Privacy policy

This policy explains what personal data Crowd Pics handles when you create an event or upload photos and videos, why, for how long, and what rights you have.

Hosts and guests: who decides

For your own account, Crowd Pics is the controller of your data. For the photos and videos guests upload to an event, the host who created the event decides what is collected and why, and is the controller; Crowd Pics processes that content on the host's behalf and only on their instructions.

If you are a guest and want a photo removed, you can delete it yourself from the same browser, ask the host, or write to us and we will pass the request on.

What we collect

• Hosts: email address, password (stored only in an irreversible, encrypted form), language preference, and the event details you enter, such as its title, date and settings.
• Guests: the photos and videos they upload and, if they choose, a name. Guests do not need an account.
• Information stored inside the files, such as when and with which device they were taken, which we use to put the album in order. Location data is not copied into our records and is removed from the photos in the album; the original file is kept exactly as uploaded.
• Security data: an irreversible fingerprint of your network address (never the address itself) to limit abuse, and technical logs without addresses or photo content, kept for 14 days.
• A record of the emails we send you (address, subject and whether it went out), kept for 14 days to sort out delivery problems.

Why we use it

• To run your account and your events, and to make the album you asked for (performance of a contract).
• To send the emails the service needs, such as account confirmation, password reset, the notice that your album is ready and the notice before deletion. We send no marketing emails.
• To keep the service secure and prevent abuse (our legitimate interest).

We do not sell your data, show ads or use your photos to train artificial intelligence.

To choose the best shots, the automatic selection looks at sharpness, exposure and where faces appear in a photo. It does not recognise or identify people and keeps no facial profiles.

Who can see the photos

• Photos are kept in private storage and are never published in a public gallery or search engine.
• The host sees every photo uploaded to their event. A guest sees only their own uploads, and the finished album if the host shares it.
• Original files are never altered; enhancements are applied to copies made for the album.

Service providers

We use a few providers to run the service, each bound by a data processing agreement:

• Amazon Web Services: hosting, database and photo storage, in Frankfurt, Germany.
• Cloudflare: secure connection and protection of the website.
• Brevo: sending the service's emails.

Where a provider is based outside the European Union, transfers are covered by the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

Deletion and retention

• Guests can delete their own uploads from the same browser. Hosts can delete single photos, an entire event or their whole account at any time.
• Anything deleted becomes inaccessible immediately and is permanently deleted from our storage within 24 hours. When an account is deleted, all its events are deleted and the account keeps no name or email address.
• A photo deleted after an album was made stays in that album’s PDF and download until the event itself is deleted.
• Events are kept for 180 days after the event date, then deleted in the same way. We email the host a week before, with a link to download the album, and the host can ask us for more time.
• Our database backups, which contain no photos, are overwritten within 7 days.

Cookies

We use only the cookies the service needs to work: one to keep you signed in, one to protect forms, one to remember your language and, for guests, one that lets you see and delete your own uploads (kept for 180 days). We use no analytics or advertising cookies, so there is nothing to consent to.

Your rights

You have the right to access, correct, delete and export your data, and to restrict or object to its use. You can delete your account and events yourself at any time; for anything else, write to us and we will reply within one month.

If you believe we have not handled your data correctly, you can complain to the Hellenic Data Protection Authority (www.dpa.gr) or to the authority in your own country.

Changes to this policy

If we change this policy in a way that matters, we will email hosts before the change takes effect. The date at the top shows the latest version.

Contact

Questions about this policy or your data: [email protected]