Privacy statement

Version June 2026

Data controller

Michiel Heijmans Fotografie
Bijsterhuizen 2414, 6604 LL Wijchen, Netherlands
Chamber of Commerce 87574012 · VAT NL004439631B22
Reachable via michielheijmans.com.

What data we process

We process as little personal data as possible:

  • Visitors without an account - only your IP address, solely for rate limiting on the website checker (temporary storage, see retention).
  • Account data - name, email address and an encrypted password, plus signup date and newsletter preference.
  • Subscription data - start date, term and Mollie customer ID.
  • Payments - payments are processed end-to-end by Mollie Payments B.V. We do not receive full payment details.
  • AI credit and usage - when you use AI tools we record your credit balance and a usage log (tool, model, tokens and cost).
  • Premium tool data - data you enter into paid tools is stored per tool.
  • Premium branding (model release) - if you have premium and set up branding, we store your logo, accent colour, header name, contact line, CoC/VAT line, tagline and footer text on your account, so they are reused automatically on future PDFs. You can clear these at any time via the PDF page.
  • Webhook and cron logs - in case of a failed payment webhook or cron job we log an error row with user ID, payment ID and the payment provider payload, strictly for debugging. These rows do not contain full payment details.
  • Email queue - scheduled emails (welcome, onboarding, reminders) sit in a queue until they are sent, with your user ID, template and scheduled date.
  • Golden hour alerts - if you sign up for the weekly golden hour email we store your email address, the chosen location (coordinates and place name), your language and the IP address used at signup (for rate limiting). Signup uses double opt-in. You can unsubscribe via the link in every email; your data is deleted immediately afterwards.

Photo and image processing stays local

Tools that process photos (camera styles, EXIF viewer, watermark generator, diptych maker, social media image) keep the photos entirely inside your browser. Nothing is uploaded to our servers. Processing and download happen on your own device.

Cookies

We set three cookies: language preference, theme (light/dark) and a session cookie when you log in. No analytics cookies, no third-party trackers. The language preference is synchronised automatically with the URL path (/ for Dutch, /en/ for English).

Third-party services

Fonts, map software (Leaflet) and PDF libraries are served from our own server; no data is shared with third parties for these. External services:

  • Sunrise-sunset.org - for sunrise/sunset times; your coordinates are sent per request.
  • Open-Meteo - for weather data; your coordinates are sent per request.
  • OpenStreetMap / Nominatim - for address lookup and map display in the map tools (golden hour, location log, photo locations, route planner).
  • OSRM (FOSSGIS e.V.) - for route calculation in the route planner; route coordinates and your IP address are sent per calculation.
  • Map backgrounds in the route planner - if you choose satellite (Esri), topographic (OpenTopoMap) or Carto, that provider receives your IP address when the map loads.
  • OpenRouteService / OSRM - for distance calculation in the mileage log; the request goes through our server, your IP address is not shared.
  • RDW Open Data, EU VIES and PDOK - for licence plate, VAT number and postcode lookups; only the entered value is sent.
  • Anthropic (Claude API) - for AI tools; only your input text is sent, without name or contact details.
  • Mollie Payments B.V. - for payments.
  • Moneybird - for invoicing.
  • Resend - for sending emails (account, newsletter, golden hour alerts); your name and email address are passed on for delivery.

Legal basis (GDPR)

  • Performance of a contract (art. 6.1b) - account, subscription and payment.
  • Legitimate interest (art. 6.1f) - rate limiting, security and webhook error diagnosis.
  • Consent (art. 6.1a) - newsletter. Also covers the golden hour alerts (double opt-in, unsubscribe anytime).

Retention periods

  • Account data - for as long as the account is active; up to 30 days after a deletion request.
  • IP addresses (website checker) - up to 90 days.
  • Payment data and invoices - per statutory retention requirement (7 years).
  • Webhook error logs - 90 days, then automatically cleaned.
  • Sent emails in the queue - 90 days after sending, then automatically cleaned.
  • Golden hour alerts - until you unsubscribe; unconfirmed signups are deleted automatically after 30 days.

Your rights

You have the right to access, correct or delete your data. Send a request via michielheijmans.com. We respond within 30 days.

Photography news (RSS)

On the photography news page we show titles, dates and short excerpts from public RSS feeds of Dutch photography sources. We link through to the original sites and host no articles or podcasts. Clicking an item opens the source in a new tab, we do not track click behaviour. Visiting a source is governed by its own privacy policy. Sources that prefer not to be listed can contact us via michielheijmans.com.

Advertising

We display in-house ads for the workshops, online course and street sessions by Michiel. In the future we may also include editorial-fit third-party ads. We measure how often an ad is in view and clicked, anonymously via a daily hash of IP and browser fingerprint (no cookies, no profiling). Data is kept for up to 90 days. Premium subscribers do not see ads.