Folklore Creative Company
Privacy policy
Covers folklorecreativecompany.com, portal.folklorecreativecompany.com. Last changed 2 November 2026.
Folklore Creative Company is a photography, film and design studio on Salt Spring Island in British Columbia. The website is where people find our work and write to us, and the client portal is where a project is run with us: the messages, documents, contracts, invoices, galleries and films.
This page says what we hold about the people who use either one, who else handles any of it, and what you can ask us to do with it.
Who is responsible
Sydney Woodward is responsible for the personal information Folklore Creative Company holds. Write to sydney@folklorecreativecompany.com with any question about it, to see what we hold about you, or to have it corrected or deleted.
What we collect, and why
| What | Why | Who sees it |
|---|---|---|
| Enquiries: your name, email address, phone number, the kind of project, its date and place, and what you write to us | To answer you, and to quote and plan the work. An enquiry also opens a lead in the client portal so the conversation stays in one place. | Us |
| Camera fund reservations: your name, email address and phone number, the amount, when and where, whether it is a gift and for whom, and your note. Your card number goes to Square and never reaches us. | To take the payment and to arrange the session | You and us, and our accountant |
| TinType sign-ups: your name, email address, region and town, the sentence beside the mailing-list box and how you set it, the page you signed up on, and the address and browser it came from | To tell you when the tintype studio comes near you, and as a record of what you agreed to | Us |
| Gallery downloads: the email address you give before downloading a selection | To know who took the photographs, and to add you to the mailing list only if you ticked the box | Us |
| A client’s portal: your name, business, contact details and sign-in, the project and its tasks, messages (including replies you send by email), documents and comments, the files and inspiration you add, and any proposals we send you | It is where your project is run | You, the people you add to the project, and us |
| Contracts: your name, your signature, when you signed, and the address and browser you signed from | So there is a record of what was agreed and by whom | You and us |
| Invoices and payments: what is owed, what was paid and when, and who the invoice is for. A card number goes to the payment company and never reaches us. | To take payment and to keep the books | You and us, and our accountant |
| The store and plans: your name, email address and phone number, your order, whether you ticked the box for news, and for a tintype booking, the address it ships to | To fill the order and send what you bought | You and us |
| Calls: who joined a portal call and when, and a guest’s name and email address. For a call held on Zoom, Zoom’s own summary of what was decided. | To run the call and to keep track of what was agreed | The people on the project, and us. Portal calls are not recorded. |
| Photographs, films and film reviews: the work itself, your comments on a cut, and a written transcript of what is said in the film | To deliver the work to you, to take your notes on it, and to show our work where you have agreed to it | You, the people you share a link with, and the public only as you have agreed |
| Visits: which public page of the website was read, the site you came from, and your country and device | To know which pages are read and whether our advertising leads anywhere | Us |
We do not sell personal information, and we collect only what the work needs.
The services that help us run it
Each of these holds or carries personal information on our behalf, and only what it needs to do its part.
| Service | What it does | Where |
|---|---|---|
| Supabase | Holds the databases, the files and sign-in. Passwords are kept only in a one-way scrambled form. | United States (California) |
| Vercel | Serves both sites | United States |
| SendGrid | Sends our email, including the message that sets up a portal account, and receives the replies to it | United States |
| Square | Takes card payments on the website and for tintype bookings | Canada and the United States |
| Stripe and PayPal | Take payment in the store and for plans, on their own pages, when they are switched on | United States |
| The Creatives Ledger | Our own invoicing system: it issues a client’s invoice, takes the payment through Stripe, and records that it was paid | United States |
| LiveKit | Carries the video calls in the portal. Nothing is recorded. | United States |
| Zoom | Hosts some booked calls, and sends back a short summary of what was decided | United States |
| Mux and Vimeo | Hold and play the films. Mux also writes the transcript of a film under review. | United States |
| Dropbox | Holds the original files and carries galleries to the website and the portal | United States |
| Anthropic | Writes a one-line summary of each enquiry for us, polishes a message when you or we ask it to, drafts a reply or a document when one of us asks, and turns an inspiration board into a design brief. Under its commercial terms it does not use what it reads to train its models. | United States |
| Runs the studio’s calendar, which carries a client’s name and may invite them. Google Analytics counts visits to the public pages of the website, and some pages show a video from YouTube. | United States | |
| Meta | The Meta Pixel measures whether our advertising leads to visits and enquiries, on the public pages of the website | United States |
| Mission Control | Our own system, which holds the mailing list and sends to it | United States |
| Browser notifications | Carry notifications to the studio’s own devices, through the browser maker’s push service (Apple, Google or Mozilla). Clients are not sent them. | United States |
Information held or carried outside Canada is subject to the laws of the country it is in, and may be reachable by authorities there.
Cookies, analytics and advertising
Signing in to the portal sets a cookie that keeps you signed in. The portal has no analytics cookie and no advertising measurement.
Opening a journal post that has a password sets a cookie for 30 days so you are not asked again.
The public pages of the website use Google Analytics and the Meta Pixel, which set their own cookies to tell one visit from the next and to measure our advertising. They are not on a gallery, an unlocked post, the editor, or any of the pages we run for others, so the address of a private page is never sent to Google or Meta. A video from YouTube may set YouTube’s own cookies when it plays.
The mailing list
Downloading from a gallery, and signing up to hear about the tintype studio, each offer a box for occasional news of new work, stories and offers from us. It starts unticked. We keep the sentence you saw and how the box was set, and every email from the list carries a way to stop.
If you leave the box unticked when downloading, we still keep your address with the gallery it came from, marked as somebody who has not agreed to hear from us, and nothing from the list is sent to it.
The store records whether you ticked its box for news. No store newsletter is sent today; if one ever is, it will go only to those who ticked it, with a way to stop in every one.
Pages we run for others
Some addresses on folklorecreativecompany.com are sites and tools we build and run for other organisations and for a family. What those pages collect belongs to the people we run them for: we hold it on their behalf, use it for nothing else, and pass a request about it to them. They use the same services named above, and also LiveKit for calls, OpenFreeMap for maps, Open-Meteo for weather, and Google Calendar and Google Fonts.
How long we keep it
Nothing is deleted on a timer yet. A project’s records stay while the client’s portal does. Contracts and payment records are kept for as long as tax law asks, which in Canada is six years.
A few things do end by themselves: a sign-in link stops working after 7 days and a password reset link after a day, a call guest’s link works only on the day of the call, and a download link from Dropbox expires within hours.
Ask us and we delete what we hold about you, except what the law requires us to keep.
Your choices
- Ask to see what we hold about you, and to have it corrected.
- Ask for a copy of your photographs, films and project records.
- Ask us to delete what we hold about you.
- Come off the mailing list from any email on it, or by writing to us.
We answer a request to see your information within 30 days. If you are not satisfied with how we have handled your information, you can complain to the Office of the Information and Privacy Commissioner for British Columbia.
Changes
When this policy changes, this page changes with it, and the date at the top says when. If a change affects how we use what you have already given us, we tell you first.
Written under British Columbia’s Personal Information Protection Act.