Privacy Policy

1. Who we are

KensiCam is an independent VRChat photography and cinematic media service operated from North Carolina, United States. We accept clients worldwide.

For any privacy question or data request, contact info@kensi.cam.

2. What we collect

We only collect what you give us directly. We do not run analytics, tracking pixels, or ad networks.

Contact form

• Name (as provided)
• Discord handle or VRChat username
• Selected service and package tier
• Your message

During a booking

• Communication you send us via Discord DM or other channels
• Payment method details you share with us (handled via Discord DM — no card data ever passes through this site)
• Reference images, avatar files, or briefs you provide for the shoot

Automatic data

Our hosting provider (Cloudflare) collects standard server logs (IP address, user agent, request paths) for security and abuse prevention. These logs are retained for a short period by Cloudflare and we do not use them for profiling.

3. Why we use it (legal basis)

• To respond to your booking inquiry — performance of a contract (GDPR Art. 6(1)(b)) or your consent (Art. 6(1)(a)).
• To deliver the service you booked — performance of a contract.
• To showcase finished work in our portfolio — only with your explicit consent (see Section 5).
• To keep the site secure — our legitimate interest (Art. 6(1)(f)).

4. Who we share data with

We share the minimum needed to operate. Our processors are:

• Cloudflare, Inc. — site hosting and CDN. Cloudflare proxies all traffic, serves the website, and stores delivered media in their R2 object storage. They process technical logs for security and abuse prevention.
• Cloudflare Web Analytics — privacy-friendly visit measurement. Does not use cookies, does not identify individuals, does not store IP addresses. Counts page views, top pages, browser families, country (coarse), and referrers. See cloudflare.com/web-analytics.
• Instagram and Discord — booking conversations and payment coordination happen on these platforms once you click through. Their own privacy policies apply.
• Payment processors you choose (e.g. PayPal, Ko-fi) — payment is handled directly between you and the processor; we do not store your payment details.

We do not sell or rent personal data to anyone, ever.

5. Portfolio and social media use

Finished photos and videos from your shoot may appear on KensiCam’s portfolio website, Discord server, X/Twitter, and the VRChat-adjacent social accounts referenced in our Avatar Showcase package — but only after we obtain your consent in writing (a Discord message counts).

You can withdraw that consent at any time by emailing info@kensi.cam. We will remove the content from channels we control within a reasonable time; third-party reposts or screenshots may persist outside our control.

6. International transfers

KensiCam operates in the United States. If you are in the European Economic Area, the UK, or Canada, your data will be transferred to and stored in the US by us and our processors. We rely on the Standard Contractual Clauses or equivalent safeguards used by our processors.

7. How long we keep it

• Contact-form messages: up to 24 months, then deleted.
• Booking records and delivered files: kept until you ask us to delete them, or 24 months after delivery — whichever is sooner.
• Server logs (Cloudflare): per Cloudflare’s standard retention.

8. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct or update it
• Delete it (“right to be forgotten” under GDPR)
• Restrict or object to processing
• Receive a copy in a portable format
• Withdraw any consent you previously gave
• Lodge a complaint with your local data protection authority (e.g. your EU member state DPA, the UK ICO)

To exercise any of these, email info@kensi.cam. We respond within 30 days.

California residents (CCPA/CPRA)

We do not sell or share personal information as those terms are defined under California law. You have the rights described above, plus the right to non-discrimination for exercising them.

9. Minimum age

KensiCam services and this website are intended for an adult audience aged 18 or older. We do not knowingly collect data from anyone under 18 and we do not accept bookings from minors. If you believe a minor has contacted us, email info@kensi.cam and we will delete the data immediately.

10. Cookies and analytics

This site does not set any cookies for public visitors and does not use advertising or marketing tracking pixels.

We use Cloudflare Web Analytics to understand basic traffic patterns (how many people visited, which pages were popular, what country they came from at a coarse level). It is cookie-less and does not identify individual users: no IP addresses are stored, no fingerprinting is performed, and no cross-site tracking happens. Because it does not place anything in your browser or otherwise track you across sites, consent is not legally required under GDPR or CCPA, and no cookie banner is needed.

Administrators who unlock the staging version of the site receive a single kensicam_preview session cookie (HttpOnly, Secure, SameSite=Lax) for 30 days. This cookie is strictly functional, set only after an admin actively chooses to unlock the staging view, and contains no personal data.

If we ever add cookies that require consent (e.g. marketing analytics), we will update this policy and present a consent banner before they are set.

11. Security

The site is served over HTTPS. We keep credentials and account access on systems with two-factor authentication where available. No internet service is ever 100% secure, so we cannot guarantee absolute security — but we take reasonable steps.

12. Changes to this policy

We’ll update this page when our practices change. The “Last updated” date above will reflect the latest revision. Material changes will also be announced on the KensiCam Discord.