Privacy Policy

Guelph Grad Photos Inc. (“Guelph Grad Photos”, “we”, “us”), an Ontario corporation (Ontario Corporation Number 1001764558) and an independent photography business based in Guelph, Ontario, Canada, is responsible for the personal information this policy describes. The person responsible for privacy here, our Privacy Officer, is the owner. Write to [email protected], or call or text (226) 332-0225.

Our team is the photographer who founded the business and, for larger groups, a second photographer who works with us and sees your details and photos only for the sessions they work. This policy covers our website, /book, your gallery, your account, our iPhone app and our messages with you, alongside our Terms of Service and Delivery Policy.

Your session and your photos

The photos we take of you and anyone with you, the original camera files, and what you tell us to plan your session, such as who is coming and where to meet. Calls and texts to our phone, and our own notes about your enquiry or booking, including how likely we think you are to book.

When you book and pay

• Your name, email, phone, package, group size, chosen time and any promo code.
• When you press Continue, before you pay, we create a customer record with Stripe, our payment processor, and email ourselves your name and contact details, even if you do not finish. If the page hits an error, it sends us what you had typed, the time you picked and your browser type, so we can help.
• Your card goes straight to Stripe; we never see the full card number. We keep the payer’s name, email and billing postal code from Stripe’s record of the payment. Stripe keeps the card on file after charging the deposit and any tip you choose. We charge it again only as our Terms of Service set out: for a balance still unpaid 7 days after your session, after two written reminders; for a missed session you did not cancel; or when you ask us to. Once your balance is paid, we remove it if you ask.
• Your booking goes into our records and our calendar, and we keep a copy of every booking email we send you.

If you start a booking and stop, we keep your name and contact details, may send you a reminder, and may send occasional news for up to 6 months. Unsubscribe or tell us, and we stop. Ask, and we delete them.

Group sessions and Join my group

When a member joins from their account, we record the session, the time they joined and that they accepted our Terms, and email them and us. Members see the group’s gallery and the booking’s price, what has been paid and the balance; only the person who booked sees the full payment history. Any member can pay toward the balance on a Stripe checkout page, which does not save the card.

Your account

We keep:

• Your email, your name and your password. We store the password only scrambled (a one-way hash), so nobody, including us, can read it.
• If you sign in with Google, or Apple where offered, your name, email and an account identifier. With Google, also the address of your Google profile picture.
• Your profile, if you fill it in: phone, program, graduation month, Instagram handle, how you heard about us, and your email setting.
• For each sign-in, your device type (for example, Safari on iPhone) and city and country, in an activity log you can check.

Your gallery

We keep:

• Your name, access code, private link, email, phone and, if given, program and graduation date.
• Each photo opened, when, and the IP address (your connection’s internet address) it was opened from.
• Your downloads, likes, notes, and requests for re-edits and signature edits.

Our iPhone app

Our iPhone app shows your gallery, books sessions, takes the deposit, lets you edit your photos on your phone and helps you plan your shoot. It has no ads and no tracking.

• You can sign in with your email and password, or with Google, on our own website’s sign-in page, shown in Apple’s secure sign-in window, so the app never sees your password. You can also use Sign in with Apple, in Apple’s own window on your iPhone: Apple gives us your name and an email address, which may be a private address Apple forwards to you, and the app sends Apple’s sign-in proof to our website to open your account. Either way, the app then keeps its own sign-in key in your iPhone’s Keychain until you sign out, and you can also end it from your account’s Security page.
• The app sends us what our website would: when you book, your name, email, phone, package, group size and chosen time; in your gallery, your likes, your notes and requests for re-edits and signature edits, and which photos you save or share and at what size.
• You pay the deposit, and any tip you choose with it, inside the app in Stripe’s payment window, with Apple Pay or a card you type into that window. Your card details go to Stripe, never to our servers. Stripe’s code in the app may collect information about your device to help prevent fraud. We keep your booking, the amount paid and Stripe’s reference for the payment.
• The photo editor works on your iPhone. Nothing you make in it is sent to us or to anyone else, and an edited photo is saved to your Photos library only when you press Save.
• Your gallery’s photos are shown in a protected layer, so a screenshot of them comes out blank.
• Some things stay on your iPhone and never reach us: your plans, checklists and their reminders, places you save, voice notes you record, and copies of your gallery’s photos kept so they open quickly. Signing out removes the sign-in key and those photo copies; deleting the app removes the rest.
• The app asks before it uses your Photos library (to save the photos you choose and the ones you finish in the editor and, only if you want them in their own album, to make that album), your calendar (only to add your session; it cannot read your calendar), your microphone (only while you record a voice note) and notifications (only the reminders you set). You can change each in your iPhone’s Settings. The app does not use your location.
• The forecast comes from Open-Meteo, a weather service: the app asks it for the weather at a fixed point on campus, never your location, and like any website it sees your phone’s internet address. The maps and walking routes between campus spots come from Apple Maps, part of your iPhone, and are asked for between those spots, never from where you are.
• Apart from Apple’s own services on your iPhone, the app talks only to our website, to Stripe and to Open-Meteo, under the same protections as everything else in this policy. It has no advertising code and no analytics from other companies.
• To delete your account from the app, open Profile and press Delete your account. It opens our website’s deletion page, asks you to sign in again, and then deletes your account as section 13 sets out. Deleting your account also ends the app’s sign-in.

Messages and forms

From Instagram and Facebook: your messages, name, username and Meta lead forms. Our app also fetches your profile picture, follower count and whether you follow us along with your messages; we do not use them to decide your price or your booking. Emails to info@ are kept in our business inbox and in our apps on our own computer and phone. Contact and events forms (name, email, phone, organization, event date, message) are emailed to us and not stored in our booking database.

What our website pages record, including on the Clubs and Faculty galleries, is in Cookies and analytics.

To book, photograph and deliver your session, take payments and collect what is owed, answer you, email you about your booking and gallery, keep our systems safe (the internet address on each photo view helps us spot a leaked gallery link), handle a complaint or a legal claim, and keep our tax records.

We also time a few reminder emails: if you start a booking and do not finish, after an enquiry we have not heard back on, if you sign in to your gallery and have not downloaded yet, as the date shown in your gallery comes up, and to ask for a review after you download. To stop them, use the unsubscribe link in the email or tell us. Occasional news and offers follow Emails from us.

Our use of your photos in our portfolio and promotions, and our marketing emails, are both things you can say no to, and saying no never changes your price or your service. Ad measurement runs on our main website pages without asking first; you can limit it as described in Cookies and analytics. We do not sell, rent or trade your information or your photos.

Your gallery is private and delivered to you. We may also use photos from your session in our portfolio: on our website and guide pages, on our own Instagram, Facebook and TikTok accounts, and in our promotions, including ads. This is how most grads find us, and it is part of what you agree to when you book.

Your choice, any time. If you would rather your photos were not used this way, tell us by email or message, before or after your session, and we will not use them. If a photo of you is already in use, tell us and we take it down from everything we control as soon as we can. Saying no never changes your price or your service. We cannot recall prints already made or posts other people have shared.

Everyone in a group session sees the group’s gallery. The person who books tells us who is coming and confirms that everyone in the group has agreed to be photographed. Anyone in a group photo can ask us not to use it, or to take it down, and we do.

For anyone under 18 we ask a parent or guardian first (see Grads under 18). Event and club galleries are public by design (see Event and club galleries).

On campus we keep passers-by out of frame where we can, and we remove or blur anyone who asks. We never use a photo to suggest the University of Guelph endorses us.

When a club, faculty, company or event organizer books us, we agree the details with them in writing, including that they tell their guests photos are being taken, and whether the gallery is public. If they share a list of members or guests with us, we use it only to deliver that event’s photos.

Our Clubs and Faculty galleries are ours, not the University’s. They are public, free to download and findable by search engines by design; we count downloads only as a number. If you are in one of these photos and would rather not be, email us and it comes down as soon as we can. A parent or guardian can ask the same for a child.

Canada’s Anti-Spam Legislation (CASL, the law on marketing emails) sets when we may send you news and offers. We send them only:

• for up to 24 months after your latest booking;
• for up to 6 months after you last asked us something (starting a booking you did not finish counts); or
• for as long as you have told us yes.

Every marketing email has an unsubscribe link. We act on it within 10 business days and keep your opt-out for good. When a time limit ends, we stop unless you said yes. Emails about your own booking still reach you. We never sell or rent our list.

Running the business

We use AI tools to help run the business, for example to keep our records in order and to find common questions for our FAQ. They may see what we hold about your booking and our messages with you, but never your gallery photos.

Editing

While we edit, our editing software may send a copy of a photo to its maker’s servers for some of its AI tools, such as noise reduction, masking and clean-up. A person chooses and checks every photo. We retouch; we never add a person, a place or regalia you were not wearing, and never reshape a body or face unless you ask. The software we built to run the business, including our booking pages and galleries, sends no gallery photo to an AI.

AI never decides a booking, refund, price, gallery release or complaint. A person does. Want no cloud editing tools on your photos? Tell us before we start editing.

A cookie is a small file a website saves in your browser; a pixel or tag is code that tells another company you visited.

• Meta Pixel and Google tag: on our main website pages, including Home, Contact, the Book Now information page, this page and the Clubs and Faculty galleries. They tell Meta and Google which page you visited, with device and connection details, and set their own cookies, so Meta can measure our ads and Google can run Google Analytics for us. Each also uses what it receives under its own privacy policy. They are not on the booking form at /book, your private gallery, /signup or /account, and no booking or payment is reported to them.
• Cloudflare, which delivers our site, adds a small analytics script to every page, booking and gallery pages included. It counts visits without cookies.
• Our gallery, sign-in and booking pages load Google Fonts, so Google sees your IP address. The deposit page loads Stripe’s payment form, which sets Stripe’s own cookies to help prevent fraud.
• Our own cookies: account sign-in (up to 30 days, ended after 20 minutes without activity), a gallery helper that only remembers which gallery you opened (60 days; it opens nothing on its own), and sign-in helpers (10 minutes). Your checklist ticks stay in your browser.

To limit them, block or clear cookies in your browser, change your ad preferences in Meta’s Accounts Centre and your Google ad settings, or use Google’s Analytics opt-out add-on. Our site still works.

We use a small number of trusted companies, most of them in the United States, to run the business: they host our website, booking pages, galleries and accounts, take payments, send our emails, keep our calendar and files, carry Instagram and Facebook messages, and help us edit photos and keep our records. Each one gets only what it needs for its job.

So your information may be stored or processed outside Canada, where courts, police and national security authorities may be able to reach it under local law. We remain responsible for it.

Beyond these companies, our team and the people in your own session, we share your information only:

• with a professional who advises us, such as our accountant, lawyer or insurer, who must keep it confidential;
• to collect money owed or to answer a payment dispute;
• when the law requires it, or to protect someone’s safety;
• if the business is ever sold or passed on, with the new owner, who must keep the promises in this policy.

Apart from short-lived security records, nothing is deleted automatically today. Ask, and we delete by hand what the law lets us.

• Your gallery: at least until the date shown in it (two months from delivery if none is shown); we may remove it any time after, so download your photos when they arrive.
• Our copies of your photos: kept to re-deliver them; deleted on request unless a booking is open.
• Booking and payment records: at least six years after the end of the tax year they belong to, as tax law requires.
• Gallery activity (views with IP addresses, downloads, likes, notes, re-edits and signature edits), unfinished bookings, messages and forms: kept, with no set end date yet. Ask and we delete them.
• Marketing: our record of your consent, and of what we sent you, while we email you and for at least three years after, so we can show we had your consent; an opt-out, for good.
• Your account: until you delete it, which you can do yourself from your account’s Security page; deleting removes your sign-in methods, profile, gallery connections, settings, scrambled password and activity log. If you only close it, your sign-in methods, gallery connections and settings go, and your name, email, profile, scrambled password and activity log stay until you delete the account or ask us to.
• Wrong-code attempts: cleared when you sign in, otherwise removed from time to time after a day. Breach records: at least two years, as the law requires.

We are committed to keeping your data safe. Your gallery opens only while you are signed in to your account, and a session ends after 20 minutes without activity (a countdown warns you first). Your access code connects your account to your gallery once; after that it is spent and can neither open nor connect anything. Your account password and your booking’s manage link are the keys to your photos and your session, so please keep them as private as a house key. Anyone who signs in as you can see and download your photos, see your price, what has been paid and the balance, and, in a group, the group’s photos. With the manage link they can move or cancel your booking. Your gallery link on its own opens nothing; it only takes you to the sign-in page.

Once you, or someone you shared with, passes photos or keys on, we cannot control what happens next and are not responsible for it. If your password has got out, change it on your account’s Security page, which can also sign out every other device; if you cannot, tell us and we will sign them out and reset it with you, usually the same day. If an unused access code has got out, tell us and we replace it. If an account you do not recognise has connected to your gallery, tell us and we disconnect it by hand and issue you a new code. If another member’s key gets out, we do the same for theirs and tell the group. The manage link cannot be replaced yet: if yours got out, tell us and we will check your booking and confirm any change with you directly. Nothing here limits our own responsibility to keep our systems secure.

• Your gallery opens only while you are signed in to your account, and a session ends after 20 minutes without activity; a countdown warns you first.
• Each access code connects one account, once; after that it is spent.
• Each person has their own long, random gallery link; it only leads to the sign-in page, and we can replace it at any time.
• Too many wrong codes lead to a lockout.
• Your private gallery is hidden from search engines.
• Passwords are stored scrambled.
• Every page is encrypted in transit, and our business computer’s disk is encrypted.
• We never hold full card numbers.

No system is perfectly secure. If a breach creates a real risk of significant harm to you (the legal test), we tell you and the Office of the Privacy Commissioner of Canada as soon as we can. We keep a record of every breach.

• See what we hold within 30 days. If we need longer, we tell you why within that time and take at most 30 more.
• Correct it, and withdraw consent to any optional use at any time.
• Delete it, except what the law requires us to keep, such as booking and payment records, or what we still need for a booking that is not finished or a payment that is in dispute. We cannot recall photos others have shared.

From your account you can download a copy of your details, profile, sign-ins, activity, galleries, and your bookings’ price, paid and balance. For photo views, downloads, likes, notes, re-edits and signature edits, ask us.

You can delete your account yourself there too, on its Security page or at guelphgradphotos.com/account/delete. Deleting is for good and cannot be undone. It deletes your account, every way you sign in to it (Google, Apple and your password), your profile and details, your gallery connections, your settings, your activity log and the list of where you are signed in, and it signs out our iPhone app. We keep your booking and payment records, because tax law requires it, and your gallery and its photos as our record of what we delivered. To have your gallery and photos removed too, email us and we delete everything the law lets us.

You can also close your account instead. Closing is not the same as deleting. Closing signs you out everywhere, removes your Google or Apple sign-in, gallery connections and settings, and turns off the email setting on your account, but keeps your name and email, profile, scrambled password, activity log, and booking, payment and gallery records. To stop news and offers, use the unsubscribe link in any of our emails or tell us. If you later want a new account connected to your gallery, ask us.

Email [email protected] or call or text (226) 332-0225. It is free; we may ask you to confirm who you are. If you are not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca. If you live in Quebec, you may have additional rights; write to us.

Google or Apple sign-in gives us your name, email address and an account identifier. Google also gives us the address of your Google profile picture; Apple shares none. We show that picture to you, in your account and on our menu bar while you are signed in. We see it too: when we open your account to help you, and beside your name on your booking’s card in our own studio app, so we can recognise you on the day of your shoot. Nobody in your group sees it. We store its address, not the picture: our site fetches it from Google when your page asks and may hold a copy for up to a day, and our studio app fetches it when we open your booking and keeps it only while the app is open. It is replaced each time you sign in with Google. Closing your account removes the sign-in and the picture’s address with it; your name and email stay on your account record until you ask us to delete them.

What we keep from Instagram and Facebook is listed in What we collect. To have it deleted, email us your username. We delete the conversation from our Instagram or Facebook inbox, so it does not come back into our app, then delete by hand what we hold of it, including copies in our working files and on our phone, and confirm. Your own copy stays in your Instagram or Messenger until you delete it, and Meta keeps its own copy under its own policy.

Bookings and accounts are for people 18 or older, or a parent or guardian booking for someone younger. If you are under 18, please make sure a parent or guardian knows about your session. When we know that someone we photograph for you is under 18, we use their photos only to deliver them unless a parent or guardian gives us a written yes, and never in paid ads.

At an event an organization books with us, the organization looks after permission for anyone under 18, and a parent or guardian can ask us to take a photo of their child down. If someone under 18 gave us information without a parent or guardian knowing, tell us and we will delete what the law lets us.

We are an independent business and a guest on the University of Guelph’s grounds, and our sessions take place outdoors, on and around the campus. The University is not a party to this policy. We do not receive student information from it and do not share yours with it, except when the law requires, or when a University faculty or department books an event with us and the photos go to them.

Questions about your information come to us, not to the University. How we behave on campus, our campus code, is on Our Mission.

We post any change here with a new date. Before we use information we already hold in a new way, we tell you and ask for your yes where the law needs it. Earlier versions are available on request. Questions, access, correction or deletion go to our Privacy Officer at [email protected].