Privacy policy

Higginbotham Media LLC (“Higginbotham Media”, “we”, “us”) respects your privacy. This page explains what information we collect when you visit this website, book a shoot, or use your account, how we use it, who receives it, and the choices you have.

Information we collect

• Contact form data — the name, email, phone (if provided), property address or preferred date (if provided), service, and message you submit, along with the page you sent it from and your IP address, are stored in our inquiry queue and emailed to Tracey through our email provider. We keep an inquiry while it is needed to respond and manage the resulting client relationship, and remove it earlier when you ask unless the law requires otherwise.
• Newsletter email — if you subscribe to the newsletter, your email address is stored by our email provider (Resend) for the sole purpose of sending occasional updates. You can unsubscribe at any time from any newsletter we send.
• Account and booking data — when you create an account or book a shoot we collect your name, email, phone, company or brokerage, billing and property addresses, the answers you give on the booking form, and any notes. Booking answers can include gate and lockbox codes. If you sign in with a password we store only a one-way hash of it; if you sign in with Google we receive your email address and name. You can add a profile photo, turn on two-factor authentication (an authenticator app or an emailed code), join teams, and earn loyalty status and referral credits, all of which we record against your account.
• Security and consent records — we log your IP address and browser details when you sign up, accept these policies, sign in or change security settings, and note when your account was last active. We use these records to protect accounts and to show what you agreed to and when.
• Reviews and public profiles — if you submit a review and tick the publication box, we may publish your first name, last initial and brokerage with it. Your profile and your team’s page are private unless you choose to make them public; a public profile can show your name, photo, bio, license number and, if you add them, your phone and email.

Analytics

We count visits to understand which pages are useful. Neither counter uses cookies, follows you across other websites, or feeds advertising.

• Our own counter runs on pages across this site, including the sign-in, account and client gallery pages, but not the admin area. It records the page, the site that referred you, campaign tags in the address (such as utm_source), an approximate location, a device type (mobile, tablet, or desktop), how long you stayed, the destination of links that leave our site, which photos were opened, and the steps you reach in the booking form. Each visit is tied to a one-way hash of your IP address that changes every day, and the IP address itself is stored alongside it. We delete these records after 365 days (180 days for search-engine and other automated crawlers).
• GoatCounter, an independent privacy-focused service, also counts views of our public pages. It does not run on the booking, sign-in, account, or client gallery pages.
• Vercel Speed Insights measures how quickly our pages load. Vercel, our hosting provider, receives those measurements with the address of the page, without any query string, so share-link tokens are not included.

Cookies and browser storage

We set only the cookies the site needs to work. We do not use advertising cookies.

• Sign-in session — keeps you signed in for up to 90 days.
• Two-factor authentication — a 10-minute cookie while you finish a sign-in challenge, and a 90-day cookie that remembers you passed it on that browser.
• Google sign-in — a short-lived cookie that protects the sign-in handshake.
• Gallery access — an 8-hour cookie after you enter a gallery passcode.
• Gallery favorites — if you favorite photos without an account, a random identifier cookie lasting one year remembers your picks.
• Booking draft — your address, date and time are kept in your browser’s session storage while the tab is open, so a refresh does not lose them. Contact details and notes are not kept there.

The chat assistant and Cloudflare Turnstile, described below, can set their own cookies or storage under their own policies.

AI features

Photo edits

In your online gallery you can generate virtual staging, virtual twilight and declutter previews. When you do, the selected gallery photo and a text instruction are sent through Vercel’s AI Gateway to Google’s Gemini image models, which return the edit. Photos of the inside of a home can show personal belongings, so choose photos accordingly. We store the result, the status and price of each edit, and any note you add when you report a problem, in your account. Previews you discard remain in our records. We also use a Google Gemini model to write alt text for images we upload to our public media library.

Studio assistant

When messages reach us through the contact form, chat feedback or a booking, staff may use Anthropic’s API to draft a reply or a check-in note. That draft can draw on the message text, the sender’s name, the booking details and, for check-ins, a client’s name, team and number of shoots. A person reviews every draft before it is sent.

Chat assistant

A chat assistant, served from chat.hig.media, appears on most pages, including sign-in and account pages. If you are signed in we pass it your email address and first name so it can greet you and look up your account. Conversations may be stored to answer follow-up questions and to improve the assistant, and feedback you leave through it, with your email if you give one, is stored with the page you were on. Do not put payment details, gate codes or other sensitive information into the chat.

AI clients and MCP connections

Higginbotham Media offers a public Model Context Protocol (MCP) endpoint that compatible AI clients can use to read our published services, pricing factors, studio information, and appointment availability. The public tools accept a service identifier and a requested date. They do not request your name, account details, property address, precise location, payment information, gallery passcode, or property access code.

The AI service you choose sends those tool inputs to us and receives the tool result. We use them only to answer the request and protect the service from abuse. Successful public MCP inputs and results are not saved in our application database after the response. A transient per-IP rate-limit key expires within 10 minutes. Our hosting provider may process ordinary request and security metadata under its own operational retention settings.

A separate account connection is available only after you sign in here and approve it. Depending on the action you request, it can share your name and email, bookings and property addresses, gallery links, loyalty status, and referral information with the AI service, or create, reschedule, update, and cancel bookings. MCP tools reject and redact property gate and lockbox codes. Authorization codes expire within 10 minutes; access tokens within one hour; and rotating refresh tokens within 30 days. OAuth codes and refresh tokens are stored only as one-way hashes and expired records are purged.

Email

We send booking, invoice, gallery, account-security and program emails through Resend, which sees the recipient and the content of each message. Resend reports back whether each message was delivered, bounced, opened or clicked, and we keep those events with the recipient and subject. Transactional emails do not include an unsubscribe link because they are needed to run your account; you can opt out of promotional email in your account profile or from the link in a newsletter.

Text messages

Our sign-up and booking forms let you agree to text messages. We are not sending text messages at this time. If we begin, we will use the phone number you gave us only for booking and account messages and, where you opted in, occasional promotions from us. Message frequency varies and message and data rates may apply. Reply STOP to opt out or HELP for help, or withdraw consent in your account profile. We do not sell your number or share it with third parties for their marketing.

Service providers and recipients

We disclose information only as needed to operate the requested workflow. Recipients can include the AI service you connect, our website hosting, storage and database providers (Vercel and Supabase), Resend for email delivery, Google for sign-in, calendar, address suggestions, maps and route processing, Cloudflare Turnstile for spam protection on forms (it receives your IP address), Google and Vercel’s AI Gateway for photo edits, and OpenStreetMap’s Nominatim service when an address needs fallback geocoding. Booking actions may also update our QuickBooks system and send the property address and any gate or lockbox codes you entered to Gate.Codes, which stores access codes for the property. When you use the airspace check on our Aerial & Drone page, the coordinates of the address you choose are sent to the FAA’s public airspace service. Each provider processes information under its own terms and privacy policy.

Client gallery portal

Client galleries, bookings, orders, rewards, referrals, and accounts are handled on this site and secured behind a login. We keep these records while the account is active and afterward when needed to deliver work, maintain business and tax records, prevent fraud, or meet legal obligations. Galleries close after the period stated at delivery, typically one year; a closed gallery is archived rather than deleted. You may ask to access, correct, or delete your data, or disconnect an AI client, by contacting Tracey. When we erase an account, we remove your personal details and keep the bookings, invoices and ledger entries we are required or entitled to retain. We cannot erase an account while a shoot is still scheduled.

Authorized Higginbotham Media staff can see your account records to do their work. To resolve a support request, staff may sign in as you for up to four hours; every page they open and action they take in that session is logged.

Property websites

Some listings we photograph have their own website on a hig.media address, published by the listing agent. If you send an inquiry through the form on one of those sites, your name, email address, phone number, message and IP address are stored by us and emailed to that agent so they can answer you. The agent is responsible for how they use your details after that. We do not add you to a mailing list. To have an inquiry removed from our records, contact Tracey.

We count visits to these sites with the same kind of cookie-free counter described above: the page, referring site, campaign tags, device type and approximate location against a daily one-way hash of your IP address, kept for 365 days and shown to the agent as totals and trends. Pages can embed videos, tours and maps from YouTube (privacy-enhanced mode), Vimeo, Matterport and Google Maps; those providers receive your IP address when the embed loads. We look up an address’s coordinates to place it on the map, send a site’s web address to search engines through IndexNow so they can find it, and send a connected or registered domain name to our domain registrar (NameSilo) and to Vercel. Where an agent hides the address, the site’s own web address does not contain it.

How long we keep information

• Analytics visits and events: 365 days; crawler visits: 180 days.
• OAuth codes, access tokens and refresh tokens: 10 minutes, 1 hour and 30 days; unused client registrations after 30 days.
• Rate-limit counters: removed shortly after they expire.
• Account, booking, invoice, gallery, photo-edit, consent, security, email-event and inquiry records: kept while needed for the purposes above. We do not delete them on a timer, and we remove them earlier when you ask unless we must keep them.

Children

This website and our services are for adults. We do not knowingly collect information from anyone under 18. If you believe a child has sent us information, contact us and we will remove it.

Contact

Questions about this policy, or a request about your data? Email tracey@higginbothammedia.com or call (321) 634-4902.

Last updated: October 8, 2026.