Privacy Policy

Midsummer Productions is a wedding videography and photography company. When we say “we” or “us” in this policy, we mean Midsummer Productions and the people who work with us on your wedding. “You” is the person reading this: typically a prospective or booked couple, or someone visiting the public site.

We collect a small set of information, only when you give it to us or visit our site:

• Inquiry details. When you fill out our inquiry form, we receive your name, email, phone number, wedding date, location, and any details you choose to share.
• Job applications. When you apply to work with us, we receive your name, email, phone number if you give one, where you are based, your school if you are applying for an internship, any link you share, what you write to us, and the résumé you upload.
• Account information. If we book your wedding, we create a client portal account for you with your name, email, optional phone, and an avatar if you upload one.
• Payment information.Card details and bank information are entered directly into Stripe’s hosted form. We never see or store your full card number. We only receive a payment confirmation.
• Wedding content. Files you or your guests upload to your client portal (photos, documents, vendor contacts) stay tied to your wedding workspace.
• Visit records.When you visit the public site, our own visit counter records the page you opened, when, how long it stayed open, the site that sent you, your device type, browser and operating system, your approximate location (city level), and your IP address. We keep the address to protect the site: it is how we notice someone trying passwords on the sign-in page. Google Analytics records a similar set for Google’s reports. You can turn both off under “Cookies and visit counting” below.
• How a film played. Our video player reports playback quality to Mux Data: that a film started, paused, buffered, or failed, and on what kind of device.

• To respond to your inquiry and prepare a quote.
• To consider you for work when you apply, and to reply to you. Applications and résumés are read only by the owners of Midsummer Productions.
• To plan, film, and deliver your wedding.
• To send transactional messages (email and SMS) about your booking, contract, payments, and deliverables. SMS specifics are documented in our SMS Policy.
• To process payments and keep accurate financial records.
• To improve the site by understanding which pages people read and which films they watch.
• To keep the site and its accounts secure.

We do not use your information for ad targeting, and we do not sell or rent your information to anyone, ever.

Mobile information, including your phone number and your consent to receive text messages, will not be shared with third parties or affiliates for marketing or promotional purposes.

We work with a small number of trusted vendors who help us run the service. Each one only receives the minimum information it needs to do its job:

• Supabase hosts our database, file storage, and authentication. Your account, wedding details, uploaded content, and our visit records live here.
• Stripe processes payments. Your card details go directly to Stripe; we only receive a payment confirmation.
• MUX delivers your wedding films and our marketing videos, and measures how they played (Mux Data).
• Cloudflare delivers our photos, serves as a content network for the site, and runs Turnstile, the check on the inquiry and application forms that tells a person from a robot.
• Resend sends our transactional emails (booking confirmations, contract notifications, delivery alerts).
• Twilio sends our transactional SMS. See our SMS Policy for specifics.
• Vercel hosts the site and runs cookie-free audience and page-speed measurement.
• Google Analytics 4 measures aggregate traffic. We run it with every advertising signal turned off.

We may also disclose information if required by law (subpoena, court order) or to protect our rights or others’ safety.

The public site counts visits two ways: with our own visit counter, and with Google Analytics 4. Neither follows you to other sites, and we run no advertising trackers, retargeting pixels, or marketing cookies.

These are the cookies involved:

• ms_visitor (ours, 13 months) tells a returning visitor from a new one.
• ms_anon_session (ours, 30 days) groups the pages of one visit together.
• _ga and _ga_followed by our property number (Google Analytics, up to 2 years) do the same for Google’s reports.
• muxData (Mux) lets the video player report playback quality. It is not set when visit counting is off.
• Sign-in and payment cookies appear only once you sign in to a portal or reach a payment page. They keep you signed in and help Stripe prevent fraud.

Who is asked first. In the United States and most of the world, visit counting is on by default. If you are in the European Union, the European Economic Area, the United Kingdom, or Switzerland, it stays off until you say yes on the card that appears.

Your browser’s privacy signal. If your browser sends a Global Privacy Control signal, we treat it as a no and turn visit counting off without asking you. Do Not Track is an older signal with no agreed meaning, and we do not respond to it. Use Global Privacy Control or the switch below instead.

Turning it off yourself. This switch works wherever you live. When it is off, Google Analytics and the video player set no cookies, our own cookies are removed, and your IP address is not kept. We still count that a page was opened.

Vercel measures audience and page speed without cookies and without identifying you, so it runs either way. The signed-in pages (the client portal and the employee portal) carry no analytics at all.

We keep different categories of information for different lengths of time:

• Inquiries that don’t become bookings: kept until you ask us to delete them.
• Job applications: kept until you ask us to delete them, or until we delete them ourselves. Deleting one removes the résumé file with it.
• Booked wedding records:kept indefinitely so that you and your family can return to your gallery and films years later. You can request deletion at any time (see “Your rights” below).
• Financial records: kept as long as required by tax law (typically seven years), even after a wedding record is deleted.
• Visit records: ours are kept while they are useful for understanding and protecting the site, and deleted when you ask. Google Analytics keeps its copy for up to 14 months.

No matter where you live, you can ask us to:

• Send you a copy of the information we have about you.
• Correct anything that’s wrong or out of date.
• Delete your information (subject to legal records we have to keep, like tax filings).
• Opt out of SMS at any time by replying STOP.
• Turn visit counting off with the switch above.

If you’re in California, you have these rights under the California Consumer Privacy Act (CCPA), including the right to know what categories of information we collect and the right to opt out of any future sale of personal information (we do not sell personal information).

If you’re in the European Economic Area or the United Kingdom, you have these rights under the GDPR, including data portability and the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at hello@midsummerproductions.net. We’ll respond within 30 days.

Our services aren’t directed at children under 13, and we don’t knowingly collect their information through the public site or the inquiry form. Wedding films and photos naturally include children in the celebration. Those are shared with the couple and the people they invite into their client portal, and appear in our portfolio only as described in our Terms of Service.

We protect your information with the standard practices you should expect from a small modern team: TLS encryption in transit, encryption at rest on our database and file storage, row-level security so that one couple’s data is never visible to another, and signed short-lived URLs for any private media link.

No system is perfectly secure. If we ever detect a breach that affects your information, we’ll notify you promptly per the timelines required by applicable law.

Midsummer Productions is based in the United States. Our vendors (Supabase, Stripe, MUX, Cloudflare, Resend, Twilio, Vercel, Google) may process information in other countries. If you’re in the EEA or UK and book with us, your data will be transferred to the US under standard contractual clauses with these vendors.

We may update this policy from time to time. We’ll change the “Last updated” date at the top, and material changes will be announced via email to active clients before they take effect.

For privacy-related questions or to exercise any of the rights above, contact us at hello@midsummerproductions.net.