Privacy

Data protection

This text faithfully describes how the service currently works technically. Some fields still need completing ([Name / business name], DPO contact if applicable) before going live.

What data is collected

• For the organizer: email address (magic-link login).
• For guests: the photo sent, the first name provided, and the IP address at the time of sending (as proof of consent).

Who has access to this data

Besides the event organizer, your data only passes through the technical providers required to run the service: Supabase (authentication, database, file storage), Vercel (site hosting, and cookie-free anonymous audience measurement via Vercel Analytics and Speed Insights), Stripe (payment and fraud prevention) and Sentry (technical error monitoring, to diagnose bugs — IP address and technical data related to the error only). No data is sold or shared for advertising purposes.

Payment

Payments are processed by Stripe. During payment, Stripe may collect transaction-related data as well as technical information (IP address, browser or device information) and trackers needed to secure the payment, authenticate you, and prevent fraud. Card details are sent directly to Stripe and are never stored by [Name / business name]. For more information, see Stripe's privacy policy.

Why

This data is used solely to run the game for the relevant event: collection, cropping, printing. It is never sold, never used for advertising purposes, and never shared with a third party outside the technical providers listed above.

How long

Photos and the first names attached to them are automatically deleted 30 days after the event date. The organizer account's email is kept for as long as the account exists. Orders and invoices are kept in line with legal accounting requirements [duration to confirm].

Guest consent

Every photo sent requires an explicit, timestamped consent checkbox. A guest can request to withdraw their consent and have their photo deleted by contacting the organizer or [contact address to be provided], as long as printing hasn't happened yet; after that, copies already printed can't be recalled.

Your rights

Under GDPR, you have the right to access, rectify, erase, restrict, port, object to, and withdraw your consent regarding your data. You can also lodge a complaint with the CNIL (cnil.fr). To exercise your rights, contact [contact address to be provided]; we respond within one month.