Your privacy

Who is responsible. Memento Studio & Design (Amira Oloufa), Fairfield, New Jersey, United States, runs this website and is responsible for the personal information described here — the “data controller”, in the words of European law. Write to [email protected] or call (973) 718-0770 with any question or request. This version took effect on November 5, 2026. The date changes whenever the policy does, and the version on this page is always the current one.

When you send an inquiry. The form asks for your name, email address, phone number, what you are photographing, the date and place you have in mind and your message. That goes to a private Google Sheet only the studio can see and is emailed to the studio, a copy is kept in the website’s own private storage (with Cloudflare) that only the studio can read, and an acknowledgement is emailed to you — that is how the inquiry reaches Amira. A spam check by Cloudflare (Turnstile) may look at your browser and address when it is switched on. The studio keeps an inquiry while the conversation is open and for up to two years afterwards, then deletes it, or sooner if you ask. The legal basis is the steps you ask the studio to take before a booking, and the studio’s legitimate interest in answering you. You are not obliged to give any of it, but without an address the studio cannot reply.

When you are a client. The studio keeps what the work needs: your contract (your name, contact details, the event, the fees), invoices (the amounts, due dates, and the day and means of payment — you pay by Zelle or in cash outside this website, so no card or bank details are ever entered here), a page of the shots planned and pictures you like when the studio shares one with you, and, for a proof gallery, the choices you send with your name and note. These are kept for the length of the work and afterwards as the business records the law requires the studio to keep — in the United States, generally seven years for financial records. The legal bases are the contract with you and the studio’s legal obligations.

Your photographs. Photographs of you are made and delivered under the agreement you signed. They are kept in private storage (Cloudflare R2, in the United States) and delivered through a client gallery that only the link and PIN sent to you can open. The studio shows a client’s photographs on this website, its portfolio or its social media only with the permission given in the agreement; you may withdraw that permission at any time by email, and the photographs come down.

Kind words. After a shoot the studio may ask you for a few words. You write them on a page of your own and tick a box if the studio may show them on this website with your first name and the occasion. Without that tick they are never published. You may ask for them to be changed or taken down at any time.

How the website counts its visitors. The website measures itself, and this is the part that concerns every visitor. For each page view it records the page, the time, the domain of the site that linked to it (if any), the country, the kind of device (phone, tablet or computer), the browser family and the browser’s language. It also records when an inquiry is sent, a client gallery opened, a photograph or a gallery downloaded, proof choices sent, or the phone, email or Instagram link pressed. To count visits it uses a code made from your internet address and browser combined with a key that changes every day; the code cannot be turned back into your address. Your internet address is not stored by the website. Its host, Cloudflare, sees every visitor’s address in the ordinary course of delivering the pages and keeps its own short-lived logs for security, as any host does. No cookie is set for the counting. The counts are used only to understand how the website is used and are never used for advertising or to build a profile of you. They are kept for thirteen months and then deleted. The legal basis is the studio’s legitimate interest in understanding its own website, which weighs little against you given how little is kept; you may object at any time by email, and a browser setting that blocks the beacon is simply respected.

New and returning visitors. To tell a first visit from a return visit, the website keeps a random number in your browser’s local storage (not a cookie). The number says nothing about you: the website stores it only in a scrambled form, and it tells the studio no more than that the same browser has been here before, so the studio can count how many different people visit and how many come back. It is not kept at all if your browser sends a Global Privacy Control or Do Not Track signal, and you can remove it at any time by clearing this website’s data in your browser. It is kept for the same thirteen months as the counts, on the same legal basis, and you may object to it in the same way.

Cloudflare Web Analytics. The website’s host, Cloudflare, also counts visits with its Web Analytics, which sets no cookies and does not retain internet addresses, as described in Cloudflare’s own privacy policy at cloudflare.com/privacypolicy.

Cookies and your device. The only cookies this website sets are a cookie that keeps a client gallery open for twelve hours after you enter its PIN, and a sign-in cookie for the studio’s own editor. They are needed for those things to work and are set only when you use them. Cloudflare may set a short-lived security cookie to tell people from automated traffic. Your own choices — stopping the seasonal animation, showing a grid — are kept in your browser’s local storage and go nowhere; the counting number described above is kept there too. There are no advertising cookies and no third-party tracking cookies, which is why the website shows no cookie banner.

Who else handles your information. Two companies process it on the studio’s behalf, under contracts that bind them to use it only for the studio: Cloudflare, Inc. (hosting, storage, delivery, security and its analytics) and Google LLC (the script behind the inquiry form, the private spreadsheet, and the studio’s Gmail account, from which the website’s emails are sent). Nobody else receives it. The studio does not sell personal information, does not rent it, and does not share it for advertising — in the words of California law, it does not “sell” or “share” personal information and has not done so in the last twelve months.

Where it is kept. The studio and its providers are in the United States. If you visit from the European Economic Area, the United Kingdom or Switzerland, your information is transferred to the United States; Cloudflare and Google rely on the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses for those transfers, and you may ask the studio for details of the safeguards.

Your rights. Wherever you live, you may ask the studio what it holds about you, to correct it, to delete it, to receive a copy in a usable form (data portability), to restrict or object to its use where the studio relies on its legitimate interest, and to withdraw a consent you gave (such as for a published testimonial or a portfolio photograph). Email [email protected]. One limit: the visitor counts cannot be tied to a person, so a request about them cannot be acted on, and the studio will say so if that is the case. The studio confirms it is you by replying to the address it holds for you or by asking for a detail only you would know, answers within thirty days (forty-five for California requests), and charges nothing. Someone acting for you needs your written permission. Deletion may be refused only where the law requires the studio to keep a record, such as an invoice. In the EEA you may also complain to your national data protection authority, and in the United Kingdom to the Information Commissioner’s Office. There is no automated decision-making or profiling on this website.

California residents. In the last twelve months the website has collected these categories of personal information: identifiers (name, email address, phone number, mailing address when you give one); commercial information (contracts, invoices and payments); internet activity (the counts described above); rough location (country only); and audio-visual information (photographs of you, made under your agreement). It collects no sensitive personal information and draws no inferences. The sources are you, your browser and Cloudflare. It is used for the purposes described on this page, disclosed only to the two service providers named above, and kept for the periods stated. It is not sold or shared, so there is nothing to opt out of; a Global Privacy Control signal from your browser is honored as an opt-out all the same. You have the right to know, to delete, to correct, to opt out of sale or sharing, to limit the use of sensitive personal information, and not to be treated differently for exercising any of these. Make a request by email or phone as described above. Memento Studio & Design is a small business below the thresholds at which the California Consumer Privacy Act applies, and honors these rights regardless.

Children. This website is not directed at children, and the studio does not knowingly collect personal information from anyone under thirteen (under sixteen in the European Economic Area). Photographs of children are made only under an agreement with a parent or guardian, who may ask for anything about the child to be deleted at any time.

Keeping it safe, and changes. Everything on this website travels over HTTPS, photographs and records are in private storage that only the studio can open, and galleries are behind a PIN. No method is perfect; if a breach ever affected you, the studio would tell you and the authorities as the law requires. When this policy changes, the new version and its date appear here, and clients are told of any material change by email.