Privacy policy · Pixworthy

Who looks after your data

Pixworthy is responsible for account, billing, support and website data. Contact [email protected] about privacy. For event photos, the host decides who contributes and who sees the album; contact the host too if your request concerns their use of a photo. The legal roles of business planners and their clients must be agreed for their event.

What we receive

You provide account names, email addresses, passwords, event details, photos, videos, optional guest names and support messages or attachments. Hosts can provide invitees’ email addresses. We also receive payment/subscription references from Stripe and technical information such as browser/device identifiers, IP addresses and request logs for security. Passwords are stored as hashes. Pixworthy does not receive full payment-card details.

Why we use it

We use account and event data to provide the service and fulfil our contract with the host. Our legitimate interests include securing the service, preventing abuse and answering enquiries. Accounting records may be kept to meet legal obligations. Hosts must have an appropriate legal basis for collecting and sharing guests’ photos, including permission where needed. We do not sell personal data or use album photos for advertising. For referral links we count how often a link is opened, without storing IP addresses, and link paid orders to the referring account to give the discount and the reward. The referrer sees numbers only, never who booked. We never collect a friend’s email address. If you send a review from your album page, we store your words, your choice about publishing, the album and its name, your account, your language and the date. We only publish it, with your first names, if you ticked the box. You can untick it, change the text or delete it on the album page while the album is online, or ask support at any time. We delete it with the album or your account.

Who can see your photos

Album owners and authorised invitees can access album content. Pixworthy staff cannot see photos, videos, guest names or guestbook messages unless the album owner lets Pixworthy support look, for up to 7 days at a time; the owner can end this at any time and sees every time we looked. The only exception is a single photo or video reported to us as illegal or under an official order: we then see only that item and may hide it, and the owner is told. Guest galleries show permitted uploads according to the host’s shared/private/off setting; the host can display photos on a live wall. A guest link can be shared, so treat it as access information. Optional passwords restrict access; a QR link containing the password also grants access. Share only with people you trust.

Storage and service providers

Pixworthy runs on servers we rent from Oracle Cloud in Frankfurt, Germany. Photos, videos and database backups are stored in a private, encrypted OVHcloud bucket, also in Frankfurt; OVHcloud is a French company. A second encrypted backup copy is kept on our own backup server in the Netherlands. Backblaze B2 keeps the locked copy of the security log (section 7) in its EU region. Resend sends our emails and receives emails sent to support, including attachments, from its EU region in Ireland. Mail to our @pixworthy.com addresses is handled by Fastmail and stored in its EU data centre. Stripe processes payments, subscriptions and invoices and is responsible for its own payment, fraud and legal checks. Cloudflare runs our DNS, and its Turnstile bot check processes your IP address and browser signals on sign-in, password reset, checkout, album unlock and the pilot request form. Resend, Stripe, Cloudflare and Backblaze are US companies or part of US groups, and Fastmail is an Australian company, so some data may be accessed from outside the EEA. For those transfers we rely on the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses.

How long data stays

New customer albums stay online until the end of the UTC day 30 days (Free), 12 months (Wedding, Planner) or 24 months (Plus) after the event date, unless an administrator sets another date. After the online period the album closes. For 30 more days you can still download everything or extend. Then the photos and videos are deleted for good: originals, thumbnails and upload metadata are removed from active storage and cloud copies are queued for deletion. Albums without an end date, which only some older albums have, are not deleted automatically; ask us and we delete them. Accounts stay until you ask us to delete them. Orders and invoices are kept for 7 years because Dutch tax law requires it. Support conversations are deleted 2 years after the last message. Copies of the emails we send are kept for 90 days; a record of which kind of email went to which address is kept for 2 years. Deleted data can stay in our encrypted backups for up to about 3 months before it is overwritten. When deletion is scheduled, access to the affected account or album ends at once. We permanently delete the data 30 days later, or sooner on request.

Security and activity logs

We keep a record of sign-ins, account and album changes, billing events and some guest actions, such as a wrong album password or a deleted upload. The record stores who did it, when, the album, and the IP address and browser, so we can investigate misuse and see what changed. We keep these records for 2 years. IP addresses and browser details are removed after 90 days. The record does not store passwords, codes or tokens. To protect this record against tampering, a copy goes out every minute to a locked Backblaze storage bucket (section 5) that nobody, including us, can change or delete. The copy shows who did what and when, with account and album numbers, staff email addresses and technical codes, but no IP addresses, browser details, or names, email addresses or messages of customers and guests. It stays locked for 1 year and is then deleted. While it is locked, it cannot be deleted earlier, also not on request.

Cookies and analytics

Essential cookies keep customers and admins signed in, save your chosen language, secure checkout and remember a guest album unlock for up to 30 days. The sign-in cookie points to a session record on our server with the device type (browser and system), when you signed in and when you were last active, but no IP address. You can see and sign out your devices in your account; these records are deleted 7 days after a session ends. A browser identifier supports guest uploads and abuse limits. These are needed for the service, so we do not ask for consent. Our analytics (OpenPanel) runs on our own server in Frankfurt and only on the public website and the checkout pages. It uses no cookies and counts page visits, completed sign-ups and purchases. Your IP address is used to estimate a rough location and is not stored. We do not send it names, email addresses, order IDs or photos. Your account, albums, guest pages, help, legal and admin pages are not tracked. Fonts and scripts are served from our own servers. We use no advertising trackers.

Your choices and rights

Ask [email protected] for access, correction, deletion, restriction or a portable copy where applicable. We reply within one month. When we delete your account, we also delete your albums and support conversations and keep only what the law requires, such as invoices. You can object to processing based on legitimate interests and withdraw any consent without affecting earlier lawful processing. We may verify your identity first. You can complain to your local data-protection authority or the Dutch Autoriteit Persoonsgegevens. We do not make solely automated decisions with legal or similarly significant effects. Account holders must be 18 or older; hosts are responsible for appropriate permission for images of children. When deletion is scheduled, access to the affected account or album ends at once. We permanently delete the data 30 days later, or sooner on request.

Photo reminders for guests

After uploading, guests can ask for one reminder to share more photos. “Add to my calendar” creates a calendar file on your own device; we only count that it was used. “Email me once” stores your email address, the album, your language and the send time, nothing else (no IP address or device). We use it only to send that one email with the album link, never for marketing, and it is not shown to hosts, planners or in our admin screens. We delete the address straight after sending, after 48 hours if it could not be sent, and when the album is deleted. To stop the form being used to send email to strangers, we also keep a coded fingerprint of the address (not the address itself) for 24 hours, so the same address gets at most one reminder a day. Resend sends the email for us (section 5). We do this because you asked for it. Your browser also keeps, on your device only, when the reminder is due and which files you already shared, so the album page can skip duplicates. We also count, per album and day, how often the reminder is offered, chosen and opened and how many guests come back to upload. These are numbers only, with nothing that identifies you, and the album’s hosts see the totals.

Pilot requests from planners

Wedding planners can ask to try Pixworthy free for one wedding with the form on our planners page. We store the name, company and email address you enter, the wedding date and message if you add them, the page language and when you sent it. We use them only to answer your request and arrange the pilot, a step you ask for before a possible contract. The request is emailed to our own inbox; a phone notification only tells us that a request arrived, without your details. We never use these details for marketing lists and do not pass them on. We delete them 12 months after we have handled your request, or 12 months after it arrived if it is still open, together with our notification email. Ask [email protected] to delete them sooner. When we set up your pilot, we create a Pixworthy account with your name, company and email address and keep your request (company, wedding date, message) as an internal note on that account, visible only to our team. From then on the account section of this policy applies, and you can delete the account at any time.

Guest contact opt-ins

On albums with planner branding, the planner can enable an optional, unticked checkbox and email field to receive emails about that named planner's services. We store your email, album, planner, consent wording and version, language and consent time. The named planner can view and export active opt-ins while they own or co-host the album. Other planners and customers cannot access them. You can withdraw through the unsubscribe link in every planner email. Withdrawal removes you from active lists and exports. Opt-ins, including withdrawn records, are deleted when the album is deleted or purged. Exported copies are managed by the planner, who must honour withdrawals. Pixworthy does not send these marketing emails.

Pixworthy

[email protected]

Privacy policy.