Privacy Policy

We answer data requests without undue delay and within one month; if Article 12(3) GDPR allows an extension, we inform you within that month.

The controller of personal data within the meaning of Article 4(7) GDPR is Bartosz Różycki, a registered sole proprietorship (JDG) at ul. Bednarska 26 lok. 56, 93-030 Łódź, Poland, NIP 7292772054, REGON 545403173 (the Controller or AlbumQR).

For any matter concerning the processing of personal data, contact the Controller at team@albumqr.io or in writing at the address above.

The Controller is not required to appoint a data protection officer under Article 37 GDPR and has not appointed one. The Controller acts as the contact point for data protection matters.

The data we process depends on the role in which you use the Service. The categories below apply to each role.

Organizers — Email address and basic Google profile data shared during sign-in (OAuth), event name and configuration, transaction data needed to settle payment (payments are handled by Stripe — we never store card numbers), and technical data including IP address and server logs.

Guests — Uploaded photos and their thumbnails (sent directly to Amazon S3 using presigned URLs), an optional name and message, file metadata (capture date, size, EXIF) and technical data. Photo likes are stored only locally in the Guest's browser and never reach our servers.

Site visitors — Traffic and interaction data collected by Google Analytics 4 and Microsoft Clarity — only after consent is given in the cookie banner (Google Consent Mode v2). Without consent neither tool is loaded. Data is transferred to Google LLC and Microsoft Corporation respectively, both in the United States.

Photo analysis (AI) — Every photo uploaded to an Album, except in year-long albums, is analysed automatically by Amazon Rekognition: image labels and properties are detected, faces are detected together with attributes such as smile, open eyes and emotion, and the content is screened for prohibited material. The analysis serves photo quality scoring, automatic selection of the best shots and label-based filtering. We do not build a database of facial templates and do not match faces across photos, so we do not process biometric data within the meaning of Article 9 GDPR. Photos in year-long albums are not analysed automatically in any way: they are not sent to Amazon Rekognition and no software checks them, including for prohibited content.

We process personal data only for the purposes set out below and only to the extent necessary to achieve them.

Creating an account and providing the Service — Account and configuration data, excluding photos processed on the owner’s instructions (Article 6(1)(b) GDPR — performance of a contract)

Responding to a partnership enquiry — Email address, type of business indicated in the form (Article 6(1)(b) GDPR — steps taken at the data subject's request prior to entering into a contract)

Processing payments and settlements — Transaction and billing data (Article 6(1)(b) and (c) GDPR — contract and legal obligation)

Issuing and retaining accounting records — Billing data (Article 6(1)(c) GDPR — tax and accounting law)

Automatic photo analysis and detection of prohibited content (not for year-long albums) — Photos, image labels and attributes (Article 6(1)(b) and (f) GDPR — contract and legitimate interest)

Ensuring security and preventing abuse — IP address, server logs, request data (Article 6(1)(f) GDPR — legitimate interest)

Traffic and usage analytics — Cookie identifiers, events, device data (Article 6(1)(a) GDPR — consent)

Optional Google Drive integration — Access token for the selected folder (Article 6(1)(a) GDPR — consent)

Handling complaints and establishing or defending claims — Contact details, correspondence, transaction data (Article 6(1)(f) GDPR — legitimate interest)

Providing data is voluntary, but the data needed to conclude and perform the Contract is a condition of using the Service — without an email address and the data required to settle payment, an account cannot be created and an Album cannot be shared. A Guest providing a name and a message is entirely voluntary and is not a condition of uploading a photograph. Data processed on the basis of consent is provided voluntarily, and withholding or withdrawing consent carries no negative consequences other than the loss of access to the feature it covers. We process photos of people other than the buyer as a processor on the album owner's instructions. Article 6(1)(b) GDPR for the buyer's contract does not itself provide a legal basis for processing other people's images. The separate section below explains year-long albums.

The Organizer's responsibility

AlbumQR is a technical tool and does not verify whether the Organizer has obtained consent to capture and publish the image of event participants. The duty to inform participants that photos are being collected and to obtain every required consent rests solely with the Organizer.

For photos and Guest data uploaded to an Album the Organizer is the controller and AlbumQR acts as a processor on the Organizer's documented instructions. The data processing agreement forming part of the Terms of Service governs that relationship. For Organizer account data and analytics data, AlbumQR is the controller.

We share data only with the providers necessary to deliver the Service, under processing agreements meeting the requirements of Article 28 GDPR. The payment operator and payment method providers do not act on our instructions: they process data as separate controllers, under their own privacy policies.

Vercel Inc. — Application and website hosting (USA — standard contractual clauses (SCC))

Amazon Web Services EMEA SARL — Photo storage (S3), delivery (CloudFront) and automatic image analysis (Rekognition) (Rekognition is not used for year-long albums) (EEA — eu-central-1 region (Frankfurt))

Neon Inc. — PostgreSQL database (EEA — AWS eu-central-1 infrastructure)

Stripe Payments Europe, Ltd. — Processing of all payments: card, BLIK, Przelewy24, Bancontact, EPS, Klarna (EEA (Ireland) — separate controller. Stripe may transfer data to Stripe, Inc. in the USA under the Data Privacy Framework and standard contractual clauses (SCC))

Provider of the payment method chosen by the buyer — Processing the payment with the chosen method, e.g. PayPro S.A. (Przelewy24), Polski Standard Płatności sp. z o.o. (BLIK), Klarna Bank AB (publ) (Klarna) or the payer's bank or card issuer (EEA — separate controller)

Google LLC — OAuth sign-in, Google Analytics 4, optional Google Drive (USA — Data Privacy Framework and standard contractual clauses (SCC))

Microsoft Corporation — Microsoft Clarity — behavioural analytics, consent only (USA — Data Privacy Framework and standard contractual clauses (SCC))

Data is transferred to a third country only where the provider ensures an adequate level of protection — under a European Commission adequacy decision or the standard contractual clauses referred to in Article 46(2)(c) GDPR. A copy of the safeguards applied is available on request at team@albumqr.io.

We apply technical and organisational measures appropriate to the risk, in line with Article 32 GDPR. These include:

1. 1.HTTPS/TLS encryption on all connections;
2. 2.photo uploads sent directly to Amazon S3 using presigned URLs valid for 15 minutes;
3. 3.encryption at rest on Amazon S3 (SSE-S3);
4. 4.private gallery access restricted by signed CloudFront cookies valid for 24 hours;
5. 5.rate limiting on file upload endpoints;
6. 6.least-privilege access to production infrastructure and accountability for administrative operations.

We keep data no longer than necessary for the purposes for which it was collected, or for the period required by law.

Album photos and metadata — Until deleted by the Organizer or until the Album's active period set out in the Terms of Service expires

Organizer account data — For as long as the account exists; deleted promptly once it is closed

Accounting records and billing data — 5 years from the end of the tax year in which the tax obligation arose

Data needed to defend against claims — Until the limitation period under the Polish Civil Code expires

Technical and security logs — Up to 90 days

Analytics data (with consent) — Up to 14 months in Google Analytics 4; per Microsoft's policy in Clarity

In connection with the processing of your data you have:

1. 1.the right of access to your data and to obtain a copy of it (Article 15 GDPR);
2. 2.the right to rectification of inaccurate or incomplete data (Article 16 GDPR);
3. 3.the right to erasure (Article 17 GDPR);
4. 4.the right to restriction of processing (Article 18 GDPR);
5. 5.the right to data portability for data processed under a contract or consent (Article 20 GDPR);
6. 6.the right to object to processing based on legitimate interest (Article 21 GDPR);
7. 7.the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Article 7(3) GDPR).

To exercise any of these rights, email team@albumqr.io. We respond without undue delay and no later than one month from receiving the request. Organizers can also delete their account and all associated data themselves from the Ustawienia / Settings panel.

If you consider that the processing of your data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, https://uodo.gov.pl.

We give the rights below to all residents of the United States, including California, whether or not a state privacy law requires it. They apply alongside your rights under the GDPR.

Right to know — You have the right to know which categories of personal information we collect. They are:

1. 1.identifiers — email address and profile data shared through Google sign-in;
2. 2.event configuration data — Album name, dates and settings;
3. 3.metadata of uploaded photos — file size, dimensions, EXIF date, orientation;
4. 4.usage data — IP address, browser and device information;
5. 5.transaction data — payments are handled by Stripe; we never store card numbers.

Right to delete — You may request deletion of your personal information. Organizers can delete their account and all associated data themselves from the Ustawienia / Settings panel, or by contacting us at team@albumqr.io.

Right to opt out of sale or sharing — AlbumQR does not sell personal information and does not share it in exchange for money or other valuable consideration. We also do not share data for cross-context behavioral advertising.

Right to non-discrimination — Exercising your CCPA rights will never result in denial of service, a higher price or a lower standard of service.

How to submit a request — Send requests to team@albumqr.io. We respond within 45 days of receiving a verifiable consumer request, with a possible extension of a further 45 days, of which we will notify you separately.

The Service relies on necessary cookies: NextAuth session cookies that handle sign-in, and signed CloudFront cookies that grant access to a private gallery for 24 hours. Browser local storage holds photo likes and the selected language. None of this data reaches the Controller's servers.

Once consent is given in the cookie banner we set Google Analytics 4 cookies (_ga, _ga_*, stored for up to 2 years) and load the Microsoft Clarity script, which writes its own analytics cookies. Without consent neither tool runs. You can withdraw consent at any time by clearing site data in your browser settings. Our site does not respond to browser "Do Not Track" signals; instead, analytics run only if you accept them in the cookie banner. If you accept, Google and Microsoft may collect information about your activity on our site and on other websites over time.

Google Consent Mode v2 may apply behavioural modelling, including conversion modelling, even where analytics consent has not been given in full. This means Google estimates traffic patterns from aggregated data stripped of identifiers. The mechanism is documented here: https://support.google.com/analytics/answer/9976101.

Photos uploaded to an Album, except year-long albums, are screened automatically for prohibited content. A photo flagged by the system as prohibited is hidden and marked as rejected without prior review by a human. In the Controller's assessment this mechanism produces no legal effects concerning data subjects and does not similarly significantly affect them within the meaning of Article 22 GDPR. Regardless of that assessment, we guarantee the right to obtain human intervention, to express your point of view and to contest such a decision — simply write to team@albumqr.io. In year-long albums we use no automated decision-making. Apart from the mechanism described here we apply no automated decision-making and no profiling for marketing purposes.

Buyers must be adults. For year-long albums only adults upload photos; children do not use the service and do not receive the link or QR code.

Adults may upload photos showing children under the rules in the “Year-long albums” section. The age of a person in a photo is not the age of the service user. Article 8 GDPR concerns certain services offered directly to a child on the basis of consent, not every photo of a child.

The owner is responsible for sharing the link with adults and for lawful photo uploads. In other albums, guest features are intended for people aged 16 or over.

In the event of a personal data breach the Controller notifies the President of the Personal Data Protection Office (ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, https://uodo.gov.pl) without undue delay and no later than 72 hours after becoming aware of it, in accordance with Article 33 GDPR.

Where a breach is likely to result in a high risk to the rights and freedoms of natural persons, the Controller notifies those persons directly and without undue delay, in accordance with Article 34 GDPR.

Please report suspected security incidents to team@albumqr.io. Every report is treated as a priority.

The current version of this Privacy Policy is always available at albumqr.io/en/privacy together with its effective date and version number. Organizers with an active account are notified of material changes by email at least 14 days in advance. Changes that are purely technical or editorial take effect on publication.

A year-long album is a private photo album for one closed group of people who know each other, such as a class, preschool group, team, camp group or family. The buyer runs it as the album owner. Photos may show children. Before this version took effect, these were called “class albums”.

Who is responsible for the photos.

The album owner is the controller of photos and data about people shown. The owner acts privately, not for a school, school district, club, employer or other organization. AlbumQR stores photos on the owner’s behalf as a processor. The owner is the person who gave you the link; if you do not know who that is, email team@albumqr.io and we will forward your message. The owner provides their identity, contact and processing information under Articles 13 or 14 GDPR where applicable.

Legal basis and permission.

Where GDPR applies to the owner, the legal basis is the legitimate interest of the owner, group members and their families in keeping a shared memory of their time together (Article 6(1)(f) GDPR). Anyone may object to a photo of them; a parent or legal guardian does so for a child. The photo is then deleted (§ A8). Before collecting photos, the owner assesses whether this interest outweighs the rights of the people shown, giving particular care to children. If it does not, the photo must not be added on that basis. This GDPR basis does not replace permission to share an image where image-rights law requires it. The owner, editors and group members with the link can see the photos. Photos must not be posted online. An uploader’s statement covers their own image and a child for whom they are a parent or legal guardian; it does not replace other people’s permission.

Data AlbumQR is responsible for.

We are the controller of: the buyer's data (email, name, Stripe transaction data) to make and perform the contract (Article 6(1)(b) GDPR) and to keep accounting records (Article 6(1)(c) GDPR); the account data of the owner and editors; security logs; and data in reports of illegal content and in deletion requests.

What we do with photos.

We store them with Amazon Web Services in the EU (eu-central-1 region, Frankfurt, Germany). To deliver photos quickly, Amazon's network may keep temporary copies close to the viewer, including in the United States. Anyone with the album link or QR code can upload photos and see the album gallery. The album owner shares the link. The owner can hide or delete any photo. No software or artificial intelligence analyzes the photos, including for prohibited content. We do not detect or recognize faces, do not scan face geometry or create biometric data, do not analyze people's features and do not label photos. We do not use photos for marketing or to train AI models, and we do not let our providers do so. Year-long albums are not public and do not appear in search engines.

How long.

An album accepts photos for 365 days from payment. The owner can only download photos for the next 30 days. We then delete the photos and album data, and backups within 30 further days. A separately paid extension of a selected album moves its dates by 365 days. A photo deleted earlier by the owner or on request disappears from backups within 30 days. After withdrawal, § A12 applies. Legally required evidence is blocked and kept only for the required purpose and time.

Your rights.

Anyone shown, or a child’s parent or legal guardian, may object to a photo and request deletion without giving a reason. Email team@albumqr.io with the album name or link and a photo description, or ask the owner. We delete it within 3 business days and tell the owner; a naked or intimate image is deleted within 48 hours. The uploader can also request deletion. Ask the owner for access to photos of yourself or your child. You may complain to the President of the Polish Personal Data Protection Office (UODO).

Children.

Children under 18 do not use the service and do not receive a link or QR code. Adults upload photos. If we learn that a child uploaded photos, we delete those uploads. Parents or legal guardians exercise children’s rights.

Families in the United States.

We do not sell or share personal information for advertising, show ads, or build profiles of group members or families. If the group is a school class, the album is not a school record and we do not maintain it for a school. A school or school district that believes the album contains its student records can email team@albumqr.io. We delete the identified data and tell the owner.

Bartosz Różycki, ul. Bednarska 26 lok. 56, 93-030 Łódź, Poland, NIP 7292772054, REGON 545403173. Correspondence on data protection matters: team@albumqr.io.