Privacy policy — ApertureX

ApertureX is a small event photography and videography business in Brisbane, Australia. This policy covers this website and the private galleries we use to deliver photographs. We handle personal information in line with the Australian Privacy Principles.

What we collect

When you send an enquiry or a message. Your name and email address, and — only if you choose to provide them — your phone number, event type, event date, venue or suburb, how you found us, and whatever you write in the message box. We ask for these because we cannot quote an event without them.

Automatically, on form submissions. A one-way hash of your IP address and the page the form was submitted from. The hash is salted with a secret we hold, so the address cannot be recovered from it — we can tell that two submissions came from the same place without being able to tell where that place is. It exists to stop automated abuse of the forms and nothing else.

If you are a client with a gallery. The photographs and video we took at your event, your name and contact details, and a record of when the gallery link was opened and which files were downloaded, again against a hashed address rather than a real one.

What we do not collect

No analytics or advertising trackers. This site loads no third-party scripts at all — there is no Google Analytics, no Meta pixel, no session recording.
No cookies for tracking. The only cookie this site sets is on a private gallery protected by a PIN, and it exists so you do not have to retype the PIN on every page. Nothing is set on the public pages.
No marketing lists. We reply to your enquiry. We do not add you to anything.
No payment details. We do not take card payments through this website, so there is nothing of that kind to store.

Where it is stored

Enquiries are held in a Cloudflare D1 database and photographs in Cloudflare R2 storage, in the Asia-Pacific region. Cloudflare processes this data on our behalf and does not use it for its own purposes. Both are reachable only by our application — the storage bucket has no public address, so every file request is checked against the link, the expiry and the PIN before a single byte is served.

Access to the administration area is restricted to named email addresses belonging to the two of us, enforced by Cloudflare Access and verified again inside the application on every request.

Private galleries

A gallery link contains a long random token. We store only a cryptographic hash of it, which means that even with full access to our database, nobody — including us — can reconstruct a link and open your gallery from it. If a gallery has a PIN, that is stored hashed as well.

Links expire on a date set when the gallery is created, usually ninety days after delivery. We can revoke a link at any time, and revocation takes effect immediately rather than when a session expires. Please do not post a gallery link publicly: anyone holding it can open the gallery, which is exactly what makes it convenient for you to share with family.

How long we keep things

Enquiries are kept while we are in contact and for a reasonable period afterwards for our business records.
Abuse-prevention counters expire within minutes and are deleted.
Photographs are kept while your gallery is live. After it expires we may delete the files from online storage; we are not an archive, so please download your full-resolution photographs before the expiry date.

Who else sees it

Nobody, other than Cloudflare as our hosting and storage provider, and — if we send you a gallery notification by email — the email provider that carries that message. We do not sell personal information and we do not disclose it overseas beyond the storage arrangement described above, except where we are required to by Australian law.

Photographs of people

Event photography inevitably captures guests as well as clients. We publish work in our portfolio only where we believe we have the agreement to do so, and if you appear in an image on this site and would like it removed, email us and we will take it down. You do not need to explain why.

Your rights

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. Email hello@aperturexaustralia.com and we will respond within a reasonable time. There are two of us, so it will be one of us reading it.

If you are unhappy with how we have handled your information, tell us first and we will try to put it right. You can also complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Security

The site is served over HTTPS only. Form input is validated on the server and written to the database using bound parameters, which means input cannot be interpreted as a database command. A strict Content-Security-Policy prevents unauthorised scripts from running on these pages. Secrets are held in Cloudflare's secret store rather than in our code.

No system is perfect, and we would rather say that than claim otherwise. If you find a security problem with this site, please email us before disclosing it publicly and we will fix it.

Changes

If this policy changes we will update the date at the top. Material changes affecting existing clients will be sent by email.