Privacy Policy

Miguel de Mora Garcia is the controller of personal data processed through the Service, unless noted otherwise for a specific processing activity.

Contact: [email protected].

Depending on how you use the Service, we may process:

• Account and purchase data: name or couple names, email address, wedding date, payment status, and Stripe identifiers (we do not store full card numbers).
• Authentication data: identifiers and session information from Clerk when you sign in as an album owner.
• Album content: photos you or guests upload, optional uploader names, filenames, sizes, and timestamps.
• Technical data: IP address, device/browser type, approximate location derived from IP, and request logs needed for security and rate limiting.
• Analytics data (only with consent): page views, events, and similar usage metrics via Google Analytics 4.
• Communications: messages you send us and transactional emails we send (album link, QR PDF, receipts).

We process personal data to:

• Provide the Service (create albums, host photos, send QR materials) — contract performance (Art. 6(1)(b) GDPR).
• Process payments and prevent fraud — contract and legitimate interests (Art. 6(1)(b) and (f)).
• Secure the Service, enforce rate limits, and investigate abuse — legitimate interests (Art. 6(1)(f)).
• Comply with legal obligations (tax, accounting, lawful requests) — legal obligation (Art. 6(1)(c)).
• Measure site usage with Google Analytics 4 — consent (Art. 6(1)(a)), which you can withdraw via cookie settings.

Album links and QR codes are designed so anyone who has them can view and (while the album is open) upload photos. Album owners control distribution of those links. Do not share an album link if you need private, invite-only access with per-guest authentication — that is not how the Service works today.

We use trusted processors, including Stripe (payments), Clerk (auth), Cloudflare (hosting/R2 storage/CDN), Resend (email), and Google (Analytics, when consented). These providers may process data in the EU, the United States, or other countries.

Where data is transferred outside the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses or the provider’s certified transfer mechanisms, as applicable.

Paid albums are typically retained for three (3) months from the wedding date when a wedding date was provided at checkout; otherwise three (3) months from the payment date, after which photos and related objects may be permanently deleted from storage. Account, purchase, and billing records may be kept longer as required for accounting, dispute resolution, and legal compliance.

Server logs are retained for a limited period for security and operations. Analytics data follows Google’s retention settings for our property once collection is enabled.

If you are in the EEA, UK, or a similar jurisdiction, you may have the right to access, rectify, erase, restrict, or object to certain processing, and to data portability. Where processing is based on consent, you may withdraw consent at any time without affecting prior lawful processing.

To exercise rights, email [email protected]. You may also lodge a complaint with your local supervisory authority (in Spain, the AEPD).

The Service is not directed at children under 16. Album owners should avoid collecting unnecessary personal data about minors and should obtain appropriate consent from parents/guardians where required when sharing photos of children.

We may update this Privacy Policy. We will revise the “Last updated” date and, where required, provide additional notice.

Privacy requests: [email protected].