Your information, treated with care

A clear note
about your privacy.

This notice explains how Charlotte Capstaff, the photographer behind Amberfield Studio, uses personal information when you browse this website or send an enquiry. It was last updated 19 October 2026.

Who is responsible?

Charlotte Capstaff is responsible for personal information collected for Amberfield Studio. The service area is Yorkshire and the wider UK. To ask a privacy question, use the enquiry form or message Charlotte on WhatsApp. A business postal address and dedicated privacy email have not yet been supplied.

What information is collected?

If you send an enquiry, the form asks for your name, email address and the type of photography you are interested in. You can also choose to share a preferred date, location, package and message. Please do not include sensitive information that is not needed to answer your enquiry.

To deliver enquiry emails, the site creates a staff notification containing the enquiry details and a receipt to the email address you provide. These messages and their delivery status are recorded so failed messages can be retried. If Charlotte later sends you a service update, the email address and message content needed for that update will also be processed.

If you create a client account, the site stores your name, email address, optional phone number and a securely hashed password (the password itself is never stored or visible to anyone). Through your account you can request dates and share booking details — such as preferred dates, location, who is being photographed and any notes — and exchange messages with Charlotte. Each request, change and message is recorded on the booking, and an email about it is sent to Charlotte and to you. Please only share details about other people, such as family members, that they are happy for you to share.

The site also receives basic technical information required to deliver and protect web pages, such as a request's time, path and browser/network details in service logs. The exact logs and retention depend on the hosting and security services configured for the live site.

If you choose to leave kind words (a testimonial) after your session, the site stores your words, the name you'd like to be credited by and which booking they relate to. They are only shown on the website once Charlotte publishes them, using only the name you chose, and you can ask for them to be changed or removed at any time; the lawful basis is your consent.

Why is it used?

Enquiry and account information is used to understand what you are asking for, check whether the requested session may be possible, manage your requests and bookings, and reply to you. The usual lawful basis is taking steps at your request before a contract, or performing a contract once a session is booked. Necessary technical records are used to operate and protect the website and handle misuse. If you book a session, further information and the relevant purposes and lawful bases will be explained as part of the booking documents.

The site uses an essential sign-in cookie to keep you signed in to your account and a security cookie to protect forms. These are strictly necessary and are not used for tracking.

Sending an enquiry does not subscribe you to marketing. This site does not currently offer a marketing mailing list. If that changes, marketing will be handled separately with the required choice and information.

Who may receive the information?

Enquiry details are available to Charlotte for responding. Transactional emails are sent through Brevo. Online payments are handled by Stripe and PayPal, who receive your name, email address and the payment amount and process your payment details themselves; this website only stores the payment reference and status. Client gallery photos, booking details, questionnaire answers and order details (including any delivery address) are stored privately and are only visible to you and Charlotte; print orders are shared with the professional print lab and delivery service needed to make and send them. The site is designed to use Heroku for hosting, PostgreSQL for application records, and Cloudflare R2 and Cloudflare image delivery for approved portfolio media; the actual production configuration and account locations must be confirmed before launch. The enquiry and sign-up forms may use Cloudflare Turnstile to check that a person, not an automated program, is submitting them; Cloudflare receives technical browser and network signals for that check, not the contents of the form. If error monitoring (Sentry) is switched on, technical details of website errors are sent to it so they can be fixed; it is configured not to send names, email addresses or form contents. These providers should receive only the information needed to provide their service, under appropriate confidentiality and data-protection terms.

Some online service providers may process information outside the UK. Before launch, the relevant provider locations and any required UK transfer safeguards must be checked and recorded. Information is not sold.

How long is it kept?

An enquiry is kept only as long as needed to reply and manage the resulting conversation. Account and booking records are kept while your account is in use. If you would like your account closed, ask Charlotte; booking records may need to be retained for the booking, legal, tax, insurance or dispute-resolution purposes that apply. A final retention schedule and deletion process are still to be set before launch; records should not be kept indefinitely without a reason.

Cookies and analytics

The current site does not intentionally use advertising or analytics trackers. The live hosting setup may use essential technical mechanisms needed for security or site operation. If non-essential analytics, advertising or other tracking is added, the site will provide any required information and consent controls before those technologies are used.

Your choices and rights

Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase or restrict use of your information, object to certain processing, or receive information in a portable format. Where processing relies on consent, you can withdraw that consent; withdrawal does not affect processing already carried out lawfully. Some rights are subject to legal exceptions.

To make a request, contact Charlotte using the details above. She may need to verify your identity before acting. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Keeping information safe

Reasonable technical and organisational safeguards should be used to protect enquiry records and limit access to people who need them. No internet transmission or storage system can be guaranteed completely secure.

Children and family enquiries

Please have an appropriate parent, guardian or person with parental responsibility make enquiries involving a child. Before any photographs of children are taken, shared or used in a portfolio, permissions and the arrangements for the particular session must be discussed separately. Sending an enquiry is not portfolio consent.

Changes to this notice

This notice may be updated when the website or photography services change. The date at the top shows when it was last reviewed.