Back

Privacy Policy

Last updated: October 28, 2026

1. Privacy at a glance

This policy explains what happens to your personal data when you use OurSnaps. Personal data is any data that can be used to identify you personally. Because OurSnaps is operated from the European Union, we process your data in line with the EU General Data Protection Regulation (GDPR), wherever you live.

Who is responsible for data processing?

The website operator. You can find the contact details in the section “Data controller” below.

How do we collect your data?

Some data is collected when you give it to us, for example when you create an account, create an event or upload photos. Other data is collected automatically by our IT systems when you visit the website – mainly technical data such as your browser, operating system or the time of your visit.

What do we use your data for?

To provide the website and the service without errors, to process orders and payments, and to send you emails about your events (e.g. your QR code after purchase or reminders before your gallery expires).

2. Data controller

Dawid Nachlik
OurSnaps
Poland
Email: contact@oursnaps.app

The data controller is the person who decides on the purposes and means of processing personal data (e.g. names, email addresses).

3. Hosting and where your data is stored

The website is hosted by external providers. Personal data collected on this website is stored on their servers. This may include IP addresses, contact requests, metadata and communication data, contract data, names, website access and other data generated through the website.

Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA (website hosting)
Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992 — the database and photo storage are located in the European Union (Frankfurt region / eu-central-1)

Hosting is used to fulfil our contract with you (Art. 6(1)(b) GDPR) and in our legitimate interest in providing the service securely, quickly and efficiently (Art. 6(1)(f) GDPR). We have concluded data processing agreements with these providers, so they process data only on our instructions and in compliance with the GDPR. If you use OurSnaps from outside the EU, your data is transferred to and stored in the EU.

4. Your rights

Under the GDPR you have the right, free of charge, to:

  • access the personal data we store about you, its origin, recipients and the purpose of processing,
  • have incorrect data corrected and have your data deleted,
  • restrict the processing of your data,
  • receive your data in a common, machine-readable format (data portability),
  • withdraw any consent you have given, with effect for the future,
  • object to processing based on our legitimate interests (Art. 21 GDPR) and to direct marketing at any time,
  • lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

To exercise your rights, email us at contact@oursnaps.app. You can also delete your account and all your galleries at any time in the settings.

5. Legal bases and storage period

We process your data to perform our contract with you (Art. 6(1)(b) GDPR), to comply with legal obligations (Art. 6(1)(c) GDPR), on the basis of our legitimate interests (Art. 6(1)(f) GDPR) or with your consent (Art. 6(1)(a) GDPR). The relevant basis is named in each section below.

Unless a more specific period is stated, we keep your data until the purpose for processing it no longer applies. If you request deletion or withdraw your consent, we delete your data unless we have another legal reason to keep it (e.g. tax retention periods); in that case we delete it once that reason no longer applies.

6. Data collected on this website

Cookies and local storage

We only use technically necessary cookies and browser storage – for example to keep you logged in, to remember your name in a gallery and to protect uploads from abuse. They are used on the basis of our legitimate interest in providing a working service (Art. 6(1)(f) GDPR). Analytics cookies (Google Analytics, see below) are only set after you give your consent in our cookie banner (Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via “Cookie settings” in the footer. We do not use advertising cookies.

Server log files

Our hosting provider automatically collects information that your browser sends: browser type and version, operating system, referrer URL, host name of the accessing computer, time of the request and IP address. This data is not combined with other data sources. It is processed on the basis of Art. 6(1)(f) GDPR, our legitimate interest in a technically error-free and optimized website.

Vercel Analytics

We use Vercel Analytics, a cookie-free audience measurement service by Vercel Inc. It collects aggregated, anonymous usage data (e.g. page views) without cookies and without identifying individual users. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly audience measurement).

Google Analytics

With your consent, we use Google Analytics 4, a web analytics service by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to analyze how visitors use our website (e.g. pages viewed, time spent, device and browser type, approximate location, completed purchases). IP addresses are not stored in Google Analytics 4. The data may be transferred to Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings” in the footer. Data is retained for 14 months. More information: policies.google.com/privacy.

Contacting us

If you contact us by email, we store your request and the personal data it contains (name, request) to handle your enquiry. We do not share this data without your consent. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract, otherwise our legitimate interest in handling enquiries (Art. 6(1)(f) GDPR).

7. Account, sign-in and photos

Account

You can create an account to create and manage events (galleries). For this we process your email address and the event data you create. The legal basis is Art. 6(1)(b) GDPR. Your data is stored as long as your account exists; you can delete your account at any time in the settings.

Sign in with Google

You can also sign in with your Google account. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you sign in, we receive the data needed to create your account (in particular your name and email address). The legal basis is Art. 6(1)(b) GDPR. More information: policies.google.com/privacy.

Photos uploaded by users

Guests and organizers can upload photos to an event gallery. These photos are stored on the servers of our processor Supabase (located in the European Union, Frankfurt region) and shown within that gallery. By uploading, you confirm that you have the right to share the photos and that the people shown agree to being shown in the gallery. Galleries and photos are deleted automatically when the plan’s storage period ends (between 14 and 90 days from the event date, depending on the plan). The legal basis is Art. 6(1)(b) GDPR.

Emails about your events

We send emails that are part of the service, such as your QR code after a purchase, reminders before your gallery expires and password reset links. The legal basis is Art. 6(1)(b) GDPR. We do not send newsletters.

8. Payments

We process customer and contract data to set up and carry out our contracts with you (Art. 6(1)(b) GDPR). Customer data is deleted after the contract is completed and any statutory retention periods have expired.

Payments are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”). When you buy a paid plan, the data needed for the payment (e.g. name, amount, payment method) is transmitted to and processed by Stripe. You enter your card details directly with Stripe; we never receive or store them. The legal bases are Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR (legitimate interest in smooth and secure payments). Any transfer of data to the USA is based on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. Details: stripe.com/privacy.

We share personal data with third parties only when this is necessary to perform the contract, such as with our payment provider. We do not pass your data on to third parties for advertising purposes.

9. Information for US residents

We do not sell your personal information and we do not share it for cross-context behavioral advertising. Depending on the state you live in (e.g. California), you may have the right to know what personal information we collect, to request its deletion or correction, and not to be discriminated against for exercising these rights. To make a request, email us at contact@oursnaps.app. We will respond within the time required by law.

10. Children

OurSnaps is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Security and changes

This website uses SSL/TLS encryption to protect the data you send us. Please note that data transmission over the internet (e.g. by email) can have security gaps; complete protection of data against access by third parties is not possible.

We may update this policy when our service or the law changes. The current version is always available on this page.