Privacy Policy

Who this is

This site is run by Tanner Stutz, a sole proprietor trading as Stutz Media, based in Western New York, United States. In this policy “I” means that business and “you” means anyone visiting stutzmedia.com. You can reach me through the contact page about anything written here, including a request to delete your information.

What I collect

When you send a message

The contact form records your name, your email address and your message, along with the subject you picked. If you’re asking about a booking it also records whatever you choose to add about the date, session type, location and budget range. All of it is optional except your name, email and the message itself, because without those I can’t reply.

When you order a print

An order records your email address, the name and shipping address you give, what you ordered, and what it cost. It also stores the reference numbers Stripe uses for the payment, so a refund can be matched back to the right order.

Your card details are never sent to this site and never stored on it. The payment form is served by Stripe inside a frame on the checkout page; the card number goes directly from your browser to Stripe. I never see it.

When you open a private gallery

Private client galleries are opened with a passcode. The passcode itself is never stored — only a salted scrypt hash of it, which can’t be reversed back into the passcode. Once you’re in, your browser holds a signed cookie containing a random identifier. That identifier is what your favourites are recorded against, which is how your selections are still there when you come back. It is not linked to your name or your email address, and it identifies a browser, not a person.

Spam protection on the contact form

To stop the form being used to send hundreds of messages, submissions are counted per sender per hour. Your IP address is not stored to do this. It is combined with a secret and hashed, and only the hash is kept — so the record can’t be used to work out where you were or who you are. Those hashes are deleted automatically after 24 hours.

Analytics

I use Vercel Web Analytics to see which pages get visited. It is cookieless and does not build a profile of you or follow you to other sites. It reports aggregate counts — page views, referrers, country, device type — not individuals. There is no Google Analytics on this site, no advertising pixel, and no third-party tracker of any kind.

Cookies

This site uses a small number of cookies and all of them are necessary for something you asked it to do. None of them are advertising cookies, and none of them track you across other websites — which is why you are not being asked to consent to a banner before you can read the page.

• Private gallery access — set only when you enter a gallery passcode. It keeps you signed in to that gallery and remembers your favourites for 30 days. It is cryptographically signed so it can’t be forged, and marked HttpOnly, so JavaScript on the page can’t read it.
• Payment fraud prevention — Stripe sets its own cookies on the checkout page to detect fraudulent card use. These appear only when you’re actually buying something.
• Administrator sign-in — set only for me, when I log into the admin area. An ordinary visitor never receives one.

Who else sees it

I don’t sell your information, rent it, or share it for anyone else’s advertising. A small number of companies process it on my behalf so the site can function:

• Supabase — the database and photo storage behind the site. Inquiries and orders are stored here.
• Stripe — payment processing. Stripe handles your card details directly and is the payment controller for that data under its own privacy policy.
• Resend — sends the notification and confirmation emails when you get in touch or place an order.
• Vercel — hosts the site and provides the cookieless analytics described above.
• Esri — supplies the background map tiles on the map page. Loading that page requests those tiles from Esri’s servers, which means your IP address is visible to them, as it would be to any site you load an image from. No other page on this site contacts them.

Beyond that, I would only disclose information if the law actually required it.

How long it’s kept

• Inquiries — kept while there’s a reasonable chance of a conversation continuing, and deleted on request.
• Orders — kept for seven years, because tax and business records have to be.
• Spam-protection hashes — deleted automatically after 24 hours.
• Gallery favourites — kept for the life of the gallery, and removed when it comes down.

Your choices

Write to me through the contact page and I will, within a reasonable time and at no charge: tell you what I hold about you, correct anything wrong, or delete it. The one thing I can’t delete on request is a completed order, for as long as I’m required to keep the record of the sale — but I can remove everything that isn’t part of that record.

I don’t sell or share personal information as those terms are defined under California law, and I never have. Emails I send you about an order are transactional. I don’t run a marketing mailing list; if that ever changes, it will be something you opt into, with a way out of it in every message.

Children

This site isn’t directed at children under 13 and I don’t knowingly collect anything from them. If you believe a child has sent me their information, tell me and I’ll delete it.

Where this is processed

The site and its services are operated in the United States and prints are sold and shipped within the United States only. If you’re writing from elsewhere, your information will be processed in the United States.

Changes

If this policy changes, the date at the top of the page changes with it. Material changes will be obvious on the page rather than slipped in quietly.