Where is the data stored?
- The app runs on servers in Frankfurt, Germany (Oracle Cloud).
- Photos, videos and database backups are stored in a private, encrypted bucket at OVHcloud, a French company, also in Frankfurt.
- A second encrypted backup is kept on our own server in the Netherlands.
What do we collect from guests?
As little as possible. Guests upload photos and videos without creating an account, and giving their name is optional.
Who can see the photos?
You as the host always see everything. What guests see in the gallery is set per album:
- Shared: guests see all the album's photos.
- Private: guests see only their own photos.
- Off: guests can only upload; there is no gallery.
- Password (optional): locks both uploading and viewing. You can put it in the QR code, so guests do not have to type it.
Can other guests see where a photo was taken?
No. When a guest opens or saves another guest's photo, they get a cleaned copy: no location, no phone model, no capture time and no original file name. The guest who uploaded it and the hosts keep the untouched originals.
The same goes for the live wall at the venue: the photos and videos shown there carry no metadata.
How long is data kept, and how is it deleted?
The online period counts from the event date: 12 months for Wedding and Planner, 24 months for Plus, and it can be extended. After it ends there are 30 more days to download or extend. Then the photos and videos are deleted for good.
Deleted data can stay in encrypted backups for up to about 3 months before it is overwritten.
Anyone who wants to see, correct or delete their data can email [email protected]. All the details are in our privacy policy.
Ads and analytics
We show no ads and we do not sell personal data. Our analytics run on our own server in Frankfurt and only measure the public website and the checkout. Never guest album pages and never the live wall.
Your own responsibility as a planner
We handle our side as described above. As a planner who offers photo collection, you have your own responsibilities too:
- Roles and legal basis. Agree with the couple who has which role in processing guest data, you or them. Put it in your contract with the couple, and have the legal basis checked by your own adviser if in doubt.
- Informing guests. Guests should know, broadly, where their photos go and how long they are kept. Put a short line on the QR card or welcome sign, for example where the album is and that it is deleted after the retention period.
- Your own marketing. Albums you run as a planner can show an optional opt-in where guests choose whether they want to hear from you. It is off by default and the guest's box starts unticked. No explicit choice, no marketing.
Checklist for planners
- Legal basis set out in your agreement with the couple (if in doubt, check with your adviser).
- A short privacy line on the QR card or welcome sign: where the photos go and how long they are kept.
- Gallery visibility chosen on purpose for each album: shared, private or off, plus a password where needed.
- The opt-in for your own marketing left unticked.
- The couple reminded to download everything before the album closes.
- Questions about access or deletion referred to [email protected].
Questions
Does Pixworthy guarantee GDPR compliance?
No. What we do is tell you exactly what happens to data, as on this page. Whether that is enough for your situation is for you and your adviser to decide.
Do you offer a data processing agreement?
Not yet. If you need one, let us know at [email protected].
What if a guest wants their photos deleted?
That is possible. Requests to see, correct or delete data go to [email protected]. Photos and videos are deleted for good anyway, 30 days after the online period ends. Accounts, invoices (kept for 7 years by law) and support conversations have their own retention periods.
Can guests upload anonymously?
They do not need an account and giving their name is optional. Uploading is not fully anonymous, though: each upload stores a random browser ID for upload limits and abuse checks. Some guest actions, such as a wrong password or a deleted upload, are recorded in the security log with the IP address. IP addresses are removed after 90 days.