Privacy Policy

1. Introduction

Wedding Photo Share ("we," "our," or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our web application and services.

We comply with the General Data Protection Regulation (GDPR) (EU) 2016/679 and other applicable European Union data protection laws. By using our service, you agree to the collection and use of information in accordance with this policy.

2. Data Controller

For the purposes of GDPR, Wedding Photo Share acts as both a Data Controller (for our direct relationship with couples who purchase our service) and a Data Processor (when processing photos and data on behalf of wedding couples).

The wedding couple who purchases and manages a wedding event through our platform acts as the Data Controller for the personal data of their wedding guests.

3. Data We Collect

3.1 Information from Couples (Account Holders)

• Names (bride and groom)
• Email addresses
• Wedding date and event details
• Payment information (processed securely by Stripe)
• Admin PIN and account credentials

3.2 Information from Wedding Guests

• Display name (voluntarily provided)
• Photos uploaded to the wedding gallery
• Photo captions and comments
• Device information (browser type, for technical functionality)

3.3 Automatically Collected Information

• IP addresses (for security and abuse prevention)
• Browser type and version
• Device type (mobile, desktop)
• Usage data (pages visited, features used)
• Photo metadata (EXIF data may be stripped for privacy)

4. Legal Basis for Processing (GDPR Article 6)

We process personal data under the following legal bases:

5. How We Use Your Data

• To provide and maintain our photo sharing service
• To process payments and send transactional emails
• To send welcome emails with login credentials
• To notify couples when photo downloads are ready
• To enable photo moderation and gallery management
• To improve our service and user experience
• To detect and prevent fraud or abuse
• To comply with legal obligations

6. Data Storage and Security

6.1 Where We Store Data

Your data is stored on secure servers provided by Supabase (database) and Cloudflare (photo storage). These providers maintain data centers in the European Union and comply with GDPR requirements.

6.2 Security Measures

• All data transmitted via HTTPS/TLS encryption
• Database access restricted by row-level security policies
• Admin access protected by PIN authentication
• Payment data handled by PCI-DSS compliant Stripe
• Regular security audits and updates

6.3 Data Retention

Wedding photos and associated data are retained for the duration of the service agreement. Couples can request deletion of all their wedding data at any time. After the service period ends, data may be retained for up to 12 months before automatic deletion, unless otherwise requested.

7. Data Sharing and Third Parties

We do not sell your personal data. We share data only with:

All third-party processors are bound by data processing agreements and comply with GDPR requirements.

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

To exercise any of these rights, please contact us at the email address provided below. We will respond within 30 days as required by GDPR.

9. Photos and Image Rights

Wedding guests who upload photos represent that they have the right to share those images and that any individuals depicted have given their consent to be photographed and have their image shared within the wedding gallery.

The wedding couple (as Data Controllers) are responsible for ensuring appropriate consent has been obtained from guests regarding the sharing of photos within their wedding event.

If you appear in a photo and wish to have it removed, please contact the wedding couple directly or reach out to us for assistance.

10. Children's Privacy

Our service is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us to request deletion.

11. Cookies and Local Storage

We use essential cookies and local storage to provide core functionality:

• Session data: To maintain your login state
• Guest name: To remember your display name for photo uploads
• Offline queue: To store photos locally when offline (IndexedDB)
• Language preference: To remember your selected language

We do not use tracking cookies or third-party advertising cookies.

12. International Data Transfers

Where data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Transfers to countries with an adequacy decision
• Binding Corporate Rules where applicable

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes by posting a notice on our website. The "Last updated" date at the top of this policy indicates when it was last revised.

14. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or have concerns about our data practices, please contact us:

You also have the right to lodge a complaint with your local data protection supervisory authority.