Your data, and your family’s face

Roel Tobias Portrait Studio — a portrait studio at 504 W Pecan Blvd, Ste 120, McAllen, Texas 78501, reachable at (956) 683-5992. One photographer, not a company with departments: the person who answers your message is the person who takes the photographs and the person who holds the files.

This notice covers this website, the messages you send the studio, and the photographs made in a session. It is written in plain language on purpose. Where a sentence sounds like a promise, it is one.

What you send me

Your name, phone number, the type of session, a possible date and whatever you write in the message. The form on this site does not send anything to a server of mine. It composes the message in your browser and opens it in WhatsApp, so what reaches me is a WhatsApp message you chose to send — and it reaches me through WhatsApp, which is a Meta service with its own privacy policy.

If you call the studio, I have your number. If you book, I also keep what a booking needs: the date, the people in the session, the quote, the payment record, and an email address if you give me one — that is how the gallery link reaches you.

Photographs

A portrait session produces images of you and of the people who came with you, including children. Those images are personal information about recognizable people, and this notice treats them as such: how they are used is section 04, and how you take them down is section 05.

What the website records on its own

Like any website, this one is served by a host that logs the technical data of each request — IP address, browser, time, page — for security and to keep the site running. Those logs are Vercel’s and are kept for a short time.

The contact page embeds a Google Map so you can find the studio. That map is loaded by Google, and Google may set its own cookies when it loads. It is the only third-party content embedded anywhere on this site.

To answer you, quote your session, agree on a date, photograph it, deliver your gallery, fill print orders, invoice, and keep the records a business is required to keep.

To show my work — portfolio, website and social media — only within the permission you gave for the images of your session, which is what section 04 is about.

I do not sell your personal information. I do not trade it, rent it, or hand it to data brokers, and photographs of your family are not licensed to stock agencies or to advertisers.

This is the part of the notice that matters most, so it is written without hedging.

A photograph of your child is published only if a parent or legal guardian said yes, in writing, on the session agreement. No signature means no publication. There is no default, no implied consent and no small print that turns silence into a yes.

You can say yes to your own portraits and no to your children’s. Plenty of families do, and it is a normal choice, not an awkward one.

When a family has said yes, this is what I still never do:

• Publish a child’s full name, age, birth date, school or home address.
• Geotag a private home or a school, or say where a child can be found on a given day.
• Sell or license a child’s image to a stock library, a brand or an advertiser, or supply it for training artificial intelligence models.
• Run advertising that targets children, or use a child’s image in any way that could embarrass them later.

One thing I cannot control, said plainly: a photograph published on Instagram, TikTok or Facebook lands inside those platforms’ own systems, and those systems may apply face grouping or recognition technology of their own. No permission of yours and no promise of mine changes that. What I do control, I keep switched off — the gallery your images are delivered through has face recognition disabled, and I use no tool that groups my clients’ faces.

If parents are separated or custody is shared, the person booking confirms they have the authority to consent. If that changes — a court order, a new agreement — tell me and the images come down.

And a child who was three when the picture was taken becomes an adult one day. When they ask for their own image to be removed, it comes down, without going back to their parents for permission.

Write to me and say which image, or say all of them. You do not have to explain why, and asking costs nothing.

I remove it from this website, from my portfolio and from the Studio’s Instagram, TikTok and Facebook accounts, and I stop using it in anything new. Then I write back to tell you it is done.

The honest limit: I cannot recall printed samples already handed out, copies other people downloaded or reshared, or what platforms keep in their own caches and archives. Removal works from that moment forward, which is exactly why the permission is asked for beforehand.

A one-person studio still needs a few services to work. Each one sees only what its job requires:

• WhatsApp (Meta) — the messages you send me, your phone number and your profile picture. It is the main way clients reach the studio. Meta handles those messages under its own privacy policy and may use information about them across its other services, which is outside my control. Please don’t send documents, card numbers or medical details through it — for anything like that, call me or come by the studio.
• The online gallery service that delivers your finished images, and your email address so it can send you the link.
• The print lab, when you order prints: the image file and the shipping address.
• The payment processor, when you pay by card: it handles the card details directly. I never see or store your full card number.
• Vercel, which hosts this website and logs technical request data.
• Google, for the map embedded on the contact page.

Beyond that, information is shared only when the law requires it — a court order, a subpoena, a legal obligation — or to protect someone’s safety.

I do not sell personal information, and I do not share it for cross-context behavioral advertising. Photographs of your family are not stock, not training data, and not an advertiser’s asset.

This site does not set advertising cookies and does not track you across other websites. There is no Meta pixel, no ad network tag and no session recording on any page. That is a decision, not an oversight: a studio that photographs families has no business watching them browse.

The embedded Google Map on the contact page is loaded by Google and can set Google’s own cookies. If you would rather not load it, you can reach the studio from the address and phone number, which are on every page of the site.

Your browser’s Do Not Track and Global Privacy Control signals are respected for anything under my control.

Writing to me about a session, or booking one, means I will write back about that session: quotes, dates, reminders, your gallery. That is the conversation you started.

Promotional messages — open dates for a themed set, a seasonal offer — are a different thing. They only go to people who agreed to them separately, and agreeing is never a condition of booking a session: say no and everything else works exactly the same. Message and data rates may apply.

To stop them, reply STOP, or tell me any way you like — by message, by phone, in person. I do not require a magic word, and every promotional email carries an unsubscribe link that works.

Your photographs. Finished images from your session are kept for a limited period after delivery so a lost file can be replaced, and then they are deleted. The exact period is stated when your gallery is delivered. RAW files and outtakes are deleted sooner. Download and back up your images the day you get them — the Studio is not a backup service.

Your booking and payment records. Kept as long as tax and accounting rules require.

Your messages. WhatsApp conversations stay in the app’s history until they are cleared.

Your signed release. Kept for as long as any image from that session is published, and afterwards as proof that the permission existed. It is the document that protects both of us.

If you ask me to delete your information, I do — except the few records the law says I have to keep, and I will tell you which those are.

Files live on password-protected devices with encrypted backups, and galleries are delivered over links that are not indexed by search engines. Access is mine alone; there is no staff with a copy of your session.

No one honest promises perfect security, and I will not. What I can promise is that if a breach ever affects your information, you will hear it from me, promptly and in plain language, along with what happened and what to do about it — which is also what Texas law requires.

Texas’s privacy law applies to businesses above a size threshold, and a one-person portrait studio sits well below it — so strictly speaking, most of what follows is not something the law forces on me. That distinction is not your problem, so the answer here is the same either way: ask, and it is done.

• Know what information about you the studio holds, and get a copy of it.
• Correct anything that is wrong.
• Delete your information, except the records tax and legal rules require me to keep.
• Withdraw the permission you gave for photographs — the whole of section 05.
• Opt out of promotional messages, at any time.

There is nothing to opt out of when it comes to selling data or targeted advertising, because neither happens here.

The studio works in Texas and serves the Rio Grande Valley. I don’t claim to comply with California’s privacy law or with European data protection rules, because they don’t apply to a business this size — claiming otherwise would be a promise with nothing behind it. What you get instead is the list above, honored on request.

Ask through any of the channels in section 14. I may need to confirm you are who you say you are before handing over information about a session — that step protects you, not me. If I turn a request down, I will say why, and you can ask me to reconsider.

This website is meant for adults booking a photography session. It is not directed to children, and I do not knowingly collect information online from anyone under 13.

If a child sent something through the form or a message, tell me and it is deleted.

That is a different question from photographs of children, and the two get confused often enough to be worth separating: the federal rule about children’s privacy online is about information collected from a child over the internet. A photograph made at a session and handed over by a parent is not that. It is covered by section 04, and it rests on a parent’s written permission.

This notice will change when the studio changes — a new gallery service, a payment method, analytics that measure how the site is used. The date at the top says when it last did.

If a change affects how photographs of you or your children may be used, it does not apply backwards to a session already photographed. Your permission is the one you gave, on the terms you gave it.

Requests about your data, a photograph you want taken down, or a question about this notice go to the same place as everything else:

• WhatsApp or phone: (956) 683-5992. Say it is about privacy so I handle it as a request and not as a chat.
• In person or by mail: Roel Tobias Portrait Studio, 504 W Pecan Blvd, Ste 120, McAllen, TX 78501.
• The contact form on the contact page.

I answer the same day I can, and no later than 45 days for a formal request about your data. If I ever have to say no to one, I will tell you why, and you can ask me to look at it again.