Privacy Policy

1. Who we are and our role

Snapia is operated by Snapia Technologies FZ-LLC, [Registered address, United Arab Emirates] ("Snapia", "we"). We act in two roles:

• Controller for account data, billing data, support messages and technical data about how our website is used.
• Processor for album content, meaning the photos, videos, voice messages, guestbook messages and optional guest names uploaded to an album. We process this content on behalf of the host, or the venue for events it creates, who decides how the album is used.

If you are a guest with a question about a specific album, you can contact the host, and we will also help at privacy@snapia.co. Users in Türkiye should also read our KVKK Information Notice. Venues should read our Data Processing Agreement.

2. Data we collect

• Account data: name, e-mail address, password (stored only as a secure hash), language, venue or company details and communication preferences. If you sign in with Google or Apple, we receive your name and e-mail address from them.
• Guest data: an optional display name, your uploads and basic file information (such as upload time and file type), and a random device token stored in your browser so you can manage your own uploads. Guests do not need an account.
• Payment data: the plan purchased, amount, billing details and payment status. Card details are entered directly with Stripe; Snapia never receives or stores full card numbers. For bank transfers we see the sender name and reference.
• Technical data: IP address, browser and device type, request and error logs and security events.
• Communications: messages you send to support and your data requests.

3. Why we use data and our legal bases

• Providing the Service (albums, uploads, share links, downloads, print-ready files): performance of our contract with you; for album content, the instructions of the host or venue.
• Payments, invoicing and accounting: performance of contract and legal obligations.
• Service e-mails such as receipts, security notices and deletion warnings: performance of contract and our legitimate interests.
• Security, fraud and abuse prevention, including bot protection: our legitimate interests.
• Improving Snapia using aggregated usage data, never album content: our legitimate interests.
• Marketing e-mails: your consent only.
• Legal compliance and defending claims: legal obligations and our legitimate interests.

4. How we store and protect album content

• Album content is stored in Cloudflare R2 with EU jurisdiction, in a private bucket that is not publicly accessible.
• Files are shown only through short-lived signed links created for people allowed to view them.
• Location (GPS) metadata is removed automatically from stored photos, including the original file, when they are processed after upload.
• Albums are private by default. Hosts can create share links, optionally protected by a PIN.
• Data is encrypted in transit, and internal access is limited to staff who need it for their work.

No system is completely secure, but we review our measures regularly and will notify you and the authorities of a personal data breach where the law requires.

5. Service providers

We use carefully selected providers who process data on our instructions:

• Cloudflare: storage (R2), content delivery and bot protection (Turnstile).
• Stripe: payment processing. Stripe may also act as an independent controller under its own privacy policy.
• E-mail delivery provider [name to be confirmed]: service and, if you opt in, marketing e-mails.
• Sentry (optional): error monitoring, set up to minimise personal data.
• AI moderation provider [name to be confirmed] (optional): only when the host enables moderation, uploads to that album are screened automatically.

We may also disclose data where required by law or to protect rights and safety. We do not sell personal data.

6. International transfers

Snapia is based in the United Arab Emirates, and some providers process data in other countries, including the United States. Where the law requires, we protect these transfers with appropriate safeguards, such as standard contractual clauses, and for Türkiye the mechanisms described in our KVKK Information Notice.

7. How long we keep data

Album content is kept for the archive period of the plan and then permanently deleted. The period starts on the event date:

• Free trial: 14 days
• Celebration: 6 months
• Wedding Standard: 12 months
• Wedding Premium and Wedding Series: 24 months
• Venue events: 12 months

Hosts can buy archive extensions, and we send e-mail warnings 30, 7 and 1 day before deletion. Account data is kept while your account is open and deleted or anonymised after you close it. Billing records are kept for as long as tax and accounting laws require. Technical logs are kept for a short period, normally up to [90] days.

8. Your rights

Depending on where you live, you may have the right to access, correct or delete your data, to restrict or object to processing, to data portability, to withdraw consent at any time, and to complain to a data protection authority.

• Guests can delete their own uploads directly from the browser they uploaded with.
• For any other request, use the data request form or write to privacy@snapia.co.

We may need to verify your identity. Where a request concerns album content, we may involve the host or venue, as the controller, and help them respond. We reply within one month or any shorter period required by law.

9. Optional consents

Marketing e-mails

We send marketing e-mails only if you tick a separate, optional checkbox. It is never pre-ticked and is not a condition for using Snapia. You can unsubscribe at any time using the link in each e-mail or in your account settings.

Face search

Snapia does not offer or run face search or facial recognition. We do not create biometric templates from photos. If we ever introduce such a feature, it would only be enabled with the separate, explicit, opt-in consent of each person concerned, after clear advance notice and an update to this policy.

10. Children

Accounts are for adults aged 18 or over. Children may appear in event photos or upload as guests with a parent or guardian involved; hosts are responsible for using such content appropriately. If you believe a child's data has been shared inappropriately, contact us and we will act promptly.

11. Cookies

We use only strictly necessary cookies and similar browser storage. See our Cookie Policy.

12. Changes

We may update this policy. We will notify you of material changes by e-mail or in the app before they take effect.

13. Contact

Snapia Technologies FZ-LLC, [Registered address, United Arab Emirates]

• Privacy and data requests: privacy@snapia.co
• Legal notices: legal@snapia.co