Last updated: October 6, 2026

This policy explains what information Hariel Xavier Photography collects when you visit our website or work with us, how we use it, and what choices you have.

By using our website at harielxavier.com or booking our services, you agree to the practices described here.

Information We Collect

Information You Give Us Directly

When you reach out through our contact form, book a session, or communicate with us, we may collect:

Your name and your partner’s name
Email address
Phone number
Wedding or event date
Venue name and location
Guest count and budget range, if you choose to give them
Your message and any other details you share with us about your wedding plans
What you type into our live chat or the wedding timeline tool

We only collect what we genuinely need to serve you well and deliver an amazing experience on your wedding day.

Information Collected Automatically

When you browse our website, certain information is collected automatically through cookies and similar technologies:

Pages you visit and how you interact with our site
Your IP address, browser type, device type, and operating system
Referring website or search terms that brought you here
General geographic location (city/region level, not exact)
How you first arrived: the landing page, the referring site, any campaign (UTM) tags in the link, and ad click IDs such as Google’s gclid and Meta’s fbclid. This is saved in your browser on your first visit (hx-attribution) and sent to us with your inquiry so we know which channel brought you here.

How We Use Your Information

We use the information we collect to:

Respond to your inquiries and communicate with you about your wedding or session (new inquiries and chat messages are also forwarded to Mauricio’s phone so he can reply quickly)
Schedule, plan, and deliver our photography services
Send you your gallery, invoices, and contracts
Improve our website and understand what content is most helpful to couples
Measure and improve our advertising on Google, Facebook and Instagram, including telling Google and Meta when an inquiry came from one of their ads, so we can reach other couples who may be looking for a wedding photographer
Follow up with occasional marketing emails (you can unsubscribe anytime)

Third-Party Services We Use

We work with a few trusted third-party services to run our business and improve your experience. Here’s who they are and what they do:

Google Analytics 4 (analytics and advertising measurement)

We use Google Analytics 4 to understand how visitors use our website — which pages are read and how people find us — and to measure our Google advertising. Google Analytics sets cookies with a unique browser identifier and records the pages you view, your IP address (which Google uses to estimate a general location), and device and browser details. It is loaded with Google’s advertising features turned on (the Consent Mode settings ad_storage, ad_user_data and ad_personalization default to granted), so Google may use this data for ad measurement and audiences. When you send an inquiry, our server also reports a “lead” event to Google through the GA4 Measurement Protocol, tied to your browser identifier (or, if there is none, to a one-way hash of your email address). You can learn more about how Google handles data at Google’s Privacy Policy. You can opt out with the analytics control on our cookie policy page (described below), or by installing the Google Analytics Opt-Out Browser Add-On.

Meta Pixel and Conversions API (advertising)

We use the Meta Pixel, an advertising tool, to measure and improve our ads on Facebook and Instagram. The pixel records the pages you view on our site and sets the _fbp cookie (and _fbc when you arrive from a Meta ad). We configure it not to collect form fields or button text automatically. When you send an inquiry (through a form, or by leaving your email in the chat), our server also sends the lead to Meta’s Conversions API with your email address, phone number and first and last name (each hashed with SHA-256 before it leaves our server), your IP address, your browser’s user agent, and the _fbp/_fbc identifiers, so Meta can match the inquiry to an ad. You can manage your ad preferences through your Facebook Ad Settings, or stop the pixel from loading in your browser with the opt-out control on our cookie policy page.

Inquiry form, Supabase and Resend

Our inquiry form is built into this website. When you send an inquiry, the details you enter (plus the arrival details described above) are stored in the studio’s own database, hosted on Supabase, and confirmation, follow-up and notification emails are sent through Resend, our email delivery provider. We do not hand your inquiry to a third-party CRM.

Telegram (notifications to the owner)

So Mauricio sees new leads quickly, the details of each inquiry (name, partner’s name, email, phone, date, venue, guest count, budget, message and how you found us), planner-kit requests, and live chat messages and chat transcripts are forwarded to him as private messages through Telegram.

Vercel

This website is hosted on Vercel, which processes standard server logs (such as IP address and request details) to serve the pages you request. Requests from our live chat assistant and timeline tool to the AI model are routed through Vercel AI Gateway (see below).

Google Places (reviews)

The Google reviews shown on our site are fetched from Google’s Places API on our server and cached. Nothing about you is sent to Google when reviews are displayed; the reviews themselves are public content from Google.

Picsui (client galleries and live slideshow)

Wedding galleries and the live guest photo slideshow are delivered through Picsui, a separate product with its own privacy policy. When you or your guests use a Picsui gallery or slideshow, Picsui processes that activity under its own terms; this website does not host guest uploads.

Cloudinary

We use Cloudinary to host and deliver images on our website. When you view photos on our site, they are served through Cloudinary’s content delivery network. Cloudinary may collect standard server logs. You can learn more at Cloudinary’s Privacy Policy.

Live chat, AI assistant and timeline tool

The chat on our website is built by us, not a third-party chat vendor. Messages you send, and any name or email you leave in the chat, are stored in our own database, hosted on Supabase, so Mauricio can pick the conversation up and reply, and they are forwarded to him through Telegram (above). If you leave your email in the chat, your email and the chat transcript are saved as an inquiry and handled like one, as described above. When you chat with the automated assistant, the text of the conversation (your recent messages and the assistant’s replies) is sent through Vercel AI Gateway to Perplexity, whose Sonar model generates the reply. Our AI wedding timeline tool uses the same model: the ceremony time, getting-ready time, venue name, guest count and other details you enter are sent the same way to generate your timeline, and are not stored by us. Please do not share payment details or other sensitive information in chat; use email or the contact form for those. To keep the chat tied to you across pages, your browser stores a random chat session ID that is sent to our server with each message, and our server sets a live_chat_session cookie (see our cookie policy).

Cookies

Our cookie policy lists every cookie and browser-storage item in detail. In short:

Analytics and advertising cookies: set by Google Analytics 4 (site traffic and Google ad measurement) and the Meta Pixel (Facebook and Instagram ad measurement).
Functional cookies: live_chat_session (set when you use the chat, kept 30 days) and wedding_access_<page> (set for 24 hours after you enter the password for a private wedding page).
Essential cookies on sign-in pages only: a security cookie (csrfSecret) and Supabase sign-in cookies on the client dashboard and sign-in pages.

You can switch Google Analytics and the Meta Pixel off with the opt-out control on our cookie policy page, or with the “Opt out” link in the notice shown on your first visit. Either stores a small flag (hx-analytics-optout) in your browser and, while it is set, neither tag is loaded and your inquiry is not reported to Google or Meta. We also honor Global Privacy Control: if your browser sends a GPC signal, we treat it as the same opt-out automatically. Most browsers also let you block or delete cookies in their settings.

Data Retention

We keep your personal information only as long as it’s needed for the purposes described in this policy:

Inquiries that don’t become bookings, and chat transcripts: we keep these for up to 24 months from your last message, so we can pick the conversation back up if you return, and delete them sooner on request.
Clients: we typically keep contact information and project records for up to 5 years after your wedding to support reorders, referrals, and album requests, or longer where tax or contract law requires it.
Analytics and advertising data: kept by Google and Meta under their own retention settings.

Your Rights

You have the right to:

Access the personal information we have about you
Correct any inaccurate information
Request deletion of your personal data (subject to any legal or contractual obligations)
Opt out of marketing communications at any time
Opt out of analytics and advertising tracking (including what some US state laws call “sharing” or “targeted advertising”) using the control on our cookie policy page, a Global Privacy Control signal, or the tools mentioned above

We don’t sell your personal information for money. Sending browsing events and hashed inquiry details to Google and Meta for ad measurement, as described above, may count as “sharing” or “targeted advertising” under some state privacy laws; the opt-outs above stop it. To exercise any of these rights, contact us using the details below.

Data Security

We take reasonable measures to protect your personal information from unauthorized access, loss, or misuse. Our website uses HTTPS encryption, and we work with reputable third-party services that maintain their own security standards. That said, no method of transmission over the internet is 100% secure, so we can’t guarantee absolute security.

Children’s Privacy

Our website and services are not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we’ll remove it promptly.

Changes to This Policy

We may update this privacy policy from time to time. When we do, we’ll update the “Last updated” date at the top of this page. We encourage you to check back occasionally, but we’ll never make major changes without giving you a heads up.

Questions?

If you have any questions about this privacy policy or how we handle your information, contact us:

Hariel Xavier Photography
Owner: Mauricio Fernandez
Sparta, NJ 07871
Email: Mauricio@HarielXavier.com
Phone: (862) 391-4179