Privacy notice
What picapass keeps about hosts and guests, why, who sees it and for how long.
The main points
- Anyone with an event’s link counts as a guest, and can see and add to it as the host’s settings allow.
- When an event ends, access stops. We then delete its photos, videos and words.
- Original photo and video files keep the location your camera saved in them, if it saved one.
- A sign-up from an advert link stays linked for up to 30 days, ending sooner at the first event or an objection. Global Privacy Control prevents the link. Necessary upload monitoring continues.
- We don’t sell your data or use advertising cookies.
Who we are
picapass is run by Blair Rennie, trading as picapass. In this notice “we” means picapass. We are the controller of the data on your account and of what we keep to run picapass and prevent abuse. That means we decide why and how we use it.
For the photos, videos and words guests add to an event, the controller depends on who runs the event:
- Personal events. We are the controller for our album service. A host’s own purely personal or household use can be outside data protection law.
- Schools, charities, clubs and businesses. An organisation that decides why it collects the album is its controller. We store and deliver it on its instructions under our processor terms. An organiser working for a client should name the responsible controller. Ask it about its uses; we pass requests on and help it answer.
Either way, we stay the controller of what we keep for safety and the law, and of the counts behind our guarantees.
Contact us at [email protected].
What we keep about hosts
You must give a name and an email address to have an account. Without them we can’t sign you in or send you the emails your events need.
- Your account. Your name, your email address, and your password in a form that can’t be turned back into it. When you accepted our terms of use, and which version.
- Signing in. Records of your sign-ins, with a rough description of the device, such as “Safari on iPhone”, and when they were last used. That lets you see where you’re signed in. Records of the links we email you to reset your password or confirm or change your address, and whether your address is confirmed.
- Your events. An event’s name, date, welcome message, cover, colour and title style, settings, albums, QR code design and a picture you put in its centre, and who its co-hosts are. An organisation’s completed notice: its name, purpose, contact and full-notice link.
- Co-host invitations. Records of your invitation links and when they expire.
- Claims and replacements. Your accepted offer, event limits, outage and saved-file records, what you report, recovery attempts and decisions. We keep replacement and gift records so an entitlement can be used once. Recovery copies can include your account name, email and settings. Claim evidence does not extend how long we keep the original files.
- How you found us. The advert link you signed up from, until your first event or 30 days. We pool the optional “How did you hear about picapass?” answer and keep a marker that you answered, without the answer. We also keep when you made your first event so we don’t count it twice.
- Messages with us. What you send us by email.
- Emails we send you. Our email provider sends them, for example to confirm your address, and keeps a record of them.
What we keep about guests
Guests don’t need an account or give an age to upload. You can upload and reply without a name.
Read “Before you share” and press Continue before sharing. It names the gallery and screen audience and shows a completed organisation notice where supplied. Continue acknowledges the notice and terms. It is not consent to optional measurement.
- Your photos and videos. We store the original file as uploaded, including the location it holds, if it has one, and make smaller copies for viewing. The original can also hold other details your camera added, such as when it was taken. The next section covers location.
- Your words. The name you choose to share under, if you give one, and your captions, replies and guestbook messages.
- Your likes. We count one per browser, and show how many a photo has, not who gave them.
- A record of your browser in that event. A random cookie links this browser to its contributions so you can change or delete them. We note its first and last use. It isn’t an analytics key.
- A block. If a host stops your browser from adding photos or words, we keep who set the block and when.
- Earlier participation promises. For events with an earlier participation guarantee, we count openers and uploaders during its counting windows. Openers use scrambled network and browser details; uploaders use contribution records. Global Privacy Control excludes an opener. New offers cover technical failures and do not use these counts.
- People in photos. If you’re in a photo or video someone else added, we got it from the guest who added it. What this notice says about photos applies to you too.
Location in photos and videos
Phones often save where a photo or video was taken inside the file. We store the original file as uploaded, including the location it holds, if it has one, and make smaller copies for viewing.
- We make smaller viewing copies with location removed where the format supports that check.
- Hosts and co-hosts who download originals get the location too.
- Guest downloads use copies prepared to remove location. Some formats or fallback copies can retain it.
If you’d rather not share where you were, turn off location for your camera before the event, or remove it from a photo before you add it.
What we keep about everyone
- Your network address. Every website receives it. We use it to help prevent abuse, by limiting how many accounts, events, unfinished uploads and wrong event links come from one network.
- Server logs. They record errors and what the server did. They can name a network that tried too many wrong event links. We set them up to leave out passwords, cookies and private links.
- Error reports. Server errors and stack traces, filtered to remove details such as email addresses, private links and credentials.
- Small items in your browser. The cookie statement lists them.
- Service monitoring. Upload results, request attempts, duration bands and server refusals by reason, broad type and size band. A bounded upload-operation timer joins a transfer’s start and finish, separately from contribution ownership. Automatic browser file-refusal reporting is off. For file help, you can preview the problem, broad type and size band before choosing whether to email it.
- Failed sign-ins. To slow down password guessing, we count failed sign-ins to an email address, per network and in total. We keep the address and network in a scrambled form.
- Reports and appeals. What you tell us, including where the content is and, on the report form, your statement and signature. Also your email address if you give one, and what we decided.
We don’t use advertising cookies, we don’t track you across other sites, and we don’t sell your data.
Because we don’t track you across other sites, a Do Not Track signal from your browser doesn’t change what we do with your data. We honour Global Privacy Control as this notice describes.
Optional measurement
We count visits from each advert link as daily totals, with no cookie and nothing that identifies you.
This covers registered campaign links. A visit means a completed request for a public page: reloads and bots can count. We don’t keep its network address or browser details with the advert total. A necessary preference cookie remembers an objection.
When you sign up from an advert link, we link its campaign code to your account, to see which adverts bring hosts. The link ends at your first event or 30 days after sign-up. The email confirming your address says how to object. Your privacy choices removes the link sooner, and clearing an objection doesn’t restore it. We don’t send conversions or identities to an advertising partner.
We also count completed requests for the wedding hashtag generator and new accounts made from its link as daily totals. Reloads and bots can count as requests. We don’t keep that page label with your account or use it to count your events. Counting does not send the names, date or generated hashtags to us.
The source question is optional. We pool its answer promptly and keep an answered marker with the account.
Use Your privacy choices or Global Privacy Control to stop optional advert, hashtag generator, sign-up, event and “how you heard” counts. Necessary monitoring and participation records continue. The wider right to object is separate.
Why we use it, and our lawful basis
| What for | Lawful basis |
|---|---|
| Your account, your events, and sending you the emails they need | Contract. We need it to give you the service you signed up for. |
| Storing and showing what guests add, as the host’s settings say | Legitimate interests for our personal-event service: guests share an event album with its hosts and audience. An organisational controller decides its own lawful basis. |
| Knowing which contributions are yours, so you can change or delete them | Legitimate interests. It keeps your photos and words under your control. |
| Preventing abuse and protecting picapass from attacks | Legitimate interests. It protects guests, hosts and the service. |
| Looking into reports, complaints and appeals, and telling people what we decided | Legal obligation, under the Online Safety Act 2023. For reports of content that breaks our terms but not the law, legitimate interests. |
| Finding and removing illegal content, reporting child sexual abuse material to the National Crime Agency, and keeping what the law requires | Legal obligation, under the Online Safety Act 2023 and its regulations. |
| Keeping evidence and deciding technical claims and earlier accepted guarantees | Contract and legitimate interests in resolving claims. |
| Necessary upload and fault monitoring | Legitimate interests in keeping transfers working and diagnosing failures. |
| Linking a new host account to the advert it came from | Legitimate interests in seeing which adverts bring hosts. The link lasts 30 days at most, and we honour objections. |
| Advert-link landing totals | Legitimate interests in comparing advert response. We keep daily shared-code totals, without a visitor identifier, and honour objections. |
| The hashtag generator’s request and sign-up totals | Legitimate interests in seeing whether the tool brings hosts. Its fixed page label is pooled without an account or event link, and we honour objections. |
| The optional source answer and service totals | Legitimate interests in understanding how hosts find and use picapass. The answer is pooled rather than kept with an account. |
| Keeping business records | Legal obligation, under tax law. |
Companies that help us, and where your data goes
| Provider type | What it handles | Where |
|---|---|---|
| Hosting and storage | Account and event data, photos, videos and words, to run the service. | Germany and the EU. |
| Backups | Copies of our database and files, to recover from a failure. | The EU. |
| Security and delivery | Network and browser details to prevent abuse, and content to deliver it and check for known illegal images. | Requests pass through a worldwide network. |
| Email and notifications | Account emails, support messages, reports and appeals. | Including the USA. |
| Error monitoring | Filtered error reports, to find and fix faults. | EU storage in Germany. |
Cloudflare checks browser and network details for bots on our account forms. It also uses those details to improve its bot detection as a separate controller. Its privacy notice explains that use.
Cloudflare, our security provider, can report a suspected child sexual abuse match to a child-protection reporting body in the USA. Automatic checks explains what is checked.
Some providers are outside the UK, or can reach data from outside it. Transfers use UK adequacy regulations or UK-approved contractual safeguards where required. Email [email protected] for details or a copy of the safeguards.
How long we keep it
| What | How long |
|---|---|
| Photos, videos, names, captions, replies, likes, guestbook messages, blocks, organisation notices and records of guests’ browsers | Until the event ends, then we delete them. A Full event ends 365 days after its date, or after the day it was made if that’s later. Once its date has started and guests have added something, changing the date doesn’t move this. Events made before 12 October 2026 end when our terms say. Guests and hosts can delete their own sooner, and the host can delete the whole event whenever they like. |
| An ended event’s name, dates, albums, settings and co-hosts, without its photos or words | One year after the event ends, so its link can say it has ended. Sooner if the host deletes the event or their account. |
| Your account | Until you delete it on your account page, or ask us to. That deletes your account and every event you own. Some records below stay longer. Photos you added and replies you wrote as a co-host of someone else’s event stay there. The replies keep the name you wrote them with, no longer linked to your account. |
| The account’s advert link | Until the first event, an objection or 30 days after sign-up, whichever comes first. Your data download includes a link still held. |
| The answered marker and first-event time | Until you delete the account. The selected source answer is not kept with it. |
| Daily measurement totals, including the hashtag generator and historical definitions | One year, then we delete them. |
| Upload timing correlation | Until the upload finishes or 24 hours after reservation, whichever comes first. A restart can lose open timing. |
| Sign-ins, emailed links and co-host invitations | Until used or expired, at most 30 days. |
| Unfinished uploads | We remove them automatically within one day after they stop. |
| Counts of failed sign-ins | Until 24 hours pass without another failed sign-in. |
| Reports, appeals and what we decided | Two years after the report last changed. A report we took a photo or video down for stays, without your words or address, while that photo or video is kept. The emails telling us about a report or appeal are kept like emails you send us (below). |
| Technical claim evidence | Monitoring observations for 60 days. Event promises and saved-file records through 30 days after the promised album period ends; accepted offer records also stay while the event exists. Evidence needed for an open claim or recovery case stays until it is resolved. |
| Account claims, recovery cases and decisions | While open, then two years after the last decision. Longer for an unresolved dispute or legal duty. Deleting your account doesn’t shorten this. |
| Replacement and gift records | Unused entitlements have no use-by date, even if you delete your account. After use, a minimal record stays to prevent reuse, unlinked from your account once you delete it. |
| A deleted account’s email address | While it has an open claim, an unused replacement or a promise still inside its claim deadline. Create and confirm an account with that address to take them over. Email us to give up an unused replacement and have the address deleted. |
| Counts of new accounts, events and uploads per network | Until the end of their day. |
| Opener records for earlier participation promises | Until the morning after the event’s date. Then we keep only the numbers. |
| Uploader records for earlier participation promises | Until the period the guarantee measures ends. Then we keep only the number. |
| Backups and recovery copies | 30 days. What we delete leaves the backups within 30 days. |
| Server logs | At most 30 days. |
| Error reports | At most 90 days. |
| Records of the emails we send you | Currently 45 days, set by our email provider. |
| Emails you send us at [email protected] | Two years after the conversation ends. If an email is part of a complaint, a dispute or a legal claim, six years after it’s settled, the time in which a claim can be brought. |
| Child sexual abuse material we report, and data about who uploaded it | One year, kept apart from everything else, as the law requires. We keep the report’s reference for five years. |
Access stops when an event ends or is deleted; cleanup follows. The backup periods and legal retention above still apply. Copies already downloaded stay with their recipients.
Your right to object
You can object to uses based on legitimate interests. Tell us which use and why at [email protected]. We stop unless we show compelling grounds that override your interests, rights and freedoms, or need it for legal claims. Direct marketing objections take effect without that balancing test.
Your privacy choices stops those optional counts and removes a signed-in account’s advert link. Necessary monitoring and participation records continue; email us to object to a particular use. Objecting doesn’t undo earlier lawful use. Refusal leaves uploading, editing and deleting available.
If the privacy-choice control does not load, you can email a privacy request. Emailing us starts a manual request; it does not change this browser’s saved choice.
Your rights
You can ask us for a copy of your data, or ask us to correct it, delete it, limit how we use it, stop using it, or give it to you in a form you can take elsewhere. Hosts can download their data and delete their account on their account page. For other requests, email [email protected].
We answer within one month. If a request is complex, or you send us many, we may take up to two more months. If we do, we’ll tell you why within one month of your request.
- Guests can delete their own photos, videos, captions, replies and messages from the browser they used. Guests have no account, so we may ask you to write from that browser’s event page or to describe the photo. That way we don’t act on someone else’s request.
- Someone pictured who wants a photo removed can ask the host, or tell us.
- Guests of an organisation’s event can ask the organisation running it, if they know who it is, or contact us. We pass requests to the responsible organisation and help it answer.
If you’re unhappy with how we use your data, you have the right to complain to us first, at [email protected]. We acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome. You can also complain to the Information Commission, the UK’s data protection regulator (known as the ICO), at ico.org.uk/make-a-complaint, or on 0303 123 1113.
Children
Children can be guests and can appear in an album. We apply the same guest protections without asking for ages. Hosts must be 18 or over and adults where they live.
New events start with guest downloads off and guest words reviewed before other guests see them. Gallery viewing starts on; anyone with a forwarded link can view it. Hosts can change these settings. Leave out private details and think about who can see what you share.
Sharing does not give permission from everyone pictured. Hosts must consider children’s interests and their basis for using photos, including later publicity.
If you want a photo of your child removed, or a photo of you as a child, ask the host or email [email protected].
- For an event a host runs for themselves, we remove the photo when the person pictured, or their parent, asks. We may ask for enough to check the request comes from the person pictured or their parent, such as pointing out who is pictured, so we don’t act on someone else’s request.
- For an organisation’s event, we pass your request to its controller without delay and help it answer.
Automatic checks
We can automatically approve a technical claim for a free replacement event when our records confirm the accepted offer, deadline and outage or permanent-loss guarantee conditions. A person reviews other claims; we never refuse a claim automatically. Contact [email protected] to add information, challenge a decision or ask for human review.
We’ve configured automatic image checks to compare the smaller copies of photos that picapass shows, a video’s still picture and an event’s cover picture, once someone has viewed them, with fingerprints of known child sexual abuse material. They don’t check original files, downloads or videos themselves. On a match, our security provider blocks that copy where it can and tells us. We review the file and take down and report illegal material as the law requires. Limits on accounts, events and uploads per network apply automatically and end on their own.
Changes to this notice
We’ll email hosts at least 30 days before a material change to how we use their data, as our terms explain. A change the law or security requires sooner may take effect sooner, and we’ll tell hosts as soon as we can.