Privacy Policy

Effective October 2, 2026

The regional settings described below have been in use since September 29, 2026. Earlier refusals remain in place. The limited order-source feature described in this update applies only to eligible new orders; it does not reconstruct source information for past visits, inquiries or orders.

Twig and Olive Photography LLC, doing business as Twig & Olive Photography, is a photography studio based in Madison, Wisconsin, and is responsible for the personal information described here. This notice explains how we handle personal information when you visit our website, contact us, book photography or video services, buy products, or take part in our educational offerings.

For privacy questions or requests, email [email protected] or call 608-347-8028. You can also write to Twig and Olive Photography LLC, 3241 Garver Green, Suite 200, Madison, WI 53704, United States.

Information we handle

The information involved depends on how you work with us. It can include the following:

• Contact and account information: your name, email address, phone number, contact or delivery address, and information used to manage a website account.
• Bookings, purchases and communications: inquiries, planning messages, session or event details, order and transaction records, delivery information, and support requests.
• Photographs and recordings: the photographs, films and any associated audio created or supplied for a project, together with information used to organize, edit and deliver that work.
• Website and technical information: information needed to operate and protect the site, plus optional website measurement and inquiry- and order-source information handled under the separate controls described below.

Planning information may include session dates and locations, family relationships, school or graduation details, business names, job titles, and preferences you choose to share. The information relevant to a family session can differ from what we need for a business event or an online purchase. People arranging a session, wedding or event may provide information about other participants.

Information comes from you, from the work we create while providing our services, from people arranging a project that involves you, and from website interactions and service providers involved in the transaction or service. We do not treat information supplied by one participant as blanket permission to use another person's likeness.

You may choose to tell us about an accessibility need or other personal circumstance that affects your session. Please share only what you want us to know and what is useful for planning. Contact us before sending sensitive documents or information about someone else.

Our website and service providers also process technical information needed to operate and protect the site, such as IP addresses, browser information and security logs. An IP address can indicate an approximate region; that is different from collecting precise device GPS coordinates. A location you give us to plan a session is also different from automatic device-location collection. Optional Analytics, Inquiry and order source and Advertising follow the regional settings and your choices described below. Enhanced identity features require a separate affirmative choice.

If you do not provide information needed to answer an inquiry, arrange a booking, process a purchase or deliver your work, we may be unable to complete that request. Analytics, Inquiry and order source, Advertising and Enhanced identity features are optional uses. Declining them does not prevent you from contacting us or making a purchase.

Why we use information

We use information to answer inquiries, plan and deliver services, manage bookings and orders, provide products and galleries, maintain accounts and business records, communicate with customers, and protect against misuse or fraud. We also use information as needed to comply with legal obligations and handle disputes.

Where permitted and consistent with your preferences, we use contact information for studio news, offers and educational updates. You can unsubscribe through a marketing email or contact us. Unsubscribing from marketing does not prevent us from answering your inquiry or sending necessary booking, purchase or account messages.

Marketing preferences

You can unsubscribe from our marketing emails using the link in a marketing email. If you receive marketing text messages from us, reply “STOP” or “UNSUBSCRIBE” to opt out. You can also contact us using the details in this notice. After you opt out, we may still send messages needed for your booking, order or account, or to answer your request.

We do not share text-message subscription records or consent to receive text messages with third parties or affiliates for their own marketing or promotional purposes. Providers may handle that information to help us deliver and support our text messages. The separate Enhanced identity features choice on our website can permit sharing protected codes derived from an email address or phone number for advertising measurement and matching, as explained below. That website choice does not subscribe you to text messages or authorize another business to send them.

Photographs, video and publication permissions

Our booking contract addresses permission to use photographs from your session. If you want to restrict public use, tell us when you book. We offer a No Model Release contract by request and will confirm the uses covered by the restriction in your agreement. You can also contact us about an existing session or a photograph already published.

Public use of identifiable client work, such as portfolio or advertising use, is separate from taking and delivering photographs. The permissions and usage rights agreed for your session or project should be read with this notice. This notice does not override restrictions agreed with you.

If you have a question or concern about a photograph or video we have published, contact us with a link or enough detail to identify it. We will review the applicable permissions and circumstances. Permission to use optional website tracking does not grant permission to publish your likeness.

Providers and other recipients

We use providers that help operate the studio and website. Relevant services can include payment processing, hosting and security, email, customer management, scheduling, gallery delivery, printing, shipping and business administration. Information shared for these purposes depends on the service being provided. We may also disclose information when required by law, to protect legal rights or safety, or as part of a business transaction subject to appropriate legal requirements.

Our checkout and payment workflows involve Authorize.net, PayPal, WooCommerce, ShootQ and ShootProof. The services involved depend on how you book or buy from us.

When Analytics is on, we use Google Analytics 4. When Advertising is on, our advertising tools send website-event, browser, device and advertising-interaction information to Google and Meta. These providers process information under the terms and privacy practices linked below, which can include measurement, ad delivery and personalization. Enhanced identity features separately control additional customer-identifier sharing, Google Signals and Google advertising personalization. Limited source labels can accompany an inquiry when Inquiry and order source is on. Submitted source information can appear in our inquiry records and notification emails, and our team can copy its summary into ShootQ. Limited labels can also be saved with eligible new orders under the regional-only rule below. They can be available to authorized order-management and export integrations under their existing access. These records follow the provider and retention information in this notice. The limited source feature does not itself send measurement events to Google or Meta. Only an affirmative Advertising choice permits full source history and source parameters on Calendly scheduling links.

External websites and services linked from our site have their own privacy practices. Information already sent to a recipient is not recalled by changing a browser preference.

AI-assisted studio work

We use AI-assisted tools in parts of our studio work. Depending on the task, client photographs or messages may be processed through these tools. Uses can include editing or preparing images and assisting with written communications. The information involved and how it is processed depend on the tool, account settings and task.

Our photo-editing tools include Imagen and Evoto. Depending on the task, AI-assisted tools may also include Adobe Photoshop, Claude, ChatGPT and Gemini. Provider processing and any use of information to improve their services depend on the provider’s terms and our account settings.

Imagen and Evoto offer features that detect faces for editing and features that can recognize the same person across photographs. Recognition features can involve analysis of facial characteristics. A tool’s capabilities do not mean that every feature is used for every project. Contact us about the tools and features relevant to your work, or to discuss a restriction before processing begins. This notice does not itself provide consent for processing that requires separate consent under applicable law. Any required separate notice and consent must be provided and obtained before that processing begins.

This section describes tools used in our studio workflow. It does not mean that we offer visitors a separate AI product through this website or that every project or message is processed by every tool.

If you have questions about how AI tools may be used for your session, photographs or communications, contact us before providing information or booking. This notice does not expand the usage rights or permissions in your agreement. Cookie settings control optional website tracking; they do not control every tool used in studio work.

Optional website tracking

Cookie settings lets you control Analytics, Inquiry and order source, Advertising and Enhanced identity features. Inquiry and order source means the limited internal source feature described here. Limited order labels are available only under eligible regional defaults. Advertising was called Marketing in our earlier controls. Necessary forms, security, accounts and shopping stay on and remain available when you reject optional uses.

For eligible visits identified as Wisconsin or Minnesota, Analytics, limited Inquiry and order source and ordinary Advertising measurement can start on, with their controls preselected. These defaults cover ordinary, nonsensitive website activity on this site intended for adults. We use an approximate region from the connection, not device GPS or proof of residence. For visits from the EEA, United Kingdom, Switzerland and other regions, or when an eligible region cannot be verified, optional uses start off and require affirmative choices, subject to the checks below. Limited order labels remain unavailable outside the eligible regional default.

A regional default is not recorded as your affirmative consent. A saved refusal takes priority. Expired or invalid saved permission does not become a new allowance under the regional rule. Close or Escape dismisses the controls without saving edits or creating consent; your current saved choices or eligible regional defaults continue. Save & close saves only the controls you edit. Leaving a preselected regional setting unchanged does not turn it into an affirmative allowance. Accept all, including enhanced affirmatively allows every optional category, including the additional identifier sharing and matching described below, where available. Reject optional turns off all optional categories.

Optional uses pause while the site checks the regional setting and browser privacy signal. If a required result cannot be verified, Inquiry and order source, Advertising and Enhanced identity features stay off for that page. Analytics can still follow a valid affirmative choice. A regional default on an open page lasts no more than 30 minutes. Each new page performs a new check. Browsing, sending an inquiry or making a purchase does not provide affirmative consent.

Analytics measures website use, shopping and inquiries with Google Analytics. Ordinary Advertising measurement uses Google and Meta tools, including advertising cookies and identifiers. These providers can receive browser and device information, pages visited and advertising interactions. This information can identify a browser or be associated with an account; it is not anonymous. See how Google uses information from businesses, Google's Privacy Policy and Meta's Privacy Policy for their processing, including measurement, ad delivery and personalization. The separate Enhanced identity features choice controls the additional uses described below; it does not control every use Meta may make of ordinary advertising events.

Limited Inquiry and order source keeps a small set of source, medium and approved campaign labels, with their capture time, so we can understand how inquiries and eligible new orders reach us. Other campaign text is recorded as unspecified. Its separate browser record does not contain your name, email address, phone number, message, form answers, advertising click identifiers, Google Analytics client identifier, full referring URL or landing-page path. It can fill existing source fields on supported inquiry forms. If you submit one of those forms, the labels travel with your inquiry and can be linked to the contact details you provide. This is personal information, not anonymous measurement. The feature does not submit a form for you or guarantee source information for every inquiry.

On eligible Wisconsin or Minnesota visits using the regional source default, a supported checkout can also attach these limited labels to a new order. This order feature is available only under that default. An affirmative Inquiry and order source choice, whether saved earlier or now, currently enables inquiry labels only; it does not enable limited order labels. We do not treat an explicit choice as a regional default or add labels to past orders. An affirmative Advertising choice permits the separate full shop attribution feature instead.

A limited order label can be linked to the contact and purchase details in that order. It is an unverified source hint, not proof of an ad click, an attributed sale or a confirmed session booking. We retain its capture time, regional-default basis and policy version with the order. The feature does not guarantee a label for every order. Order labels can be available to authorized order-management and export integrations under their existing access.

The limited source record stays in the same browser tab for up to 30 minutes from capture. Its deadline is fixed; reusing that record does not extend it. Expired records cannot be reused. Removal can wait until a suspended page resumes running. To attach a label to a new order, its source record must be less than 30 minutes old. This browser limit does not delete a source summary already received with an inquiry or order; those copies follow the business-record retention rules below.

Turning Inquiry and order source off stops its future capture and new limited order labels, and clears its browser record and the source fields it added to unsubmitted forms where browser access permits. An affirmative Advertising choice can separately allow full source history. To stop both source features, turn off both controls or choose Reject optional. Changes cannot recall information already sent.

Only an affirmative Advertising choice allows full inquiry source history, advertising click identifiers with an inquiry or scheduling link, and WooCommerce's full order attribution. A regional Advertising default does not enable these features. Full source history can include source, medium, campaign information, advertising click identifiers, landing-page paths, referring website host names and timestamps. Information submitted with an inquiry can be linked to your contact details and copied into ShootQ. Following a scheduling link with added source information sends those parameters to Calendly. First-touch and last-touch records have different age limits; browser storage periods do not determine retention of copies in business systems.

With an affirmative Advertising choice, WooCommerce can associate full referral and campaign information with orders. Withdrawing Advertising stops this full shop source collection and clears its source information from unsubmitted checkout fields where browser access permits. Analytics, limited Inquiry and order source and regional Advertising defaults do not enable full shop order attribution. The separate limited order label can still be available under an eligible regional source default. Necessary cart and checkout functions remain available.

Enhanced identity features starts unchecked in every region and requires a separate affirmative choice, with Advertising also on. This permits supported sharing of identifiers you provide, such as email addresses and phone numbers, with Google and Meta for enhanced conversion measurement and customer matching. Identifiers can be hashed, which changes them into codes used to find a match. Hashing does not make that matching anonymous. This choice also permits Google Signals for additional reporting and Google advertising personalization, including remarketing. We use these features only where lawful. The choice does not authorize sending inquiry messages, sensitive personal information or children's information to advertising providers. Google's and Meta's automatic contact-detection features remain off.

You can turn Enhanced identity features off without turning off ordinary Analytics or Advertising measurement. Turning Advertising off also prevents Enhanced identity features from operating. A browser opt-out blocks Advertising, Inquiry and order source and Enhanced identity features as explained below. These changes stop future optional uses; they cannot recall information already sent.

We save choices in the to_consent_v3 cookie and a matching local-storage record, with compatible to_consent_v2 and to_consent_v1 records for earlier site pages. An affirmative allowance lasts up to 180 days from the time you save that purpose. Returning to the site or editing a different purpose does not renew it. Local preference records can remain after cookie expiry to preserve refusals and expired-choice status. Earlier choices continue only for the ordinary purposes they covered. An earlier Marketing allowance does not turn on Enhanced identity features; earlier refusals stay in place for the purposes they covered. Where Inquiry source was a separate choice, that choice is preserved independently. If preferences cannot be saved or verified, the site keeps optional uses off on that page and tells you about the problem.

See our Cookie Policy for browser storage, the limited source record's 30-minute rule, full source-history age limits, browser controls and withdrawal behavior.

Browser privacy signals

Do Not Track and Global Privacy Control are different signals. We do not currently respond to the legacy Do Not Track signal.

When our website detects Global Privacy Control, it turns off Inquiry and order source, Advertising and Enhanced identity features for that browser, including full source history, even if an older choice allowed them. Analytics follows its own saved choice or an eligible regional default; GPC does not itself grant Analytics permission. An explicit Analytics refusal remains off. Removing GPC does not automatically restore earlier blocked allowances. A retained opt-out continues until you make a new choice when no active GPC signal applies.

A browser choice does not identify or automatically erase an earlier inquiry, order or other business record. Contact us to request action on information we hold.

Retention and security

We keep personal information for as long as it is needed for the purpose for which it was collected, subject to applicable legal requirements. We decide the period by considering the service or purchase involved, any archive or access commitment in your agreement, support needs, accounting and legal obligations, security needs, and the establishment or defense of legal claims.

Different records can have different periods. Inquiries support communication and follow-up; photographs and galleries support delivery and agreed access; contracts and transaction records support our business and legal obligations. Closing an account or clearing browser storage does not automatically delete these other records.

When we have no ongoing legitimate business need to process personal information, we will delete or anonymize it or, where that is not yet possible because it is held in backup archives, securely store it and isolate it from further processing until deletion is possible.

Browser storage and business records have separate retention rules. Local storage does not automatically disappear when a cookie expires. Turning off a purpose stops its future optional use. Turning off Inquiry and order source stops new limited order labels and clears its separate browser record and the source information it added to unsubmitted forms where browser access permits. Turning off Advertising clears the full inquiry source-history and full shop source records described in our Cookie Policy where browser access permits and prevents Enhanced identity features from operating. Turning off Inquiry and order source alone does not turn off full source history already allowed through an affirmative Advertising choice. These changes cannot recall information already sent.

We use safeguards intended to protect the information we handle. No website, transmission or storage system can guarantee complete security. Contact us if you suspect an issue involving your information.

Children and family sessions

Our website is intended for adults arranging services and purchases. Teens may contact us with questions, but a parent or legal guardian must arrange and sign for a minor’s session. Please contact us if a child has used the website without appropriate authorization.

Our services include photographing children and families. Parents, guardians and other adults may provide planning information and arrange services that involve children. Those records are different from a child independently creating an account or sending information through a service directed to children.

Photographing a child, receiving planning information from an adult, and a child independently using a website are different situations. Permission to arrange a session does not by itself settle every publication or other use of a child's image.

If a child has submitted information through the website without appropriate authorization, or you have a concern about a child's information or image, contact us so we can review it and take the appropriate action.

Privacy requests and applicable rights

Depending on the law that applies to your information and our processing, you may have rights to access or receive a copy of information, correct it, request deletion, restrict or object to certain uses, withdraw consent, or opt out of certain advertising, sale or sharing activities. Rights and exceptions vary. You may also have a right to complain to a privacy regulator or appeal a decision.

Optional advertising measurement and customer matching can be treated as sale or sharing under some laws. Use Cookie settings to turn Advertising off for this browser, or enable Global Privacy Control. Both also prevent Enhanced identity features from operating. Contact us for a request concerning information already held in business records. These browser controls do not automatically erase earlier records.

Email [email protected] with your request and enough information to help us locate the relevant records. Please do not send passwords, full payment-card details or government identification unless a secure and necessary verification process has been agreed. We may need to verify your identity or an agent's authority before acting on a request.

You may also contact us by phone at 608-347-8028 or by mail at the studio address above. Tell us what you are requesting and how you would like us to respond. We use information supplied to verify a request for that verification purpose, rather than treating the request as permission for unrelated marketing.

We will consider requests under applicable law, including response deadlines, verification rules and permitted exceptions. Where a law permits an authorized agent to act for you, we may need to verify the agent's authority. If we cannot fulfill a request in whole or in part, we will explain the reason and any applicable appeal route. You can email the same address to ask us to review a decision.

Where your website account provides an information-editing function, you can use it to update the available details. Contact us about account closure or information you cannot change there. Account closure and a request to delete other business records are related but separate actions; applicable retention requirements and exceptions still apply.

Regional privacy information

United States

Applicable state privacy laws can give people rights to know whether information is processed, access or obtain a copy of it, correct inaccuracies, request deletion, and receive equal treatment when exercising those rights. Depending on the law and processing involved, rights can also include opting out of sale, sharing, targeted advertising or certain profiling.

Some laws provide additional rights concerning categories or identities of recipients, sensitive information, or the use of information in profiling and automated decisions. The rights, exceptions and procedures depend on the law that applies. A list of rights in this notice does not imply that we engage in each type of processing described.

Use the contact methods in Privacy requests and applicable rights to make a request. You may use an authorized agent where applicable law permits. We may verify identity or the agent's authority as required for the type of request. You can email [email protected] to appeal a decision where an appeal right applies. We will explain our decision and the applicable complaint route, which may include your state attorney general.

Our treatment of browser choices is described under Browser privacy signals. Cookie settings and Global Privacy Control govern the browser activity described there; they do not automatically identify a previous customer record.

California

California residents can contact us about the personal information we hold and the rights that apply to their information. California's “Shine the Light” law also concerns requests about certain disclosures to third parties for their direct marketing purposes. Where that law applies, a California resident may request the relevant categories of information and the names and addresses of recipients for the preceding calendar year, once a year without charge. Send a written request to the studio contact above.

Optional advertising disclosures may be considered a sale or sharing under applicable law. That question depends on the actual information flow and use, rather than whether money changes hands. Browser choices and requests about existing records serve different purposes.

EEA, United Kingdom and Switzerland

We sell shop products worldwide and occasionally provide photography services in the United Kingdom and European Union. The protection that applies depends on the relevant law and processing activity, rather than the location of our studio alone.

Legal bases where EU or UK data-protection law applies

• Contract: information necessary to provide requested services, fulfill orders or take steps you request before a contract.
• Legal obligations: records and disclosures required by applicable law.
• Legitimate interests: appropriate business purposes such as protecting the site, preventing misuse and handling support, subject to the required assessment of your rights and interests.
• Consent: processing for which consent is required, including affirmative choices for Analytics, Inquiry and order source, Advertising and Enhanced identity features in these regions.

A booking contract does not automatically supply a lawful basis for every use of every participant's information. Sensitive information can require an additional legal condition. In these regions, optional website tracking remains subject to your affirmative choices.

Your rights and complaint routes

Where applicable data-protection law provides them, your rights may include access and a copy of your information, correction, erasure, restriction, portability, objection to processing, and protection concerning decisions made solely by automated means that have legal or similarly significant effects. You can contact us to exercise an applicable right. If such an automated decision is made, we will provide the information and review options required by the law that applies.

Where consent is the basis for processing, you can withdraw that consent. Withdrawal does not undo earlier lawful processing and does not remove other lawful grounds where they apply. In these regions, optional website Analytics, Inquiry and order source, Advertising and Enhanced identity features follow their affirmative-choice requirements; other business purposes do not override those choices.

Your right to object: where applicable law provides this right, you can object to processing based on legitimate interests and to processing for direct marketing. Contact us using the privacy-request details above. Marketing email preferences and website tracking choices are separate controls.

You can complain to the relevant EEA data-protection authority, the UK Information Commissioner's Office, or the Swiss Federal Data Protection and Information Commissioner, as applicable.

Canada

Where applicable Canadian law requires consent, the appropriate form of consent and any permitted exception depend on the information and purpose. You can contact us to ask about access, correction or withdrawing consent and any lawful limitations. For visits identified as outside the Wisconsin and Minnesota default rule, optional Analytics, Inquiry and order source and Advertising require affirmative choices, subject to the verification limits explained above. Enhanced identity features always requires a separate affirmative choice and Advertising must also be on.

Australia and New Zealand

Where applicable law provides access or correction rights, contact us using the methods above. If you choose not to provide information needed for a requested service, we may be unable to provide that service, answer the request or manage the related account or transaction.

For a privacy complaint, you can contact the Office of the Australian Information Commissioner or the New Zealand Office of the Privacy Commissioner, as applicable.

South Africa

You can contact us about access to or correction of personal information and other applicable rights. If you are dissatisfied with how we address a privacy complaint, the Information Regulator of South Africa provides information about the relevant complaint process.

International processing

Twig & Olive is based in the United States and serves customers in other countries. Information handled for your inquiry, purchase or photography service may be processed in the United States and in locations where the relevant providers operate. Some albums are produced by our partner lab in Portugal. Information needed to fulfill an order can be shared with the relevant production and delivery providers.

Where applicable law restricts international transfers, those protections still apply. Visiting the website, making a purchase or signing a booking contract does not by itself waive them. Contact us to ask about the recipients, processing locations and any safeguards applicable to your information.

Changes to this notice

We will show the date of a published revision at the top of this notice. If a material change requires additional notice or consent, we will follow the applicable requirements. A revised notice does not itself give us permission to use previously collected information for an unrelated purpose.

All policies and disclosures