. If you change your mind, email us and we will take it down.
If you message us on Facebook
The Message us buttons open Messenger. Facebook tells us nothing about that conversation: not your name, not your number, and not an id of any kind. All we know is that a button on this website was tapped, which is counted the same way as any other button and is described below. What you write in Messenger lives in Facebook's systems under Meta's privacy policy, not ours, and any automatic reply you get there is Facebook's own feature rather than something this website sent. If you would rather not use it, email us instead.
When you write to us
The form on the help page asks for your name, your email address, optionally your mobile number, and whatever you write. We keep it so we can answer you and so we can find the conversation again later, and we email a copy to ourselves so a message never sits unread. We reply from our own inbox, which means your message and our answer also sit with our email provider. We do not add you to any mailing list, because we do not have one. Messages are deleted a year after we have dealt with them. Ask us sooner and we will delete yours right away.
What we measure
We count how often the Message us buttons are tapped, so we know which parts of the site are useful. We store a one-way hash of the network address that tapped, never the address itself, and only so that one person cannot flood the count. The booking lookup is limited to a few tries at a time for the same reason. Those attempts are stored with your number or reference hashed, never in the clear, and are deleted after a day. There is no advertising tracker, no analytics script, and no third-party cookie on this site.
Cookies and what your browser keeps
A few small things, all of them ours and none of them used to follow you anywhere. Opening your gallery sets a signed cookie so you do not have to type the PIN on every page, and it lasts a day. Sending a booking request, or looking one up afterwards, sets one that opens that booking's page for a week. Your browser also remembers, on your device only, that you have visited before, so a return visit does not jump you back to the top of the homepage. While you are filling in a booking, the form is kept in the tab you are filling it in, so a reload or a dropped connection does not lose what you typed. It never leaves your device, and your browser discards it when you close the tab. If you are on a shared or borrowed phone, closing the tab is enough to clear it.
Who else can see it
Only the studio's own staff, and the companies that run the machinery underneath: Vercel hosts the website, Supabase stores the database and the photos on servers in Sydney, Google or Resend carries our email, and Meta runs Messenger. They process this on our behalf and cannot use it for their own purposes. We will hand over information if the law requires it, and for nothing else.
How long we keep it
Booking and payment records are kept as business records. Galleries expire and are then archived, and the photos are eventually deleted from storage. Lookup attempts are deleted after a day, and the tap counts after a little over a year. If you want us to delete your details, ask us and we will, apart from anything we are required to keep for tax or accounting.
Your rights
Under the Philippine Data Privacy Act of 2012 you can ask us what we hold about you, ask us to correct it, ask us to delete or block it, and object to how we use it. Email caughtatthesurface@gmail.com and we will answer within a few days. There is no charge. If you think we have handled your details badly and we have not put it right, you can complain to the National Privacy Commission at privacy.gov.ph.
Changes to this page
If what we do with your details changes, this page changes with it and the date at the top moves. We will not quietly start doing something with your information that this page does not mention.
To see where a booking of yours stands, or to ask us anything at all, the help centre is the quickest way in.