Trust Center

    Trust, Security & Privacy

    This page is maintained by RTW Photography to answer common security and privacy questions about ridethewave.co. It describes the controls we have enabled today and is not an independent certification or audit.

    Shared Responsibility

    ridethewave.co is built on the Lovable platform and uses Lovable Cloud (a managed backend powered by Supabase) for authentication, the database, file storage, and serverless functions. Lovable provides the underlying platform capabilities; RTW Photography is responsible for how those capabilities are configured, what data we collect, and how we handle client content. You as a visitor or client are responsible for keeping your account credentials private and for the accuracy of information you submit through our forms.

    Authentication & Access Control

    Admin areas of the site (anything under /admin) are gated behind authenticated sign-in and a server-side role check. Database access is protected by row-level security policies so that public visitors can only read content we have intentionally published. Sensitive actions such as managing blog posts, portfolio entries, videos, media, pages, and users are restricted to invited admin accounts.

    Hosting & Platform

    The site runs on Lovable's managed hosting infrastructure with HTTPS enforced for all traffic. Backend services (database, auth, storage, edge functions) run on Lovable Cloud. Connections to the database and storage are encrypted in transit.

    Data We Collect

    • Inquiry & booking forms: name, email, phone, event details, and anything you choose to include in a message. These are sent to RTW Photography so we can respond to your inquiry.
    • Newsletter signups: email address, submitted through our embedded Flodesk form.
    • Account data (admins only): email and role information for team members invited to the admin area.
    • Site usage: standard server and analytics logs (e.g. page views, referrers, approximate location, device type).

    Subprocessors & Integrations

    We rely on a small number of third-party services to operate the site. Each handles a specific function and processes data under their own terms and privacy policies:

    • Lovable / Lovable Cloud (Supabase): hosting, database, auth, storage, edge functions.
    • HubSpot: corporate inquiry forms and CRM.
    • Flodesk: newsletter signups and email marketing.
    • Mediazilla / Vimeo: video hosting and playback for the videography portfolio.
    • Google (Search Console / Analytics): search performance and aggregated site analytics.

    Cookies & Analytics

    The site uses a small number of cookies and similar technologies needed for core functionality (such as keeping admins signed in) and for aggregated analytics. We do not sell visitor data.

    Client Galleries & Image Files

    Final client galleries and high-resolution downloads are delivered through dedicated gallery tools rather than from this marketing site. Public portfolio imagery is intentionally shared on the Site under the terms in our Copyright & Image Usage Policy.

    Retention & Deletion

    We keep inquiry messages, booking records, and client correspondence for as long as needed to provide our services and to meet routine business and tax recordkeeping needs. You may request deletion of your personal information at any time by emailing us.

    Privacy Requests

    To access, correct, export, or delete personal information you have shared with RTW Photography, email info@ridethewave.co from the address on file. We aim to respond within thirty (30) days.

    Security & Vulnerability Reporting

    If you believe you have found a security issue affecting ridethewave.co, please report it privately to info@ridethewave.co. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and respond. We appreciate good-faith reports and will acknowledge receipt.

    Compliance

    RTW Photography is a small photography and videography studio. We do not claim SOC 2, ISO 27001, HIPAA, PCI, or similar formal certifications for this website. If your organization requires specific contractual or compliance language before working with us, contact info@ridethewave.co and we will be glad to discuss.

    Updates to This Page

    We update this page as our practices and integrations change. For questions, visit our contact page.

    Event Photography &
    Videography Agency

    Professional event photography, videography, FAA-certified drone coverage, and photo booth experiences for corporate conferences, weddings, and branded events — across five U.S. markets.