Privacy policy

This service is operated by [registered company name - set it in /admin/integrations]. You can reach us about anything on this page at andy.smit1@gmail.com.

It applies to this site and everything reached through it: the venue area, a host's dashboard, the guest upload page behind a shared link or QR code, and the emails we send.

Souvenir has a shape worth understanding before the detail, because it decides who can see what.

• Venues hold an account with us, buy credits, and invite the people who book with them.
• Hosts - a couple, an organiser, whoever the event belongs to - are invited by a venue and own the gallery their guests fill.
• Guests scan a code on the day and upload. They create no account and we ask nothing of them beyond, optionally, a name.

For an account - venue staff, or a host:

• Email address, and a name if one was given.
• A password, stored only as a bcrypt hash. We cannot read it, and nobody at Souvenir can set it for you: an administrator can only email you a link to choose your own.
• If two-factor authentication is switched on, a shared secret encrypted at rest, and single-use recovery codes stored as hashes.
• A record of when the account was created and which venue invited it.

For a venue:

• Billing contact, country, timezone, VAT number if given, and a logo, colour and welcome note if uploaded.
• A ledger of credits bought, spent and refunded, and the tax invoices issued.
• A log of what its staff did - invitations sent, withdrawn, resent - so a venue can answer its own questions later.

For an event:

• Its name, date, timezone, an optional access code, and an optional welcome note and header image.
• The photographs and videos guests upload, at full original quality, along with the file name, type, size and time of upload.
• For each upload, whatever name and short message the guest chose to type. Both are optional, and a guest who types nothing is recorded as nothing.

We do not keep a record of which device or which person uploaded which file beyond the name a guest typed themselves. There is no tracking of guests across events, no advertising identifier, and no profile of anybody.

• We do not sell personal information, and we do not share it for anyone else's marketing.
• We do not run facial recognition or any other biometric analysis over the photographs.
• We do not use the photographs to train machine-learning models, ours or anybody else's.
• We do not open a gallery to look at its contents. Access by our staff happens only to fix a fault or to answer a request from the account holder, and it is logged.
• We do not use advertising or analytics cookies. See the cookies section below for the three we do set.

The host can. Everyone else has to be let in, and the boundaries are enforced in the software rather than by policy alone.

• The venue that invited a host cannot see their photographs. A venue can help with setup and print the guest cards, and that is the whole of its reach.
• A host can share an individual photograph with their venue - for the venue's own marketing - one photograph at a time, and take it back afterwards.
• Guests see each other's photographs only if the host switches on the guest gallery. It is off by default. When it is on, previews can be watermarked with the event name, and videos are never shown to guests.
• An access code, if the host sets one, is needed before the upload page opens at all.
• Our administrators have technical access to the systems that hold the files, which is unavoidable in hosting a service, and their actions in the admin area are logged.

Every event runs on four clocks, pinned when the event date is set and shown to the host on their own screen:

• Uploads open on the morning of the event, in the event's own timezone.
• Uploads close a fortnight later.
• The host's access to the gallery ends three months after the event.
• The files are deleted a month after that. Deletion is permanent and we cannot undo it.

Before access ends we build the whole gallery into a download and email it, then remind the host as the dates approach - so nobody loses photographs by not reading an email. Download links last 14 days. A host can also download everything at any time, and can delete their event, or their whole account, whenever they like.

Elsewhere: invitations expire after 30 days, a password reset link after one hour, a first-password link after seven days, and an email-change confirmation after one hour. Account, credit and invoice records are kept as long as tax and company law requires. Deleted files may persist in encrypted backups for a short period before those rotate.

We keep the list short on purpose. Each of these sees only what it needs to do its job.

• Object storage for the photographs and videos. Which provider and which region depends on how this instance is configured; ask us and we will tell you exactly where your files sit.
• An email provider, to deliver invitations, reset links and the notices above.
• Paystack, for card payments by venues. Card details are entered on Paystack's own pages and never reach us; we keep the reference, the amount and the invoice.
• Unsplash, if a host chooses a header image from it. The search runs through our server so Unsplash does not see who is searching, and the chosen photograph is copied into our own storage.
• Google Drive, if - and only if - a host connects their own Google account to keep a copy of their photographs. See below.

A host can have every photograph copied into a folder in their own Google Drive, so their photographs outlive our deletion schedule. This is off unless they switch it on.

• We ask Google for one narrow permission, drive.file, which reaches only files our app itself creates. We cannot see, read or delete anything else in that Drive.
• We store the token Google gives us, encrypted at rest, and use it only to add files to the folder we created.
• We never delete from anyone's Drive. When the deletion schedule above removes files from Souvenir, the copy in their Drive is untouched - that is the point of the feature.
• Disconnecting stops the copying and forgets the token. Everything already copied stays where it is.

Three, all necessary, none for tracking:

• A sign-in cookie for account holders, which is how you stay logged in.
• A per-event cookie for guests, recording that a correct access code was entered.
• A language cookie, remembering whether you chose English, German or Afrikaans.

• Everything travels over TLS.
• Passwords are bcrypt hashes; recovery codes are SHA-256 hashes; two-factor secrets and stored third-party tokens are encrypted at rest.
• Sessions carry a version, so changing a password or two-factor setting signs out every other device at once.
• Uploads go straight from the guest's phone to object storage with a short-lived, single-purpose signed URL.
• If a breach affects your data we will tell you and the relevant regulator, as the law requires and as quickly as we can establish the facts.

Depending on where you live, the Protection of Personal Information Act in South Africa, the UK and EU General Data Protection Regulation, or a local equivalent gives you the right to see what we hold about you, correct it, have it deleted, object to how we use it, and receive a copy in a portable form. Two of those you can exercise yourself, without asking: a host can download their entire gallery whenever they want, and can delete their account and its files from their settings.

For anything else, email andy.smit1@gmail.com and we will act inside the time the law allows. If we hold photographs on a host's behalf and you are a guest who wants one removed, tell the host or tell us and we will pass it on - they decide what happens to their gallery, and we will help.

If you think we have handled your information badly you can complain to us first, and to the Information Regulator of South Africa or your own supervisory authority regardless of what we say.

We are based in South Africa. Depending on how this instance is configured, files and emails may be handled in another country by the providers listed above - the storage region is a deliberate choice we can tell you about, and can be kept in the EU where that matters. Wherever data goes, the protections in this policy follow it.

Accounts are for adults. Guests at an event may well be children, and photographs of children will end up in galleries: whoever hosts the event decides who is invited and what is done with the photographs, and is best placed to handle a parent's wishes. Tell us and we will help a host act on such a request quickly.

When this policy changes we will update the date at the top, and for anything material we will email account holders rather than leave it to be noticed. This page is published in English; if you need it in German or Afrikaans, ask us.