Privacy Policy

1. Information We Collect

We may collect the following types of information when you interact with our website:

Automatically Collected Information

• IP Address: We log visitor IP addresses for security and analytics purposes.
• Browser & Device Info: We collect user agent strings, browser type, and device information.
• Geolocation Data: We may estimate your general location (city/country) from your IP address.
• Pages Visited: We track which pages you visit and how you navigate the site.
• Visit Date & Time: We record when you access the website.

Voluntarily Provided Information

• Contact form submissions (name, email, message)
• Account credentials if you create an admin account
• Feedback or communication you send to us

2. How We Use Your Information

We use the collected information for the following purposes:

• To provide and maintain our photography portfolio website
• To improve website performance and user experience
• To analyze visitor trends and traffic patterns
• To respond to your inquiries and messages
• To prevent unauthorized access and protect against security threats
• To comply with legal obligations

3. Cookies & Local Storage

Our website uses cookies and local storage for essential functionality, including:

• Session Cookies: Used to maintain your logged-in state and preferences.
• CSRF Tokens: Security tokens to prevent cross-site request forgery attacks.
• Consent Preferences: We store your cookie consent choice.

We do not use third-party tracking cookies or advertising networks on this website.

4. Data Sharing & Third Parties

We do not sell, trade, or rent your personal information to third parties. Your data is only shared in the following circumstances:

• When required by law or legal process
• To protect the rights and safety of Milad Atelier or our visitors
• With service providers who assist in operating the website (hosting providers), under strict confidentiality agreements

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encrypted database connections (PDO with utf8mb4)
• Password hashing using bcrypt with a cost factor of 12
• CSRF protection on all forms
• Rate limiting on login attempts and form submissions
• IP blocking capabilities for malicious users
• Security headers (X-Content-Type-Options, X-Frame-Options, etc.)

6. Data Retention

Visitor analytics data (IP addresses, page visits) is retained indefinitely for analytical purposes unless you request deletion. Admin account data is retained as long as your account is active. You may request deletion of your personal data at any time.

7. Your Rights

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your personal data
• Withdraw consent for data processing
• Object to data processing in certain circumstances

8. Third-Party Links

Our website may contain links to third-party websites (e.g., social media platforms). We are not responsible for the privacy practices or content of those external sites. We encourage you to review their privacy policies before providing any personal information.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.