This is how Tipuna Studio collects data, runs advertising and answers privacy requests.

Effective date

This policy took effect on September 7, 2026. Any version published before that date no longer applies.

Who controls this data

Tipunaqe, trading as Tipuna Studio at tipunaqe.com, is the controller of the data described in this policy. The studio operates from 127 Cedar Court, Austin, Texas 78904, United States, and that address is also where a written data request should be sent.

Data collected

The inquiry form on this site (which posts to submit.php) records the name, phone number, email address, the address or area named for a sitting, the kind of session selected, any notes typed into the message field, the session specification if one was built with the configurator tool, and the consent tick itself. Alongside that, the form records the visitor's IP address, browser user-agent string, the page that referred them, and the two timestamps marking when the form was rendered and when it was submitted.

The support chat widget (which talks to chat.php) keeps the message thread and a return token in the visitor's own browser, plus whatever name, phone or email the visitor volunteers when starting a conversation.

Separately from either form, this site reads cookie identifiers and the advertising click identifiers that a paid ad platform appends to a link a visitor arrives on: gclid from Google Ads, msclkid from Microsoft Advertising, and fbclid from Meta Ads where a campaign runs there.

Why each category is collected

Name, phone, email and address answer and schedule a specific sitting — without them the studio cannot reply. Notes and a session specification let the photographer prepare before a first call. IP address, user-agent and referrer data help identify abuse of the form and diagnose delivery problems, and the two timestamps confirm how quickly an inquiry was answered. Chat transcripts and the return token let a visitor pick a conversation back up without repeating themselves. The click identifiers and cookie identifiers measure which advertising campaign produced an inquiry, so spend can be judged against results.

Legal basis for each use

Handling an inquiry or a chat message rests on contract — taking the steps needed to arrange a sitting a visitor asked for. Keeping technical and log data rests on legitimate interest in running a working, abuse-resistant site. Reading advertising click identifiers, and any advertising or analytics storage tied to them, rests on consent, gathered through the banner described in the next section and withheld by default until a visitor allows it.

Advertising platforms in use

Google Ads and Microsoft Advertising send paid traffic to this site, and a Meta Ads campaign may as well. Google Ads attaches a click identifier called gclid to the links it sends visitors through; Microsoft Advertising attaches its own identifier called msclkid; a Meta Ads click carries fbclid. Each identifier is read from the landing URL and, where the visitor has allowed advertising storage, is used to connect that click to whatever happens next on this site.

None of this should be read as an endorsement. No advertising platform named on this page has reviewed, approved or verified the content of this site — running a campaign through their system carries no such claim.

Who receives this data

Beyond Tipunaqe, the following parties process pieces of the data above. Google Ireland Ltd and Google LLC receive the consent signals and the gclid identifier through Google Ads. Microsoft Ireland Operations Ltd receives the msclkid identifier through Microsoft Advertising; its own handling of that data is covered separately by the Microsoft privacy statement at privacy.microsoft.com/privacystatement. Meta Platforms Ireland Ltd receives the fbclid identifier through Meta Ads on any campaign that runs there. Outside advertising, a hosting provider serves this site and stores the enquiry database, and a mail provider carries the notification email from an inquiry into the studio's inbox. No other party buys, rents or otherwise receives this data.

Where data travels

Because the platforms above operate internationally, an inquiry or a click identifier can be processed outside the country where a visitor is physically located, including transfer from the European Economic Area to the United States. Where that happens through Google, Microsoft or Meta, it relies on those companies' own standard contractual clauses and other lawful transfer mechanisms rather than any arrangement unique to this site.

Consent Mode v2

This site runs Google's consent mode v2. Four signals — ad_storage, ad_user_data, ad_personalization and analytics_storage — are held denied by default for every visitor, before any choice is made. Only after a visitor actively allows storage through the cookie banner do those four signals switch to granted. Declining, or later withdrawing consent, sets all four straight back to denied; nothing about that reversal is delayed or partial.

Global Privacy Control

Where a visitor's browser sends the Sec-GPC header, this site treats it as an opt-out signal automatically. Global Privacy Control is honoured the same way a manual decline is: advertising and analytics storage stay denied, and the visitor is not asked to repeat the choice through the banner.

Rights under the GDPR

A visitor reaching this site from Europe has the rights set out under the GDPR: access to the data held about them, rectification of anything inaccurate, erasure, restriction of processing, portability of the data they provided, objection to processing based on legitimate interest, and withdrawal of consent at any time, with no effect on processing that happened before the withdrawal.

Rights under US state privacy law

Visitors in the United States have rights under state privacy law, including the CCPA as amended by the California Privacy Rights Act, and the comparable laws now in force in other states. Those rights include knowing what data is held, requesting deletion or correction of it, and opting out of the sale or sharing of personal information for cross-context advertising. This site does not sell data for money; the advertising click identifiers described above count as sharing under some of those laws, and a visitor can opt out of that sharing the same way they decline the cookie banner or send Global Privacy Control.

Children

This site is not directed at children and the studio does not knowingly collect data from anyone under 13. A parent or guardian who believes a child has submitted data through the inquiry form or the chat widget can write to the address in the contact section below and it will be deleted.

Complaints

A visitor who believes their data has been mishandled can complain to their state Attorney General, and Californians specifically can complain to the California Privacy Protection Agency, in addition to raising the matter directly with the studio using the contact details below.

How long data is kept

Inquiries and their email copies are kept for 24 months. Chat transcripts are kept for 18 months. Server and access logs are kept for 90 days. The record of a consent choice is kept for 12 months before it expires and a visitor is asked again. Past those windows, the relevant record is deleted rather than archived indefinitely.

Security measures

Form submissions travel over an encrypted connection. The enquiry database sits behind the hosting provider's access controls rather than an open folder, and it is not exposed to search engines. Two hidden fields on every form catch automated spam submissions before they reach a human inbox. No system is unbreakable, and this section is not a guarantee that no breach can occur — it is a description of what is actually in place today.

How to exercise these rights

Send a request by email to office@tipunaqe.com or by post to Tipunaqe, 127 Cedar Court, Austin, Texas 78904, United States. Say plainly what is being asked for — a copy, a correction, deletion, or an opt-out of sharing — and include enough detail (typically a name and email or phone number used on a prior inquiry) to locate the record. A reply follows within 5 days. The dedicated request page and form are at the data request page.

Changes to this policy

If this policy changes, the date at the top of this page changes with it and the revised version replaces this one at the same address. Material changes — a new advertising platform, a new retention period — are described in the relevant section rather than buried in a single changelog line.

Contact

Reach a person directly at office@tipunaqe.com or by phone at +1 (809) 555-7404, or in writing at 127 Cedar Court, Austin, Texas 78904, United States. This is the same address and inbox that runs the studio itself; there is no separate privacy department to route through.