Privacy policy

How Coastal Properties Photography collects, uses, and protects your personal information.

This policy applies to Coastal Properties Photography (operated by Zaid Taie), a sole proprietorship based in Vancouver, British Columbia, Canada. We are committed to protecting your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and BC's Personal Information Protection Act (PIPA).

1. Who we are

Coastal Properties Photography provides real estate, architectural, and property photography services across Greater Vancouver and the Lower Mainland. Our website is located at coastalphoto.ca.

Privacy contact: info@coastalphoto.ca

2. What personal information we collect

We collect personal information only when necessary to provide our services or improve the site experience.

Contact & booking inquiries

When you submit an inquiry through our contact, quick-quote, or booking form, we collect:

  • Full name and email address (required)
  • Phone number (required on the booking form, optional elsewhere)
  • Property address, property type, square footage, and MLS status
  • Preferred shoot date and additional notes
  • Selected services and how you heard about us

To match leads back to the marketing channel that referred you (so we can measure which campaigns work), each form submission also stores:

  • UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) if present in the URL
  • Google Ads click IDs (gclid, wbraid, or gbraid) and Meta click ID (fbclid) if present
  • The page you first landed on and the referring website
  • A Google Analytics client ID, when available, and a first-party visitor identifier used to connect page activity with your inquiry. These identifiers can become linked to your contact details when you submit a form.

Saved booking details

As you complete the booking steps, we save your progress so you can return to the booking. This may include your name, email, phone number, property details, selected services, and preferred appointment, even if you have not submitted the final form. A resume link can reopen saved details, so keep it private.

First-party visit and booking measurement

Our site records page visits and booking steps in Supabase separately from Google Analytics. These records include a random visitor identifier, page path, device category, referral and campaign details, booking interactions, and validation errors. The identifier is stored in a first-party cookie for 30 days. We also record a hashed IP value and approximate location to distinguish traffic and investigate problems. If you submit a form, relevant events may be linked to your inquiry.

This first-party measurement currently runs even when you reject optional analytics cookies. Rejecting the banner controls the third-party measurement described below; it does not stop these first-party records.

Google Analytics (with your consent)

If you accept analytics cookies, we use Google Analytics 4 to collect usage data, including:

  • Pages visited, time spent, scroll depth, and page interactions (e.g. which pricing services you toggled, which FAQ you opened, which area page you viewed)
  • Coverage checker activity, including the first three characters of the postal code, whether the area is covered, and the matched service region. We never collect the full postal code through this checker.
  • Approximate geographic region, derived from IP information processed by Google
  • Device type and browser
  • Referral source (e.g. Google search, social media)

You can decline analytics at any time using the controls in section 5 or through your browser settings.

Marketing measurement (with your consent)

If you accept analytics cookies and we have activated paid-ad measurement (Google Ads, Meta Pixel, and/or Microsoft Advertising), we additionally send the following to those platforms so we can measure ad performance and optimise spend:

  • Conversion events when you submit a form, click a key call-to-action, or call us. These events include an estimated lead value (in CAD) for ad-bidder optimisation.
  • Enhanced Conversions for Google Ads. When you submit a form, your email, phone, and name are hashed (one-way SHA-256) by Google's tag before transmission, then matched against ad-click data on Google's servers. The hashed values are not shared with us back as raw data. You can disable this by rejecting analytics cookies.
  • Meta Pixel events. Standard events (Lead, Schedule, Contact, InitiateCheckout) and a custom CalculatorComplete event with the estimated quote value.
  • Microsoft Advertising (UET) tag. Page-visit data so Microsoft can attribute leads to Bing Ads campaigns and measure conversion goals (form submissions, quote requests).

Booking payments

Stripe processes online booking payments. Payment card fields are sent directly to Stripe; Coastal Photo does not receive or store your full card number or card security code. At checkout, Stripe places a temporary authorization for the booking total. Payment is captured when your finished files are delivered. If the booking is not approved, is canceled before capture, or the authorization is released, no charge is made. We retain the booking total, payment status, authorization and capture timestamps, Stripe transaction identifiers, and invoice or receipt links so we can confirm bookings, issue refunds, respond to disputes, and maintain accounting records.

3. How we use your information

Purpose Data used Basis for use
Respond to your inquiry and schedule a shoot Name, email, phone, property details Contract / consent
Deliver completed photos via private gallery link Email address Contract performance
Process booking payments, refunds, receipts, and payment disputes Name, email, booking reference and total, payment status, authorization and capture timestamps, and Stripe transaction identifiers Contract performance / legal obligation
Understand how visitors use the website Google Analytics events and approximate location Consent (cookie opt-in)
Measure ad campaign performance and optimise spend UTM / click-ID parameters, conversion events, hashed contact details for Enhanced Conversions Consent (cookie opt-in)
Comply with applicable law Any data we hold Legal obligation

We do not sell, rent, or trade your personal information. We share the information described here with providers that help us operate bookings, deliver emails, process payments, and measure advertising. Advertising providers may match consented conversion data with information they already hold, under their own privacy policies.

4. Third-party services

We use the following third-party services. Each has its own privacy policy. Google tags load with analytics and advertising storage denied by default and may send measurements without cookies before you accept. Meta Pixel and Microsoft Advertising load only after acceptance.

Service Purpose Data sent
Google Analytics 4 Website analytics (consent required) Page views, event interactions, anonymised IP, device/browser, referrer
Google Ads Conversion measurement and Enhanced Conversions for paid-search campaigns (consent required) Conversion events with lead value (CAD); hashed email, phone, and name for ad-click matching
Meta (Facebook) Pixel Conversion measurement for paid social campaigns (consent required) Page views and standard events (Lead, Schedule, Contact, InitiateCheckout)
Microsoft Advertising (UET) Conversion measurement for paid-search campaigns on Bing/Microsoft Ads (consent required) Page views and conversion-goal events (form submissions, quote requests)
Supabase Bookings, saved progress, and first-party measurement Inquiry and booking details, saved drafts, visitor and attribution identifiers, page and booking events, hashed IP values, and approximate location
Formspree Fallback delivery of form submissions when configured Inquiry form data including attribution fields
Resend Booking and inquiry emails Recipient email address and message content, including relevant booking details
Vercel Website hosting and API requests Request details, including IP address, browser information, and requested URL
Geoapify and the OSRM routing service Address suggestions and travel estimates Typed address searches and location coordinates needed for routing; browser requests also reveal request details such as IP address
Stripe Payment authorization and capture, invoices, receipts, refunds, and fraud prevention Name, email, booking total and reference, plus payment information entered directly into Stripe's secure form
Google Fonts Typography (served from Google CDN) IP address (standard web request)

Some providers process information outside Canada. Our Supabase booking database is hosted in the United States. Information processed abroad may be subject to the laws of that country.

5. Cookies and local storage

Cookies are small text files stored on your device when you visit a website. Some browser storage works the same way without using a cookie (for example, localStorage), and both are covered here.

We use cookies, localStorage, and sessionStorage to remember your consent choice, save booking progress, record first-party visit and booking activity, and retain referral details. These first-party items currently operate separately from the optional third-party analytics choice. Google Analytics, Google Ads, Meta Pixel, and Microsoft Advertising cookies require acceptance.

What we use

Name Provider Purpose Duration
cpp_cookie_consent This site (first-party cookie + localStorage) Stores your cookie preference (accepted/declined). Always on. 180 days
cpp_attribution This site (localStorage only, no cookie) Remembers referral and campaign details so we can connect a later inquiry to its source. Currently stored independently of the optional analytics choice. These identifiers may be linked to a submitted inquiry. 90 days
_ga, _ga_* Google Analytics 4 Distinguish unique visitors and sessions 2 years (consent required)
_gcl_au, _gcl_* Google Ads Measure ad clicks and conversions (consent required) 90 days
_fbp Meta (Facebook) Pixel Distinguish unique visitors for ad conversion measurement (consent required) 90 days
_uetsid, _uetvid Microsoft Advertising (UET) Distinguish unique visitors and sessions for ad conversion measurement (consent required) 16 days to 13 months

Additional first-party storage used by the booking flow:

  • coastal_funnel_session and coastal_funnel_attribution: visitor and referral cookies, renewed for 30 days, with sessionStorage copies.
  • coastal_visitor_seen: a returning-visitor marker, stored in a one-year cookie and localStorage. coastal_visitor_session_type lasts for the browser session.
  • coastal_store_order_v4 and coastal_store_session_id: saved booking details and the identifier used to resume them. These localStorage records have no automatic browser expiry.
  • coastal_funnel_sent and coastal_funnel_queue: event-deduplication and retry records in sessionStorage and localStorage. The retry queue has no automatic time-based expiry.

Google, Meta, and Microsoft measurement cookies require acceptance. Google Fonts receives a standard web request when your browser loads the typefaces, including your IP address.

URL parameters we read

If you arrive on the site with marketing-attribution parameters in the URL, we read them and store them in your browser's localStorage so a later inquiry can be attributed to the right campaign:

  • utm_source, utm_medium, utm_campaign, utm_term, utm_content
  • gclid, wbraid, and gbraid (Google Ads click identifiers)
  • fbclid (Meta click identifier)

The cpp_attribution record has a 90-day validity period. A separate first-party funnel record uses a 30-day cookie. Referral and campaign details may be sent with page and booking events before you submit a form, and may later be linked to your inquiry.

If you accept analytics and ad measurement, a one-way hash of the email address or phone number submitted with a completed booking may be sent to Google Ads. Google uses it with available click IDs to measure qualified conversions. The plain email address or phone number is not included in this conversion feed.

Your consent choice

On your first visit, a banner asks whether to accept optional third-party analytics and advertising cookies. If you decline, Meta Pixel and Microsoft Advertising do not load. Google tags may still send measurements without cookies, including consent status and request information, for conversion modelling. First-party visit records and saved booking progress continue separately, as described above. You can change your choice below.

Managing cookies in your browser

You can also delete or block cookies through your browser settings. Blocking all cookies may affect how the site functions, but no core content will be hidden.

The site stops using expired cpp_attribution records after 90 days. You can remove browser records by clearing your browser's site data; this does not delete records already stored in our systems.

6. Data retention

  • Inquiry form data. Retained for as long as needed to fulfil your booking and for up to 2 years for legitimate business records (invoicing, communications), after which it is deleted.
  • Payment records. Transaction identifiers, payment status, invoice and receipt records are retained for the period required for accounting, tax, dispute, and legal obligations. Stripe retains payment data under its own privacy and retention policies.
  • Analytics data. Coverage checks and other first-party analytics are retained in Supabase for service-demand reporting. Google Analytics data is retained for 14 months, after which it is automatically deleted per our GA4 data retention settings.
  • Email correspondence. Retained in our email system for up to 3 years.

7. Your rights

Under PIPEDA and BC PIPA, you have the right to:

  • Access. Request a summary of the personal information we hold about you.
  • Correction. Ask us to correct inaccurate or incomplete information.
  • Withdrawal of consent. Withdraw your consent to any use of your personal information where consent is the basis for processing. This does not affect the lawfulness of processing before withdrawal.
  • Deletion. Request deletion of your personal information, subject to our legal retention obligations.
  • Complaint. File a complaint with the Office of the Privacy Commissioner of Canada or the Office of the Information & Privacy Commissioner for BC.

To exercise any of these rights, email us at info@coastalphoto.ca. We will respond within 30 days.

8. Data security

We take reasonable precautions to protect your personal information. Form data is transmitted over HTTPS and stored on Supabase's encrypted infrastructure. Access to your information is limited to Zaid Taie and the third-party service providers listed above, each of whom is bound by their own privacy and security commitments.

No method of transmission or storage over the internet is 100% secure. If you believe your information has been compromised, please contact us immediately.

9. Children's privacy

Our services are not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has submitted information through our site, please contact us and we will delete it promptly.

10. Changes to this policy

We update this policy when our practices change and show the revision date at the end of this policy. Publishing an update does not change your saved cookie choice. Where a new use requires consent, we will ask for it.

11. Contact us

For any privacy-related questions, requests, or concerns:

Last updated: September 29, 2026  ·  Coastal Properties Photography  ·  Vancouver, BC, Canada