Privacy

From the host: email address and name when you have an account, the event's name and settings, and the payment. Card details go straight to Stripe; we never see them. When an organisation buys Business, we also keep the company name, organisation number, invoice email and any reference.

From guests: the photos and videos they upload, file names and times. Guests need no account, and we do not ask for names. At a Business event that asks for it, we record whether the guest ticked that the organisation may use the photos.

Technical: IP address and browser details in server logs and to prevent abuse, and a random session id per visit to the guest page. It is not stored on the device and is used only to count how many people uploaded.

We process the data to provide the service you ordered (contract), to take payment and keep accounts (legal obligation under Norwegian bookkeeping law), to keep the service secure and stop abuse (legitimate interest), and to show the host anonymous numbers about the event (legitimate interest). Website analytics happens only if you consent to cookies. A guest's tick for reusing photos is consent given to the organisation, and it can be withdrawn.

Anyone with an event's link or QR code sees the gallery and the big screen. Original files are never public; only the host can download them. At a Business event with approval switched on, only the host sees a photo before it is approved, and a rejected photo is deleted at once. The host can delete photos at any time. If someone in a photo is a minor, it is the host who answers for the photo being shared.

A free event is deleted automatically after 14 days, a Premium or Business event 365 days after purchase. The photos, database records and the event's numbers are deleted then. Your account is kept until you delete it. Payment records and invoices are kept for five years because Norwegian bookkeeping law requires it. Server logs and error reports are deleted after a short time, at most 90 days. When an event expires, the files sit in a recycle bin for up to 75 days before they are deleted for good, so a host who changes their mind can get the album back. If you delete an event yourself, that is a deletion: it is gone immediately.

We never sell data. We use these providers, which process data only on our behalf: Google Cloud (Firebase) for the database, file storage, sign-in and hosting; Stripe for payments and invoices; Mailgun (EU region) for email to the host; and Sentry for error reports, without photo content.

Only if you say yes to cookies do we also use Google Analytics and Google Ads, Meta (Facebook and Instagram) and LinkedIn to measure whether our ads lead to visits and purchases. These companies then receive which pages you visit and whether you buy, and they can link it to an account you have with them. They are themselves responsible for what they do with it. None of them is used on the guest page or the big screen.

All traffic is encrypted, and so is storage. Original files are fetched only through links that expire. Passwords are handled by Firebase and never stored in plain text. Operational access is limited to those who need it.

You can ask for access, correction, deletion and a copy of your data, and you can object to processing or withdraw consent. Write to support@snapr.no and we will answer within 30 days. If you were a guest at a Business event, you can also contact the organisation; we help them answer. You can complain to the Norwegian Data Protection Authority (Datatilsynet) or the authority where you live. We make no automated decisions about you and build no profile of you.

Snapr uses only the cookies the service needs to work, plus analytics and ad measurement (Google, Meta and LinkedIn) if you say yes. The guest page does not ask and measures nothing. Nothing is stored before you choose, and you can change your mind at any time.

If we change this statement, we update the date at the top. If the change is significant, we tell hosts by email before it takes effect.