Privacy Policy

1.Who is responsible

[LEGAL COMPANY NAME] ([TRADING NAME]), [REGISTERED ADDRESS], is the controller of the account and order data described here. For the photos and videos of an event we act on behalf of the host, who decides what the event is for and who is invited. [CONTROLLER / PROCESSOR ROLES TO BE CONFIRMED ON LEGAL REVIEW]

Privacy questions and requests: [PRIVACY EMAIL].

2.Hosts: what we process

The email address you give at checkout, and a name if you provide one.

Your event's name, date and, if you add them, venue, welcome message and cover photo.

Your order: the package, the amount, the date, and the payment provider's reference for the payment. We never receive or store your card details — the payment provider handles those.

For printed packages only: the delivery name, address, country and phone number, to produce and ship your cards.

Sign-in data: a password (stored only as a one-way hash) if you set one, sign-in sessions, and one-time sign-in or reset links.

The messages you send us when you ask for support.

3.Guests: what we process

Guests never create an account.

We process the photos and videos a guest chooses to upload, the time of each upload, and a name and a short message only if the guest decides to add them.

A random identifier is kept in a cookie on the guest's device so the host can see how many different people contributed. It is not linked to a name or used to follow the guest anywhere else.

As with any website, our servers briefly handle technical information such as the IP address, to deliver the page and to protect the service from abuse.

4.Why, and on what basis

To provide the service you bought and to process your order — performance of our contract with you.

To keep the service secure, prevent abuse and handle reports — our legitimate interest.

To keep the accounting records the law requires — legal obligation.

[LEGAL BASES TO BE CONFIRMED ON LEGAL REVIEW]

5.Who can see an event

Only people who have the event's QR code or link, and only what the host allows: the host can make the event upload-only, approve uploads before they appear, and hide or delete anything.

Event pages are not listed anywhere and search engines are told not to index them.

6.Who we share data with

Service providers that process data for us, under contract: hosting and storage, the payment provider, the email delivery service and, for printed packages, the printer and the courier. [LIST OF PROCESSORS AND LOCATIONS TO BE COMPLETED]

We do not sell personal data and we do not share it for advertising.

7.No advertising use of your photos

Uploading to an event gives us no right to use that content in advertising, on our website or on social media. We would only ever do that with the separate, explicit permission of the people entitled to give it.

8.How long we keep things

Photos, videos and download archives: until 30 days after the event date, plus a 7-day download period for the host, and then they are permanently deleted.

Account and order records are kept for as long as accounting and tax law requires. [RETENTION PERIOD FOR RECORDS TO BE CONFIRMED]

More detail is in the Data Retention explanation.

9.Your rights

You can ask to access, correct or delete your personal data, to restrict or object to its processing, and to receive it in a portable form. You can also complain to your data protection authority.

Send requests to [PRIVACY EMAIL] or use the report form. We may need to confirm who you are — or, for event content, that you are entitled to ask — before we act. If your request concerns a photo at someone's event, the host can usually remove it fastest.

10.Analytics

We count a few anonymous steps of the purchase journey (for example, that a checkout was opened) to understand how the website works. These counts contain no identifier, no IP address and no cookie. We use no third-party analytics or advertising trackers.