Effective 24 August 2026
This site is operated by Zulu Creative LLC, doing business as Jonathan Zuluaga ("I," "me," "my"), a photography and film studio based in Chicago, Illinois. This policy explains what information this site collects, why, who it goes to, and what you can ask me to do about it.
I run a small studio, not an advertising business. I don't sell personal information, and I never have.
What I collect
When you use the contact form. Your first name, last name, email address, subject line, and message. All five fields are required. That's the whole form — there is nothing hidden in it.
When you email or call me. Whatever you choose to put in the message, plus your email address or phone number. If we go on to work together, that expands to the things a working relationship needs: a billing address, a business contact, project details, and a record of invoices and payments.
Automatically, when you visit. Standard web log and analytics data — the pages you viewed, roughly where in the world you are, the browser and device you used, and the site that referred you. This arrives in aggregate. I use it to understand which work people actually look at, not to identify you.
I do not collect payment card numbers on this site. There is no checkout here. Invoices are sent and paid through QuickBooks, which handles that data under its own terms.
On photography and biometrics. I photograph people at events, in restaurants and in hotels. Those images are photographs, and I treat them as such. I do not run facial recognition, face-geometry scanning, or any other biometric analysis on the images I make, and I do not build or license databases of biometric identifiers.
Why I collect it
To answer your enquiry, quote a project, and do the work. To send and collect invoices. To keep the business records the law requires me to keep. To understand how the site is performing.
I do not send marketing email from this site. Submitting the contact form does not subscribe you to anything.
Who it goes to
I use a small number of services to run the studio. Each receives only what it needs:
- Squarespace hosts the site and runs the contact form. It receives everything you submit through the form, plus visit data.
- Google Workspace runs my email. It receives anything you email me, and form submissions forwarded to my inbox.
- Meta receives a record of your visit to this site, through an advertising and measurement pixel, associated with a Meta cookie.
- Intuit QuickBooks handles invoicing and payment records. It receives client billing details, and only for projects that go ahead.
Beyond these, I share personal information only when a client project genuinely requires it — a venue needing a name on a crew list, a retoucher or second shooter under the same obligations I hold — or where the law requires disclosure.
I do not sell your personal information, and I do not share it for cross-context behavioral advertising in exchange for anything of value.
Cookies and tracking
Squarespace sets cookies necessary for the site to function and for its built-in analytics.
This site also runs a Meta pixel, which sets a cookie and reports your visit to Meta. If you would rather it didn't, you can control this at facebook.com/adpreferences, through your browser's cookie settings, or with any standard tracker-blocking extension. Blocking it does not affect how the site works.
Do Not Track. Browsers can send a "Do Not Track" signal. There is no agreed industry standard for what a site must do in response, and this site does not currently respond to those signals. I am telling you that plainly because California law requires the disclosure — and because it's the honest answer.
How long I keep it
Contact form messages and enquiries: about two years, then deleted. Client project records, contracts and invoices: seven years, which is what tax and business-records practice calls for. Aggregate analytics: as long as the platform retains it.
What you can ask me to do
Whoever you are and wherever you live, you can ask me to:
- tell you what personal information I hold about you
- correct anything that's wrong
- delete it, unless I'm required to keep it for tax or contractual reasons
- stop using it for a particular purpose
Email me and say what you want. I'll confirm receipt and act within 30 days. There's no form to fill in and no charge. I may need to verify you are who you say you are before I hand anything over.
If you're in California, the EU or the UK, you have these rights under CCPA/CPRA, GDPR or UK GDPR respectively, plus the right not to be treated differently for exercising them. I honor them for everyone regardless.
Children
This site isn't directed at children under 16 and I don't knowingly collect their information. If you believe a child has sent me something, email me and I'll delete it.
Security
Form submissions and site traffic are encrypted in transit. Client files live in access-controlled cloud storage. No system is perfect, and I won't claim otherwise — but the amount of personal data this studio holds is small by design, which is the best protection there is.
Changes
If this policy changes materially, I'll post the revised version here with a new effective date. The date at the top always tells you which version you're reading.
Contact
Jonathan Zuluaga — Zulu Creative LLC Chicago, Illinois info@jonathanzuluaga.com