Privacy Policy
Who I Am
In case you are not aware, you are currently at website address : https://www.grafphoto.com. This is the official website for Graf Photography, run by Mark Graf, Chief Creative Officer, photographer, copywriter, web site designer, tinkerer, administrator, marketing manager, security tech and dog servant. I’ve attempted to explain in clear language, as concise as possible, and with poor attempts at humor, the efforts made to protect your privacy while visiting and interacting with my site.
What personal data we collect and why we collect it
Comments
This site has a blog named “Notes from the Woods” which allows comments. As any blog owner knows, comment spam is an ongoing issue. If you are a well-intended visitor, no problem and welcome! To keep this site from filling with content that you don’t want to read, and I certainly don’t want filling the comment areas, some basic info is stored. When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string (that type of browser you are using, device, etc) to help spam detection.
An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your Gravatar profile picture (if you have one) is visible to the public in the context of your comment. Otherwise a random icon is generated.
If you don’t use this feature of the site, none of this applies to you of course.
Cookies
If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment on a return visit (which you will do… right??). These cookies will last for one year.
Embeds
Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website. So if I link to a YouTube video and it is embedded in a blog post for example, it saves you the time of going to that site to view it.
These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracing your interaction with the embedded content if you have an account and are logged in to that website. Privacy policies are available at each of these individual sites where the content is originally hosted. Please use the appropriate browser privacy settings for extra layers of protection.
Who we share your data with
I do not sell or trade your information with third parties unless you happen to be a bear, bird, or other critter as a subject of one of my photographs. In that case, your likeness may be sold, and it is entirely my fault for not recognizing your species’ evolution to the point of having this concern. I do use various tools to manage my site, purchases, license and monetize some of my original content. Those are referred to below.
PayPal
If you make a purchase from my site (which you intend to do right?), of course I need personal information that helps me ship a big, gorgeous print to you. I use Paypal as a payment processor, for as many years as I can remember, for reliable, secure payments. Therefore they securely collect the necessary information to arrange the payment transfers. I do not receive any information about your credit card numbers or bank accounts.
The same applies if you are a commercial client and are paying by a manually sent invoice. You can find out more about Paypal’s privacy policy here. Paypal securely transfers your address information to me so it can be used for shipping purposes only. Your address is not used for any other purpose.
MailChimp
If you have subscribed to comments or my kickass, not-done-very-often newsletter, your email address is used solely to facilitate delivery of those specific items that you explicitly requested. My site keeps track of subscribers.
If you sign up for my newsletter, your email will be held in a database managed by Mailchimp. Your email is only used and known to me, and only used for the purposes of sending out my “not-done-often-enough” kickass newsletter and special offers to those that request it. (HINT: COUPONS!) Mailchimp’s privacy policy is here.
Amazon
If you make a purchase through an affiliate link, such as Amazon, I only see what was purchased in a generic report that totals up affiliate sales. No personal information is made available to me in this process.
I use Google Analytics on my site for the purposes of keeping an eye on traffic for specific pages and the overall site. It is usually a detriment to my morale to look at it, so “keeping an eye on it” is a loosely used term. Google retains information regarding browsers, devices, keywords that help me in maintaining, optimizing and updating the design of this site. You may see this aspect appear in “tracker blocking” reports. Their privacy policy is here.
As of Jan 2022, I started implementing some Google Ads on my site. These are only used on select pages. I receive no personal identifying information from these ads. To learn more about Google privacy, see here: How Google uses data when you use our partners’ sites or apps
Cloudflare
My site uses a cloud-based service called Cloudflare at the “front door”. “The Cloud” is so busy these days right? This serves to speed up all this high-quality content delivery to you, and provides an extra measure of security for my site, as well as to you in keeping bad guys out. This service only provides generic reports to me on traffic processed through Cloudflare, and threats (that include country of origin and IP address). You can read about their privacy policy here. I receive no personally identifying information from Cloudflare.
How long we retain your data
If you leave a comment, the comment and its metadata are retained indefinitely, or until I die and this site fades away, whichever comes first. This is so I can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.
For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information. If you feel a small prick in your finger while visiting here, no worries, it is just a check on your blood. (Kidding! Sheesh!)
Those that sign up for my kickass newsletter will have their email’s stored for the purposes of that newsletter delivery until an unsubscribe action takes place or you turn mean.
If you use my contact form, your message may be stored on my website servers so that I can reference it in the future should I need to contact you or if there are troubles with it sending via email (sometimes happens!). These messages are held as private communications and protected by the security firewalls and features of this site. These messages will be retained for future reference.
Names, emails, addresses and purchase receipts are kept in my private files for the purposes of tax records and to track where my prints have gone. These messages will be retained for 20 years on encrypted drives, or in some future archeological dig site when our civilization as we know it has vanished.
What rights you have over your data
If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data I hold about you, including any data you have provided to me. You can also request that I erase any personal data we hold about you. This does not include any data I am obliged to keep for administrative, legal, or security purposes. If we have to break up, I retain the right to ask what I have done to wrong you and throw shade privately.
You always have the option to unsubscribe from my kickass, not-done-very-often newsletter or comment subscriptions. Information on how to do that is always sent with these distributed communications.
Where we send your data
Visitor comments may be checked through an automated spam, super AI, glowing red eyes detection service. IP addresses may be checked through security plugins for blacklisted IP’s known for bad behaviors. This is solely to protect the operation of this website. (Seriously Luxembourg, stop it!)
How I protect your data
My site is on a secure server and uses the HTTPS protocol to encrypt your visit and any data that is exchanged. In addition, traffic is routed through several big, beautiful security firewalls to protect the operation of this site. It is triple protected by security firewalls at Cloudflare, at my web host, ninja throwing stars, and through security features of my site itself. Add in a fourth protection – I am not a jerk and won’t be selling your data (except that part about likeness if you are a bear or a squirrel). If you are a bear, can read, and work in website security, well I may seek you out as yet another layer of protection.
What data breach procedures we have in place
This site uses security firewalls, big beautiful firewalls, and multiple firewall barriers to make sure your data and your visit is safe, and to protect the operation of this website. You would not believe the number of walls…massive, massive walls.
What third parties we receive data from
If you make a purchase, I will receive your name, email, and address information, along with the purchase details, from Paypal as a necessity in completing the transaction. This information will not be sold to any third party, and the email address is only used to issue a certificate for One Tree Planted.
What automated decision making and/or profiling we do with user data
The only automation that takes place on this site is checking if you are a crafty hacker or spammer trying to break into it. That just pisses me off and it’s not nice. Therefore some automated checks are done against blacklisted IP addresses or countries. If you are not doing any of those things, you are not being profiled.
This page may be updated at any time as the site evolves, adds new features or bears learn to read.
If you have made it this far, thank you for visiting and your time in reading through all this stuff! Setting aside some of the poor attempts at humor on this page, your privacy is a serious concern and fully respected. Please let me know if you have any concerns.
See you in the woods,
~ Mark
Contact at : [email protected]
Published 22May2018, revised 18Feb2022