Effective date: 6 September 2026
I am Ryan Kessler, trading as Ryan Kessler Photography, a photographer based in the United States. This policy explains what personal information this website collects, why, who else sees it, and what you can ask me to do about it.
You can reach me about anything on this page at info@ryankesslerphoto.com, or through the contact page.
The short version
No advertising, no profiling, and no analytics or tracking scripts of any kind. I do not track how you move around this site. The only information I hold is what you give me: an email address if you subscribe, and your message if you write to me. Buying is handled by Shopify, on their own pages; nothing of theirs runs here. Nothing here sets a cookie unless you put something in the basket.
What I collect, and when
If you subscribe to the newsletter — your email address, and which page you subscribed from. Nothing else. Subscription is double opt-in: you will be sent a confirmation email, and you are not added until you click it. There is no pre-ticked box anywhere on this site; you are only ever subscribed by typing your address and confirming it.
Your browser never contacts my newsletter provider. The form posts to this site, and the subscription is made from my server — so no third-party script runs and no cookie is set on your machine when you subscribe.
If you use the contact form — your name, email address, the department you chose, and your message. These are emailed to me and are not stored on this website. Your address is used as the reply-to so I can answer you, and you are sent an automatic acknowledgement. As with the newsletter, your browser does not contact the email service directly — the form posts here and I send from my server.
If you buy something — checkout is hosted by Shopify, not by this site. Your payment details, billing and shipping address are entered on Shopify's systems and never pass through this website. When you add something to the basket your IP address is sent to Shopify, which they use to tell one shopper from another; it is not sent while you are only browsing. I receive the order information I need to fulfil it. Prints are produced and shipped by a printing company in Germany, who receive your name and delivery address for that purpose and nothing else; other items I pack and send myself.
Automatically, on every visit — my host records standard server logs, including your IP address, the pages requested and your browser's user agent. These exist to keep the site running and secure.
Photographs are loaded from Sanity, where they are stored, so your IP address and browser also reach Sanity on any page showing one. They set no cookie and run no script.
Cookies
This site sets one cookie, and only if you use the basket. No advertising or analytics cookie is set here, by me or by anyone else, and there is no consent banner because a basket cookie is what the rules call strictly necessary and does not require one.
It is a reference to your basket, set only once you add something to it, and it lasts up to two years unless you clear it sooner. It exists so the basket survives moving between pages, and holds a random-looking code identifying the basket — no information about you.
Do Not Track. Some browsers can send a "Do Not Track" signal. There is no agreed standard for how sites should answer it, and this site does not respond to it — but since nothing here tracks you, there is nothing for it to switch off.
Tracking across other sites. None, by me or by anyone else. There is no advertising network, no analytics, and no embedded component from another company on this site.
How your information is kept safe
- The whole site is served over HTTPS.
- No card details ever reach this website. Payment is taken on Shopify's own checkout, so I never see, handle or store a card number.
- Contact messages are not stored on the website at all — they arrive in my email and live there.
- The credentials for the services below are held as server-side environment variables. They are never sent to your browser and are not in the site's source code.
No system is perfectly secure, and I cannot guarantee that information sent over the internet is completely safe.
Who else processes your information
These services process information on my behalf, each for one purpose:
- Kit (formerly ConvertKit) — newsletter subscriptions and sending. Privacy Policy
- Resend — delivering contact-form email. Privacy Policy
- Shopify — products, basket and checkout. Privacy Policy
- A printing company in Germany — printing and shipping print orders.
- Vercel — hosting and server logs. Privacy Policy
- Sanity — stores the site's text and images, and serves the images to your browser, so they receive your IP address. Privacy Policy
I do not sell your information, and I do not share it with anyone beyond the services above.
Why I am allowed to hold it
Where the UK GDPR or EU GDPR applies to you:
- The newsletter — your consent, given by confirming the opt-in email. You can withdraw it at any time using the unsubscribe link in any email.
- The contact form — my legitimate interest in answering someone who has written to me.
- Orders — performance of a contract, and my legal obligation to keep records of sales.
- Server logs — my legitimate interest in a site that works and is not being attacked.
What happens if you do not give it
Nothing on this site requires you to hand over personal information, and you can read everything here without giving me any. Without an email address I cannot send you a newsletter; without a way to reply I cannot answer a message; without an address an order cannot be delivered.
No automated decision-making
I do not make any decision about you by automated means, and I do not profile you. Nothing here scores, ranks, segments or sorts visitors.
How long I keep it
- Newsletter — until you unsubscribe. After that Kit keeps a record showing you unsubscribed, so you are not added again by mistake; it holds your email address and nothing else you did not give. Ask me and I will delete it outright.
- Contact messages — in my email for as long as I need them to deal with what you wrote about.
- Orders — as long as required for tax and accounting records in the United States.
- Server logs — for the period my host retains them.
Your rights
You can ask me to:
- tell you what information I hold about you, and give you a copy
- correct anything that is wrong
- delete it
- stop using it for a particular purpose
- send it to you or someone else in a portable format
Email info@ryankesslerphoto.com and I will respond within one month. There is no charge.
One limit on deletion: if you have bought something, the law requires me to keep the sales record for tax and accounting. I can delete everything else, and I will tell you what was kept and why.
If you are unhappy with how I have handled it and you are in the UK or the EU, you can complain to your own national data-protection authority — in the UK that is the Information Commissioner's Office, at ico.org.uk. I am based in the United States and have no establishment in the Union, so there is no single lead authority for me; the right one is the one where you live.
Where your information goes
I am based in the United States, and so are most of the services above.
If you order a print, your name and delivery address are sent to a printing company in Germany, who print it and post it to you. They receive nothing else.
If you are in the UK or EU, ordering from me means your information is handled in the United States. Those providers act as my processors under their own data-protection commitments and standard contractual clauses.
Children
This site is not aimed at children, and I do not knowingly collect information from anyone under 16. If you believe a child has given me their details, email me and I will delete them.
Changes
If this policy changes, the new version appears here and the date at the top changes with it. Substantial changes affecting newsletter subscribers will be sent by email.