Skip to content
CCD Creative Co

Legal

Privacy policy.

Last updated: October 2026

Who we are

CCD Creative Co is the creative studio of David Correa Chaparro, based in North Carolina, USA. This policy explains what personal information we collect through this website, why we use it, how we protect it, how long we keep it and the choices you have. It follows North Carolina law and the federal rules that apply to our studio (see “Laws we follow” below). By using the site you also agree to our Terms of use.

How we use your information

Your information is used only by CCD Creative Co, and only for two purposes:

  • Scheduling and running your session or project: your booking, confirmations, reminders, changes, a deposit when there is one, the delivery of your photos and our answers to your messages.
  • News and promotions from David, by email, only if you ask for them by ticking the optional box in our forms. You can unsubscribe at any time.

We never sell, rent, trade or share your information so others can market to you, and we never use it for any other purpose.

What we collect

  • When you book a session: name, email, mobile number, Instagram handle (optional), city or town and place of the session, your vision for the shoot, your language, how you prefer to be contacted, and your choices about text messages and promotions.
  • When you send a message or request a quote: what you write in the form (for businesses, also the business name, service, timeline and budget) and your choice about promotions.
  • When you leave a review: your name, review, stars, the session (optional) and your email. Your email is never published.
  • Consent records: when you agreed to booking texts (and the IP address it came from), and when you asked for promotions or unsubscribed, so we can prove your choices.
  • To protect the site: basic technical data (IP address and browser) for spam and abuse checks.

We never ask for Social Security, driver’s license or passport numbers, or bank or card numbers. When a session needs a deposit, David agrees the amount and how to pay it with you before the session; for now the website does not take payments.

Promotions (only if you ask)

  • Promotions are sent by email only, never by text message. Promotional texts would need a separate signed permission under North Carolina law (G.S. 75-101 and 75-103) and the federal Telephone Consumer Protection Act, and we do not ask for it.
  • The promotions box is optional and unticked. It is never a condition of booking or of getting an answer.
  • Every promotional email says who it comes from and that it is a promotion, includes our postal address and has an easy way to unsubscribe. We honor unsubscribe requests within 10 business days, as the federal CAN-SPAM Act requires, and we never ask for anything but your email to do it.
  • You can also unsubscribe by replying to any of our emails or texting 704-762-6040.

Text messages (SMS)

If you check the text-message box when booking, CCD Creative Co will text you booking confirmations, reminders and updates only, never promotions. Message frequency varies (up to 6 messages per booking). Message and data rates may apply. Reply STOP to opt out at any time or HELP for help. You can also ask us to stop in any other reasonable way, and we will stop within 10 business days. Consent is not a condition of booking. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

Your photos

The photos from your session are personal information too. We deliver them through a private online gallery and use them to promote the studio only with your permission, as the Terms of use explain.

Reviews

Reviews you send from this site are read by David before they appear. Only your name, stars, review, session and the date are published; you can ask us to remove your review at any time. The reviews from Google shown on our Reviews page are loaded from Google Maps each time the page opens; we do not store them, and Google’s own privacy policy applies to them.

How we protect your data

  • Every page and form travels encrypted (HTTPS with HSTS).
  • The studio panel requires a long password and a second step with an authenticator app for every sign-in. Attempts are limited, every sign-in is recorded, and the account owner is alerted by email about new sign-ins and security changes.
  • Only David (and anyone he authorizes for the business) can see client details. Every access rule is checked on the server.
  • Booking links are long random codes; the database keeps only a hashed copy, and sensitive codes (booking links, calendar connection, two-step secrets) are encrypted (AES-256-GCM).
  • Forms are protected against spam and automated abuse (Cloudflare Turnstile and rate limits). The limits keep a scrambled code of your IP address, never the address itself, for 24 hours.
  • We collect only what we need and erase it on schedule (see below). Erased records are deleted so they cannot be read or rebuilt, as G.S. 75-64 requires.

If there is a data breach

If a security breach ever exposes your personal information, we will tell you without unreasonable delay, explain what happened and what you can do, and notify the North Carolina Attorney General’s Consumer Protection Division, as the North Carolina Identity Theft Protection Act requires (G.S. 75-65). If more than 1,000 people are affected, we will also notify the nationwide consumer reporting agencies.

Service providers

We rely on providers that process data only on our behalf and may not use it for anything else: Vercel (hosting, photo storage and privacy-friendly analytics), Neon (database), Resend (email), Twilio (text messages, only if we turn them on), Google Calendar (scheduling, only if we connect it), Google Maps (reviews and maps), OpenStreetMap (finding a session's location on a map, from the address only), Stripe (online payments, only if we turn them on), Cloudflare Turnstile (spam protection), our online gallery provider (photo delivery) and Have I Been Pwned (checks that panel passwords are not in known data breaches, without sending the password).

How long we keep it

  • Bookings: your personal details are erased 4 years after your session (the booking’s reference, date and price stay for our accounts). Checkouts you started but did not pay are deleted after 30 days.
  • Messages and quote requests: 2 years.
  • Reviews: published reviews stay while they are published; the private email is erased after 12 months. Reviews that are not approved are deleted after 6 months.
  • Promotions: until you unsubscribe or the record above is erased, whichever comes first.
  • Records of the emails and texts we sent, and security records: 12 months.

You can ask us to delete your information sooner, unless the law requires us to keep it.

Your rights and choices

North Carolina does not yet have a general consumer privacy law, but we give every client these rights: you can ask for a copy of your information, a correction or its deletion, unsubscribe from promotions, and stop text messages at any time (reply STOP). Text 704-762-6040 or reply to any of our emails. We answer within 30 days, may ask you to confirm your identity first, and will never treat you differently for using these rights.

Children

This site is not directed to children under 13, and we do not knowingly collect information from them (Children’s Online Privacy Protection Act). Sessions for minors are booked by a parent or guardian who is at least 18. If we learn that a child under 13 sent us information, we delete it.

Cookies

This site does not use advertising or tracking cookies. We use privacy-friendly, cookie-less analytics to understand visits. The studio panel uses only the cookies needed to keep you signed in.

Laws we follow

  • North Carolina Identity Theft Protection Act (G.S. 75-60 to 75-66): protecting personal information, secure disposal and breach notification.
  • North Carolina telephone solicitation law (G.S. 75-100 to 75-105): no promotional calls or texts without signed permission.
  • North Carolina Unfair and Deceptive Trade Practices Act (G.S. 75-1.1): this policy describes what we really do.
  • Federal law: the Telephone Consumer Protection Act and FCC rules (texts and opt-outs), the CAN-SPAM Act (promotional email) and the Children’s Online Privacy Protection Act.

Changes and contact

If we change this policy, we will update the date at the top and announce important changes on this page. If the law changes, we will update it. Questions: text 704-762-6040 or reply to any of our emails.