Privacy
Privacy policy
Short version: this site collects almost nothing. What you type into the contact form is used to answer you, kept only as long as needed, and never sold or shared for advertising.
In plain words. No advertising cookies. No tracking across other sites. No profile of you. The only personal data this site handles is what you choose to send through the contact form or by email.
1. Who is responsible
Ali Ahmadi — trading as Vision, photography — is the data controller for this site.
- Contact: contact form
- Postal address: [ADDRESS], Paris, France
There is no data protection officer: the volume and nature of the data handled here do not require one.
2. What is collected, and when
Contact form
If you use the form, you send: your name, your email address, the type of shoot, the dates you entered (optional), and your message. Nothing else is asked for. Fields are not pre-filled and the form does not run any profiling script.
If you write directly, the message and your email address are kept the same way as a form enquiry.
Bookings and delivery
If a shoot goes ahead, the usual information needed to run it and invoice it: contact details, the shoot brief, the date and place, the photographs themselves, and billing information.
Testimonials
If you agree to a testimonial, the wording you approve, your first name or the name you chose, and the description you chose (for example “Wedding · Provence · 2026”) are published. Nothing is published without your approval.
Photographs of people
Photographs of identifiable people are personal data. They are published on this site only with the consent of the person shown — see the image publication consent page, which explains what that consent covers and how it is withdrawn.
Technical data
The host keeps short-lived connection logs for security and abuse prevention. This site also counts visits with a cookie-free tool — see section 6.
No sensitive data (health, religion, political opinions, biometric identifiers) is requested or wanted. Please do not send any.
3. Why it is processed, and on what legal basis
- Answering an enquiry — steps taken at your request before a possible contract (article 6.1.b GDPR).
- Running a booking, delivering photographs, invoicing — performance of the contract, plus the legal obligation to keep accounts (articles 6.1.b and 6.1.c).
- Publishing a testimonial or a portrait — your consent (article 6.1.a), which you can withdraw at any time.
- Counting visits — the legitimate interest of knowing whether the site is read (article 6.1.f), using a method the CNIL exempts from consent.
- Defending a legal claim — legitimate interest (article 6.1.f).
There is no automated decision-making and no profiling. Your data is never sold, rented or exchanged.
4. Who receives it
Only the services strictly needed to run this site, each for one job:
- FormSubmit (formsubmit.co) — receives the contact form and forwards it to the publisher's mailbox. It is operated outside the European Union.
- Cloudflare, Inc. — hosts the site and terminates HTTPS. Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States.
- Google (Gmail) — stores the mailbox that receives enquiries and correspondence.
- GoatCounter — the cookie-free visit counter (see section 6).
Transfers outside the European Union are covered by the safeguards those providers publish — the European Commission's standard contractual clauses, or an adequacy decision where the provider is certified under the EU–US Data Privacy Framework.
No data is shared with advertising networks, data brokers or analytics resellers.
5. How long it is kept
- An enquiry that does not lead to a booking — 12 months, then deleted.
- A booking, its correspondence and the delivered photographs — 5 years after the last job, which matches the period in which a contractual claim can be brought.
- Invoices and accounting records — 10 years, as French accounting law requires. This overrides the line above for those documents.
- A published testimonial or portrait — for as long as it is published, plus 5 years of proof of your consent. Withdraw consent and it comes down; the proof is then kept only to show the publication was lawful at the time.
- Visit statistics — aggregated, kept no longer than 25 months.
- Host connection logs — a short period set by the host for security purposes.
6. Cookies and tracking
This site sets no cookies at all — not for analytics, not for preferences, not for advertising. That is why you are not shown a consent banner: there is nothing to consent to.
Visits are counted with GoatCounter. It records the page viewed, the referring site, the browser and operating system, the country, and a temporary technical fingerprint used only to avoid counting one visit twice — never your full IP address, and it is overwritten within hours. It cannot follow you to another website, and it is not combined with any other data.
That profile is the one the CNIL exempts from prior consent for audience measurement. If you prefer to opt out anyway, a browser content blocker will stop the count request without affecting the site.
One preference is stored, and it stays on your device: the light or dark theme you pick in the menu is saved in your browser's local storage under the name vision-theme. It is not a cookie, it is never sent to this site or to anyone else, and clearing your browser data simply puts you back on your system's own setting.
The complete list, checked page by page
The whole site was audited on 27 October 2026. It contains exactly two pieces of storage: the vision-theme entry in local storage, and the GoatCounter count request. Nothing else is written, read or sent. There is no login, no comment system, no embedded video, no advertising script and no social plugin; the contact form is a plain HTML form that posts to the mail forwarding service described in section 4.
When a banner would appear
A consent banner would become necessary the day a tool that is not exempt is added — for example a cookie-setting analytics service, an advertising or retargeting pixel, an embedded player or a chat widget. Should that happen, this section is updated and a banner that refuses as easily as it accepts is added before the tool goes live. Until then, a banner would be asking you to consent to nothing.
Read the CNIL's guidance: cnil.fr — cookies and other trackers.
7. Your rights
You have the right to:
- know whether data about you is processed, and obtain a copy (access);
- have inaccurate data corrected (rectification);
- have data deleted (erasure);
- limit how it is used (restriction);
- object to processing based on legitimate interest (objection);
- receive your data in a portable format (portability);
- withdraw consent at any time, for a testimonial or a photograph (withdrawal);
- give instructions about what happens to your data after your death.
To exercise any of them, use the contact form. A reply comes within one month; complex requests may take up to three. Nothing needs to be justified and no fee is charged.
If the answer does not satisfy you, you can complain to the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — or online at cnil.fr/fr/plaintes.
8. Photographs, and your right to your image
French law protects the use of a person's image independently of data protection. Every identifiable person on this site consented to publication here, and that consent covers this site only.
How that consent is collected, what it permits, and how it is withdrawn is set out on the image publication consent page, which also carries the form to print and sign. The rights and obligations of a commissioned shoot are in the terms of sale.
To have a photograph removed, use the contact form, giving the page address. It is taken down without delay, and you do not have to explain why.
9. Security
The site is served over HTTPS only, with a strict content security policy, no third-party scripts on public pages, and no database to breach. Access to the accounts and services behind it is restricted to the publisher and protected by two-factor authentication. No system is perfect, but the surface here is deliberately small.
10. Children
This site is not aimed at children. No data is knowingly collected from a child under 15 without the consent of a parent or guardian. If you believe that has happened, use the contact form and it will be deleted.
11. Changes to this policy
This policy may be updated when the site, the tools behind it or the law change. The date at the top of the page is the date of the last change. When the change is significant, it is also announced on the site.
12. Contact
Any question about this policy or about your data: use the contact form. The publisher details required by law are on the legal notice page.