Privacy policy

1. Controller

Blas Ariel Quintana Domínguez (Blash brand), event photographer and filmmaker based in Saltos del Guairá, Paraguay.

Contact: WhatsApp +595 985 388 582 and Instagram @blashquintana.

2. What data I collect

When you request a quote from the public form: your first name, last name, phone, and optionally email, event type, date, location, guest count, and message.

When you create your account: your first and last name, your language, the date you accepted this policy, and how you sign in — with Google, your Google account identifier and its email; with username and password, your username and an irreversible fingerprint of the password (the password itself is never stored). Also a log of your access: when you signed in, failed attempts, from which network address, and which event you linked to your account.

When you enter your private gallery with your access code: a signed session cookie (HttpOnly, no tracking or profiling), your preferred language, and a technical log of your photo selections and comments.

When you use your event's digital invitation: the guest list you load (name, phone, how many people), their replies, and the photos your guests upload to the party gallery with the name they type.

When we work together on your event: the photo and video files of the event, which may include images of you and your guests.

I also keep operational metadata: quotes sent/accepted, recorded payments, WhatsApp conversations summarized as internal notes, and the basic history of the relationship.

3. What I use it for

To contact you and coordinate the service you requested, generate your quote and the proofing gallery, deliver the final photos/videos, and keep accounting records of my work.

Your account lets you reach what's yours —your events, your quotes, your photos— without codes, and lets me know it's you. The access log exists to detect attempts to reach other people's data and so you can ask me what happened with your account.

The data is NOT used for advertising, automated profiling, credit scoring or similar. It is NOT sold to third parties under any circumstances.

4. Who it's shared with

Final photos and videos are stored in my personal Google Drive (you download them from a private gallery). Google is responsible for Drive infrastructure under their own terms.

If you choose to sign in with Google, Google confirms who you are (name and email) and nothing more: I get no access to your Drive, your mail or your contacts, and I store no key to your Google account. What Google records about that sign-in is governed by its own policy.

System hosting runs on Cloudflare (Workers + D1). Your data lives in the system database with at-rest encryption.

I don't share your data with marketing agencies, social networks, or other photographers. If I ever recommend a colleague or vendor, I give YOU the contact — I don't share your data directly.

5. Cookies and tracking

The site uses only necessary technical cookies: your account session (lasts 30 days and ends when you sign out), the code-based gallery session (signed with HMAC), your selected language, two ten-minute cookies while you sign in with Google, and a temporary log of attempts to prevent brute-force attacks. No third-party cookies, no Google Analytics, no Facebook pixels or similar.

6. Your rights

At any time you can ask me to: see what data I have about you, correct it if wrong, delete it when we're no longer linked by an active job, or restrict its use.

You can ask me to delete your account: your access, your sessions and your access log are removed. Photos, quotes and payments of an event we did together are not deleted with the account —they belong to the contracted work— and are kept for the time stated in section 7, unless you ask me to delete them.

To exercise any of these rights, message me on WhatsApp or email and I'll handle it within a few days.

7. How long I keep data

Contact details and service history: while the relationship is active and up to 2 years afterward, so you can hire me again without repeating everything.

Your account: as long as you use it. Sessions expire after 30 days; the brute-force attempt log is deleted after 7 days.

Final photos in Drive: as long as you want. If you ask me to delete them, I delete them completely.

Automatic backups in private Drive: rotate every 30 days (the daily cron uploads a new one and deletes the old).

8. Changes to this policy

If I update this policy, the date above changes. If the change substantially affects how your data is used, I'll let you know on WhatsApp beforehand.