1. Introduction

Welcome to Snapeen ("Snapeen," "we," "our," or "us"). Snapeen is an event photo-sharing platform operated from the Republic of Serbia. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you use our website and services at snapeen.com.

This policy applies to both event hosts (users who create an account and set up an event gallery) and event guests (people who upload or view photos via a QR code or event link, with or without an account). For questions or privacy requests, contact us at hello@snapeen.com.

2. Roles: Hosts, Guests, and People in Photos

Snapeen is a tool that hosts and guests use to collect and share event photos. Because of this, responsibilities are shared:

For account and usage data (your account, payments, analytics), Snapeen determines how data is processed and acts as the data controller.
For photos and videos uploaded to an event, the host and the uploading guest decide what is captured and shared. Snapeen stores and processes this content on their behalf in order to provide the service.
People appearing in photos: uploaded content may include images of third parties (event attendees). The person uploading the content, and the event host, are responsible for ensuring that people appearing in photos are informed and, where required by law, have consented to being photographed and shared within the event gallery. Snapeen does not control what guests photograph.
Business accounts: a photographer, event planner or venue that uses Snapeen for Business to deliver a service to its own clients decides what it collects from its guests and clients (for example through the guest form or by adding client contacts) and is responsible for that information under applicable law. Snapeen processes it on the business's behalf to provide the service. If you were a guest or a client at such an event and have a question about your data, the business that ran the event is your first point of contact; we will assist where we can.

If you appear in a photo on Snapeen and want it removed, contact the event host, or email us at hello@snapeen.com and we will assist.

3. Information We Collect

3.1 Information You Provide

Account Information: Name, email address, and password when you create a host account, or the name and email address provided by Google when you sign in with Google. You may also set, in your account settings, your country and whether you want to receive product news by email.
Onboarding Answers: When you create your first event we may ask, optionally, how you heard about Snapeen and what kind of user you are (for example host, photographer, or planner). These answers are stored with your account and used to understand where our users come from.
Event Information: Event name, date, occasion type (for example wedding or birthday), settings (including access PINs and gallery visibility), and, optionally, the expected number of guests. The event's country is not asked; it is taken from your approximate location (see Section 3.2).
Photos and Media: Images and videos uploaded to events, including embedded metadata where present (such as capture time, image dimensions, and camera make and model), and any name a guest optionally provides with an upload. Guests can upload without giving a name, and hosts can turn the name field off entirely.
Business Profile and Clients: if you set up a Snapeen for Business profile we also store your business name, type (photographer, planner, venue or other), website, logo, brand colors and guest page defaults, and the contact details of the clients you add (name, email address, phone number and notes), together with the emails we send them on your behalf (such as a gallery delivery) and whether those were opened. Where a business turns on the guest form for an event, guests are asked for their name, email address, phone number and, optionally, an answer to one question, and to confirm their consent; these answers are stored with the event's guest record and are visible only to the business that runs the event. Where a business creates a client gallery, we store its settings, its access PIN and how often it was viewed.
Communications: Messages you send us (support requests, feedback)

3.2 Information Collected Automatically

Device and Log Information: IP address, browser type and version, operating system and device type (for example phone or desktop), browser language, time zone, and access timestamps. For hosts we keep the IP address and browser used at sign-up together with the account, for fraud and abuse prevention.
Approximate Location: our hosting provider derives an approximate location (country, and in some cases region and city) from your IP address at the network edge. We keep only the country on accounts, events, uploads, and analytics records. We do not collect GPS location from your device, and location data embedded in photos is not read or stored separately.
Account Activity: how the account was created (email or Google), when the email address was verified, the date of the last sign-in, the number of sign-ins, and the date of the last activity.
How You Found Us (marketing attribution): when you arrive on snapeen.com we record the campaign parameters in the link you used (for example utm_source or an advertising click identifier), the website that referred you, and the first page you landed on. This is kept in your browser for the duration of the visit and, if you accept analytics cookies, across visits. If you create an account or an event during that visit, the attribution is stored with your account or event so we know which channels bring us hosts.
Product Usage (first-party analytics): we record pages viewed and actions taken in the product, such as creating an event, uploading, viewing a gallery or photo wall, sharing, downloading, or starting a checkout. Each record carries the page, the time, the device type, language, and country, and a random session identifier that lives in your browser only until you close the tab. When you are signed in, records are linked to your account; when an action concerns an event, they are linked to that event. This analytics is run by Snapeen itself and stored in our own database; it does not use third-party cookies.
Guest Identifiers: when you open an event's upload page we store a random identifier for that event in your browser's local storage. It lets the host show you your own uploads when the gallery is set to "own uploads only", and links your uploads together. For each event we keep a guest record with this identifier, the name you optionally entered, the times of your first and last upload, how many photos and videos you uploaded, and your device type, language, and country. Guest records are deleted together with the event.
Event Statistics: per event we count upload page views, gallery and photo wall views, shares, downloads, and the number of distinct uploaders, and record when the QR code was first downloaded and when a paid upgrade was started. Hosts see these counts in aggregate; they do not see guests' IP addresses or precise device information.
Email Engagement: emails we send contain a small tracking image and links that pass through our tracking address (links.snapeen.com) before reaching their destination. This tells us whether an email was delivered, opened, or clicked, and whether it bounced or was reported as spam. We use this to make sure important notices (such as deletion reminders) actually reach you and to improve our emails.
Third-party Analytics: we also use Google Analytics and Microsoft Clarity. If you are in the EEA, the United Kingdom, Switzerland or Serbia they run only with your consent; elsewhere they run by default, together with Google Ads conversion measurement, and you can switch them off at any time (see Section 6).

3.3 Payment Information

Payments are processed by our payment partner Lemon Squeezy (acting as merchant of record). When you purchase a plan or subscription, Lemon Squeezy collects your payment details (card number, billing address, VAT information) directly. Snapeen never receives or stores your full payment card details. We keep our own record of each order: the plan purchased, amount, currency, tax, discount, refund status, the order identifier, the email address and name used at checkout, and the analytics session in which the purchase started (so we can attribute the sale to the channel that brought you). Lemon Squeezy's own privacy policy applies to their processing.

4. How and Why We Use Your Information

We use personal information only where we have a legal basis to do so:

To perform our contract with you: providing the service: creating and managing event galleries and QR codes, enabling uploads, downloads, and gallery viewing, generating optimized versions of your media (thumbnails and previews) and, where you request it, creations such as collages, slideshows, and highlight videos; showing guests their own uploads; processing purchases; and sending service emails (for example purchase confirmations, event reminders, and deletion notices)
Legitimate interests: securing the platform, preventing fraud and abuse, enforcing plan limits, debugging; measuring how the product is used through our own first-party analytics and event statistics; checking that our emails are delivered and read; understanding which marketing channels bring us customers; improving the product on that basis; and, outside the EEA, the United Kingdom, Switzerland and Serbia, running third-party analytics (Section 6) by default with an opt-out. You can object to this processing (see Section 9).
Consent: in the EEA, the United Kingdom, Switzerland and Serbia, third-party analytics cookies (Google Analytics, Microsoft Clarity), remembering marketing attribution and our own analytics visitor identifier across visits; everywhere, marketing emails. You can withdraw consent at any time.
Legal obligations: record-keeping (for example tax and accounting records for purchases) and responding to lawful requests

Marketing emails: we send tips and product news only if you opted in, either with the checkbox at sign-up or the toggle in your account settings. Emails about your own events (capacity warnings, reminders, storage expiry, purchase receipts) are part of the service and are sent regardless.

We do not use your photos to train artificial-intelligence models, we do not run facial recognition on your content, we do not build advertising profiles, and we do not use your event content for our own advertising without your explicit permission.

5. How We Share Your Information

We share personal information only in the following circumstances:

Event Participants: Photos and media uploaded to an event are visible to the host and to other people who have access to that event (via its QR code, link, or PIN), including on shared displays such as a live photo wall or slideshow if the host enables them. The name a guest enters with an upload is visible to the host and, in the gallery, to other guests.
Service Providers (processors): companies that help us run the platform under contractual confidentiality and data-protection obligations: Vercel (website hosting and the approximate-location lookup), Amazon Web Services (photo and video storage), DigitalOcean (application servers and database), Lemon Squeezy (payments), Resend (email delivery and email engagement tracking), and, with your consent, analytics providers (Google, Microsoft)
Legal Requirements: when required by law, court order, or to protect the rights, safety, or property of Snapeen, our users, or others
Business Transfers: in connection with a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your data

We do not sell your personal information, and we do not share your photos with advertisers.

6. Cookies, Browser Storage, and Analytics

We use cookies and similar technologies (local storage and session storage in your browser):

Essential: sign-in session, security protections, your cookie choice, the per-event guest identifier described in Section 3.2, and a random per-tab session identifier for our own analytics that is deleted when you close the tab. These are required for the service to work and cannot be disabled.
First-party analytics: our own usage records (Section 3.2) are collected without third-party cookies and without a persistent identifier by default. Only when analytics cookies are on (accepted by you, or on by default outside the regions listed in the next point) do we also keep a random visitor identifier and your marketing attribution in local storage, so that we can recognise a returning visitor across visits.
Third-party analytics (consent-based): we use Google Analytics (via Google Tag Manager) and Microsoft Clarity to understand, in aggregate, how the site is used and to improve it. If you are in the EEA, the United Kingdom, Switzerland or Serbia, their cookies are set only after you accept them in our consent banner, and Google Analytics is loaded only after you accept. Elsewhere, where the law does not require prior consent, they run by default and you can switch them off at any time via the "Cookie settings" link in the page footer. Which applies is decided from the country of your IP address; if it cannot be determined, we ask first. Outside the EEA, the United Kingdom, Switzerland and Serbia, Google Analytics also passes our conversion events (such as a sign-up or a purchase) and the advertising click identifier to Google Ads so we can measure whether our ads work; this does not personalize ads to you and is switched off together with analytics via the same "Cookie settings" link. Microsoft Clarity runs on the site to help us understand usage (for example which parts of a page are used), but if you have not accepted analytics cookies it operates in cookie-free mode: it sets no cookies and cannot recognize you across visits, and form inputs and other sensitive content are masked.
Email tracking: the open-tracking image and tracked links in our emails (Section 3.2) do not set cookies on our site.

You can change or withdraw your choice at any time via the "Cookie settings" link in the page footer. Your choice is remembered for 6 months; after that we ask again where consent is required and otherwise return to the default. You can also control cookies and site data through your browser settings; clearing site data removes the guest identifier, which means a gallery set to "own uploads only" will no longer recognise your earlier uploads. Disabling essential cookies may prevent parts of the service from working.

7. Data Storage and Security

Your photos and data are stored with reputable cloud infrastructure providers, with encryption in transit and at rest, access controls, and monitoring. Event galleries are protected by unguessable links, QR codes, and, where the host enables it, access PINs. However, no method of transmission or storage is 100% secure, and access to a gallery depends on how carefully its QR code, link, and PIN are shared: anyone who obtains them can access the gallery. We cannot guarantee absolute security, and hosts are responsible for distributing access credentials only to intended guests.

8. Data Retention and Automatic Deletion

We retain your account information for as long as your account is active or as needed to provide the service.

Event photos and media are automatically and permanently deleted at the end of your plan's storage period, measured from your event date:

Free plan: 30 days after the event date
One-Time plan: 12 months after the event date
Premium plan: 12 months after the event date

An active Snapeen Memories subscription keeps your event content stored for as long as the subscription remains active. If the subscription ends, your content becomes subject to the standard storage periods above, and content already past its storage period may be deleted after a short grace period.

Once deleted, content cannot be recovered by you or by Snapeen under any circumstances, including from backups. You are solely responsible for downloading your content before your storage period expires. Deleted content may persist in encrypted backups for a limited period before those backups are cycled.

Other data is kept as follows:

Server logs (including IP addresses): 30 days
Guest records and event statistics: deleted together with the event
Guest form answers, client contacts and client galleries (business accounts): deleted together with the event or the client record, and when the business account is deleted
Account details, activity, attribution, and onboarding answers: deleted when you delete your account
First-party analytics records: kept for product analysis in pseudonymous form; when you delete your account, the link between these records and your account is removed
Order records and email delivery logs: retained after account deletion where required for accounting, security, and dispute resolution, with the link to your account removed

We may retain limited non-media information (such as event metadata and purchase records) after deletion where required by law or for legitimate business purposes such as accounting, security, and dispute resolution.

9. Your Rights and Choices

Depending on your location (including under the EU GDPR and the Serbian Law on Personal Data Protection), you have the right to:

Access a copy of your personal data
Correct inaccurate or incomplete information (hosts can edit their name, email, and country in account settings)
Delete your account, your uploaded content, or specific photos in which you appear
Export your photos and event data (hosts can download their gallery at any time while it is available)
Object to or restrict certain processing, including our first-party analytics and email engagement tracking, and withdraw consent where processing is based on consent
Opt out of marketing communications at any time via the toggle in your account settings or the unsubscribe link in any marketing email
Complain to your data-protection authority (in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection; in the EU, your local supervisory authority)

To exercise these rights, contact us at hello@snapeen.com. Guests who uploaded without an account can quote the event link and the name they used, if any. We may need to verify your identity before acting on a request, and we will respond within the timeframes required by applicable law.

10. Children's Privacy

Our service is not directed at children, and host accounts and purchases require you to be an adult. We do not knowingly collect personal information directly from children under 13. Event photos may naturally include images of children (for example at birthdays or family events); responsibility for such photos rests with the uploading guest and the event host as described in Section 2. If you are a parent or guardian and want a photo of your child removed, contact us at hello@snapeen.com and we will act promptly.

11. International Data Transfers

Your information may be transferred to and stored on servers located outside your country, including through our cloud, email, payment, and analytics providers. Where such transfers occur, we rely on appropriate safeguards such as standard contractual clauses and our providers' compliance frameworks to protect your data at a level consistent with applicable data-protection law.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the 'Last updated' date; for material changes we will make reasonable efforts to notify account holders (for example by email or an in-app notice). We encourage you to review this policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy, our privacy practices, or wish to exercise your rights, please contact us at:

Email: hello@snapeen.com
Subject: Privacy Inquiry