PRIVACY & COOKIES

Privacy Policy

The boring-but-important bit

I take looking after your information as seriously as I take confetti. This page explains what I collect, why I collect it, who else touches it, and what you can ask me to do with it. No legalese marathons, I promise.

Who I am

Joy Story is run by me, Sarah Craig, trading as Joy Story. I’m the “data controller”, which means I’m responsible for your personal information.

What I collect

When you get in touch or book

  • Your names, email, phone number and postal address.
  • Wedding or session details: date, venues, timings, and anything you tell me about your plans.
  • The names of key people, such as family members or your wedding party, so I can plan group photos.
  • Payment and invoice records. I never see or store your full card details. Payments go through a payment provider (Stripe) or your bank.

On your wedding day or shoot

  • Photographs, and sometimes video clips, of you, your guests and your day. Some guests may be children.

When you sign up for my free guide or emails

  • Your name and email address.

When you browse this website

  • Basic analytics, such as pages visited, rough location (city level), device and browser type. This is collected through cookies. More on those below.

Things you choose to share

  • Sometimes people tell me about access needs, dietary requirements, or other personal details so I can look after them properly. I only use this to plan your day, and I only share it with others if you ask me to.

Why I use it, and my legal basis

  • To reply to your enquiry and give you a quote. This is a step you’ve asked for before entering into a contract.
  • To photograph your day, edit and deliver your images, and manage your booking and payments. This is necessary to perform our contract.
  • To keep financial records. This is a legal obligation (HMRC requires me to keep records).
  • To send you my guide and occasional emails. This is based on your consent. Every email has an unsubscribe link.
  • To understand how people use my website. This is in my legitimate interests, so I can improve the site.
  • To see whether my social media posts bring people to my website, and to show my work to people who’ve visited. This is in my legitimate interests, so I can reach couples who might like what I do.
  • To share some of your photos in my portfolio, blog or social media, or with suppliers and wedding publications. See the next section.

Your photos and how I share the

I’m a photographer, so showing off my work is part of how I find new couples.

  • When I send your gallery, I’ll ask whether you’re happy for me to share some of your photos. I’ll only share them if you say yes, and you can change your mind at any time.

Also:

  • I won’t share images of children as a focus of a post without a parent or guardian’s OK.
  • If you (or a guest) ever want a photo taken down, email me and I’ll remove it from anything I control.

Who else handles your information

I don’t sell your data, ever. I do use a few trusted services to run my business. They only process your information on my behalf and under data protection agreements:

  • Sprout Studio: my enquiry form, client management, contracts and invoices.
  • ShootProof: delivering your images.
  • Mailchimp: my free guide and newsletter.
  • Krystal: hosting this website.
  • Cloudflare: website security and performance.
  • Google Analytics: website statistics.
  • QuickBooks: keeping my accounts.
  • Stripe: processing card payments.
  • Meta (Facebook and Instagram): the Meta Pixel.
  • Second photographer: on wedding days, a second photographer works with me. They receive the details they need for your day and are bound by confidentiality.

I’ll also share information if I’m legally required to.

Some of these services store data outside the UK, often in the USA. Where they do, they use approved safeguards such as the UK International Data Transfer Agreement or UK–US data bridge certification.

How long I keep it

  • Enquiries that don’t go ahead: 12 months, then deleted.
  • Booking, contract and payment records: 6 years after your wedding or shoot, because HMRC requires it.
  • Your online gallery: live for 12 months. After that, I keep a backup of your final images for a further year in case you ever lose yours.
  • Email list: until you unsubscribe.
  • Images used in my portfolio or blog: for as long as they’re published, unless you ask me to remove them.

Your rights

You have the right to:

  • see a copy of the personal information I hold about you
  • ask me to correct anything that’s wrong
  • ask me to delete your information, unless I’m legally required to keep it (for example, financial records)
  • ask me to stop or limit how I use it
  • object to me using it for marketing or for sharing your images
  • withdraw consent at any time, where I’m relying on consent
  • ask for your information in a format you can take elsewhere

Just email [email protected]. It’s free, and I’ll respond within one month.

Cookies

They’re set when you visit, and you can block or delete them at any time (see “Turning them off” below). I never sell anything they collect.

Essential cookies

  • Cloudflare (__cf_bm and similar): protects the site from bots and attacks. Lasts up to 30 minutes.

Analytics cookies

I use Google Analytics to see things like which pages are popular, how people find my site and what device they use. This helps me make the site better.

  • _ga: tells visits apart so I can count visitors. Lasts up to 2 years.
  • _ga_[ID]: keeps track of your current visit. Lasts up to 2 years.

Marketing cookies

I use the Meta Pixel (Facebook and Instagram) to see whether my posts lead people to my website, and so I can show my work to people who’ve visited. Meta also uses this information for its own purposes, under its own privacy policy.

  • _fbp: recognises your browser on return visits. Lasts up to 3 months.
  • fr: set by Facebook if you’re logged in to Facebook or Instagram. Lasts up to 3 months.

Turning them off

You can block or delete cookies in your browser settings at any time. You can also opt out of Google Analytics on every website with Google’s opt-out browser add-on, and manage the ads you see in your Facebook or Instagram ad settings.

Embedded content

Some pages include content from other sites, such as my enquiry form (Sprout Studio) or videos. Those services may set their own cookies, which are covered by their privacy policies.

Social media

If you interact with me on Instagram, Facebook or Pinterest, those platforms’ own privacy policies apply too. I’ll never ask you for sensitive information through social media. Please email me instead.

Links to other websites

My blog and supplier pages link to other people’s websites. I’m not responsible for how they handle your data, so check their privacy policies.

Complaints

If you’re unhappy with how I’ve handled your information, please talk to me first and I’ll do my best to sort it. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

Changes to this policy

I’ll update this page if anything changes.

Last updated: October 2026