Privacy & Cookie Policy

1. Introduction

This Privacy and Cookie Policy explains how No Filters Stories ("we", "us", "our") collects, uses, stores and protects your personal data when you visit nofiltersstories.com or contact us through this website.

We are committed to protecting your privacy and handling your data transparently in full compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Bulgarian data protection law.

By using our website, you acknowledge that you have read and understood this policy.

2. Data Controller

The data controller responsible for your personal information is:

3. What Data We Collect

3.1 Data You Provide Directly

When you complete our contact form, we collect:

• Full name — to address you personally in our response
• Email address — to reply to your enquiry
• Session type — the type of photography session you are interested in
• Message content — any information you choose to share about your project

Providing this information is entirely voluntary. You are not required to submit the contact form to browse our website.

3.2 Data Collected Automatically (with your consent)

If you accept cookies, we collect anonymised analytics data via Google Analytics 4, including:

• Pages visited and time spent on each page
• General geographic location (country/region level only — not precise location)
• Device type, browser and operating system
• How you arrived at our site (e.g. search engine, direct link)
• Anonymised IP address

This data is aggregated and cannot be used to identify you personally. If you decline cookies, no analytics data is collected.

3.3 Data We Do Not Collect

• Payment or financial information
• Sensitive personal data (health, ethnicity, religion, etc.)
• Data from minors — our services are directed at adults only
• Precise geolocation data

4. Legal Basis for Processing

• Consent (Art. 6(1)(a)) — for analytics cookies. You may withdraw consent at any time by clearing your browser cookies or declining via our cookie banner.
• Legitimate interests (Art. 6(1)(f)) — for responding to contact form enquiries. Our legitimate interest is to communicate with prospective clients who have chosen to contact us.
• Contract (Art. 6(1)(b)) — where processing is necessary to take steps at your request prior to entering into a contract for photography services.

5. How We Use Your Data

• Respond to your enquiry or booking request in a timely manner
• Communicate with you about your photography session
• Provide you with information you have specifically requested
• Improve our website and understand how visitors use it (analytics only, with consent)

We will never sell, rent, share or transfer your personal data to third parties for marketing or commercial purposes. We do not use your data for automated decision-making or profiling.

6. Cookies & Tracking

Cookies are small text files stored on your device. We use cookies only with your explicit consent, except for strictly necessary cookies required for the site to function.

6.1 Strictly Necessary Cookies

6.2 Analytics Cookies (Optional — Consent Required)

These cookies are only set if you click "Accept" on our cookie banner.

IP anonymisation is enabled — your IP address is truncated before storage. You can opt out via Google's opt-out tool.

6.3 Managing Your Cookie Preferences

You can change your preferences at any time by clearing your browser's cookies and revisiting our site, or by managing cookies through your browser settings.

7. Third Party Data Processors

• Formspree (formspree.io) — processes contact form submissions and delivers them to us by email. GDPR compliant. Privacy Policy
• Google Analytics (Google LLC) — provides anonymised website analytics under Google's data processing terms. Privacy Policy
• GitHub Pages (GitHub Inc.) — hosts this website. GitHub may process server logs including IP addresses. Privacy Policy
• Cloudflare Inc. — provides security, CDN and DNS services. May process IP addresses to protect against threats. Privacy Policy
• Google Fonts (Google LLC) — provides web fonts served from Google's servers. Privacy Policy

We do not share your personal data with any other third parties.

8. International Data Transfers

Some third party processors (Google, GitHub, Cloudflare) are based in the United States. Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place including Standard Contractual Clauses (SCCs) approved by the European Commission and the EU-US Data Privacy Framework where applicable.

9. Data Retention

• Contact form submissions — retained for up to 12 months from the date of last contact, then deleted
• Analytics data — retained for 14 months within Google Analytics, then automatically deleted
• Cookie consent records — stored locally in your browser for 12 months

10. Your Rights Under GDPR

• Right of access (Art. 15) — request a copy of all personal data we hold about you
• Right to rectification (Art. 16) — ask us to correct inaccurate or incomplete data
• Right to erasure (Art. 17) — request deletion of your personal data
• Right to restrict processing (Art. 18) — ask us to limit how we use your data
• Right to data portability (Art. 20) — request your data in a machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interests
• Right to withdraw consent (Art. 7(3)) — withdraw consent at any time without affecting prior processing
• Right not to be subject to automated decision-making (Art. 22) — we carry out no automated profiling

To exercise any of these rights, contact us at the details below. We will respond within 30 days at no charge.

Right to Lodge a Complaint

If you are unhappy with how we handle your data, you have the right to complain to the Bulgarian supervisory authority:

You also have the right to complain to the supervisory authority in your country of residence within the EU.

11. Security of Your Data

• HTTPS encryption across the entire website (enforced via Cloudflare)
• HTTP Strict Transport Security (HSTS) to prevent downgrade attacks
• Content Security Policy to prevent cross-site scripting attacks
• Cloudflare DDoS protection and Web Application Firewall
• No storage of personal data in databases on this website

We will notify you and the relevant supervisory authority of any data breach as required by GDPR Art. 33-34.

12. Children's Privacy

Our website and services are directed exclusively at adults aged 18 and over. We do not knowingly collect personal data from children under the age of 16. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it promptly.

13. External Links

Our website contains links to Instagram, Facebook, TikTok and Pinterest. Once you leave our site, we are not responsible for the privacy practices of those platforms. We encourage you to read their individual privacy policies.

14. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. Continued use of our website after any changes constitutes your acceptance of the updated policy.

15. Contact Us

For any questions, concerns or data rights requests: