Privacy policy
1. Controller and contact
Jean Julien Lehmpfuhl, Wißmarer Weg 12, 35396 Gießen, Deutschland. Privacy enquiries: [email protected].
2. Visiting the website
We process connection data necessary to operate the website, including IP address, time, requested address, browser information and HTTP status. This supports service delivery, troubleshooting and abuse prevention. The legal basis is our legitimate interest in a secure service under Article 6(1)(f) GDPR. The application stores temporary hashed IP-based counters to limit requests. Hosting logs are processed according to the hosting provider settings.
3. Accounts and event albums
For organiser accounts, we process your name, email address, a password hash rather than a plain-text password, and account creation time. We also process event name, date, time zone, currency, description, storage usage, sharing settings and order associations. This is necessary to perform the service contract (Article 6(1)(b) GDPR). Essential session cookies enable sign-in and protection against forged requests. Your chosen language and currency are stored in preference cookies for up to one year. Advertising cookies are used only with your explicit consent. Fonts and public sample images are served from our own web hosting.
Google Ads and consent
With your consent we load Google tag AW-623617110 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for advertising measurement. Google may process IP addresses, browser and device data and advertising identifiers and set cookies. Processing by Google LLC in the USA is possible. Without permission the tag is not loaded (Basic Consent Mode). Personalised advertising is disabled. Legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. We store your choice locally in your browser for six months. You can change or withdraw it at any time using “Privacy settings” in the footer. We do not send album contents, email addresses or password links as measurement data. After payment confirmation, with consent we send the purchase amount, currency and a unique order identifier to measure purchases and prevent duplicate counting. For processing and retention details see Google Privacy Policy.
Service emails
We send transactional emails through our Serverprofis mailbox: account confirmation, password recovery and security notices, payment notifications, and reminders about storage or archive deadlines. We process the recipient address, language, message content and delivery status to provide and secure the service (Article 6(1)(b) and (f) GDPR). Pending email content is stored encrypted and removed after successful sending or expiry. Reset links expire after 30 minutes; verification links after 24 hours. Expired token records are removed after one additional day. Delivery identifiers remain for duplicate prevention. No advertising or tracking pixels are included.
4. Photos and guest access
We process uploaded files, file names, file sizes, formats, upload times and thumbnails to provide the event album. Original files may include metadata such as location or capture time. Remove this metadata before uploading if you do not wish to share it. Uploaders must have the necessary rights and consent of the people concerned. The organiser is responsible for organising and selecting event photos. Processing is based on providing the agreed album functionality; consent from the people concerned must be obtained where required.
Anyone with a valid guest link can view and download the album photos and add photos when uploads are open. Forwarding the link grants the same access. Organisers can renew the link and remove photos. We cannot recall copies already downloaded.
5. Service providers
Our website and account database are hosted by Serverprofis GmbH in Germany. The provider processes server and connection data necessary to operate the service on our behalf. See Serverprofis privacy information.
We use Cloudflare to deliver and protect the website. This may involve IP addresses, requested URLs, browser and connection data, and transmitted content. The legal basis is our legitimate interest in a secure, reliable service (Article 6(1)(f) GDPR). Security functions may use technically necessary cookies. Cloudflare also processes data outside the EEA. See the Cloudflare privacy policy. Data processing agreements are in place for hosting, Cloudflare and Backblaze.
We use Backblaze B2 private object storage with the EU Central regional endpoint. Photos in the bucket are not public; the application checks album access before serving files. Backblaze is a US provider; processing and support may involve international data transfers. Information about contractual safeguards and processing is available in the Backblaze privacy policy.
Payments take place on a hosted Stripe payment page. We transmit email address, order reference, plan, event name, amount and return URLs. Stripe processes payment and billing data, billing addresses and, where provided, tax identification numbers for payment and automatic tax calculation through Stripe Tax, and reports payment status to us. We do not receive full credit card details. The legal bases are contract performance and legal obligations (Article 6(1)(b) and (c) GDPR). See the Stripe privacy policy. Stripe may also process data outside the European Economic Area.
6. Retention and deletion
Your booked album period is 30 calendar days from midnight on the event date in the chosen event time zone. Access ends after this period. Before expiry, you may purchase additional 30-day extensions. When the booked period ends, the gallery and guest access close. Original photos are combined into a ZIP archive. Individual originals and thumbnails are deleted only after the archive has been successfully created and verified. The ZIP is available only in the organiser account until 30 calendar days after the booked period ends; it is then automatically deleted permanently. Large albums take time to process. Status and the download deadline are shown in the account. Processing is retried after technical failures; source files are retained for archive creation until the end of the additional archive period at the latest. Empty albums do not receive a ZIP. The maintenance job runs every five minutes. Organisers can delete individual photos before expiry. Account data is retained for account use; you may request account deletion by email. Order and payment records may be retained longer to meet legal retention obligations. Rights to restrict processing remain unaffected.
7. Your rights
Subject to the legal requirements, you may request access, rectification, erasure, restriction of processing and data portability. Where processing relies on consent, you may withdraw it for the future. You may object to processing based on legitimate interests on grounds relating to your particular situation. You may lodge a complaint with a data protection supervisory authority, in particular the Hessian Commissioner for Data Protection and Freedom of Information.
Last updated: 3 November 2026.