1. Data Controller
The controller of your personal data is itworked, NIP: 8952272359, email: kontakt@fotoclick.pl (hereinafter: "Controller").
2. What Data We Collect
Organizers with an account
- Email address — provided during account registration. Used for login, transactional emails, and user identification.
- Password — stored exclusively by the external authentication provider (Supabase). The Controller does not have access to user passwords in plain text.
- Payment data — processed exclusively by the payment provider Stripe. The Controller does not store credit card numbers, bank details, or CVV codes.
Organizers without an account (Free plan)
- Event code and organizer PIN — stored in hashed form. No personal data is required.
Guests
- Device identifier — an anonymous, randomly generated identifier stored in a cookie. Only its cryptographic hash is saved in the database. It is not linked to any personal data.
- Photos — image files uploaded to the event gallery.
- Optional data — author name (max 30 characters) and message (max 100 characters), provided voluntarily by the guest when uploading a photo.
Automatically collected data
- Photo metadata: dimensions, file format, size, date taken (if available in photo metadata).
- Photos uploaded to the Platform may contain metadata stored by the device (e.g., date, GPS location, camera model). The Platform does not read or use this data, but it is stored as part of the photo file.
- IP addresses may be temporarily processed to protect against abuse (request rate limiting), but are not saved in the database or logs.
3. Purposes of Data Processing
- Service delivery — creating and managing photo galleries, displaying photos, generating thumbnails, enabling downloads.
- Automatic scene descriptions (Full plan) — generating short gallery chapter names (e.g. "First dance", "Cake") via an external AI provider (OpenAI) from a single photo representing the scene. Descriptions relate to the scene and do not identify individuals.
- Authentication — organizer login (email and password or PIN).
- Payment processing — processing plan upgrades via Stripe.
- Device identification — enforcing per-device upload limits, marking photos as "mine" in the gallery, counting unique devices in event statistics.
- Transactional communication — sending emails related to the service (registration confirmation, payment confirmation, expiration warning, event summary - with a preview of a few photos and guest notes from the event).
- Error monitoring — logging technical errors to improve service quality (technical data only, no personal data).
- Usage statistics — aggregate statistics of traffic and actions on the Platform (e.g. creating an event, uploading photos), collected without cookies and without storing anything on your device.
- Ad performance measurement — only with your consent (Meta Pixel), see section 5.
4. Legal Basis for Processing (GDPR)
- Art. 6(1)(b) GDPR — processing is necessary for the performance of a contract (creating events, storing photos, processing payments).
- Art. 6(1)(f) GDPR — legitimate interest of the Controller: ensuring Platform security, device identification for enforcing limits, error monitoring, Platform usage statistics.
- Art. 6(1)(a) GDPR in conjunction with Art. 399 of the Polish Electronic Communications Law — your consent: ad performance measurement with the Meta Pixel.
5. Cookies, local browser storage and consent
Essential to the service (no consent needed)
We use cookies essential to the operation of the service: guest device identification (anonymous identifier), maintaining the organizer session (PIN authorization), and logged-in user sessions. We also keep your cookie choice in local browser storage.
Beyond cookies, we use local browser storage (IndexedDB, Cache API) solely for purposes essential to the service: caching the gallery you view so it works offline, and queuing photos uploaded while you have no connection. This data stays on your device, is not used for tracking, and is cleared when you clear your browser data or uninstall the app.
Statistics without storing anything on your device
For aggregate usage statistics we use PostHog and Vercel Web Analytics and Speed Insights. They work without cookies and store nothing on your device, so they do not require consent.
Ad performance measurement (with consent)
With your consent, we run the Meta Pixel (Meta Platforms Ireland Ltd.) on the information pages, in the organizer panel and in your account. It measures whether our Facebook and Instagram ads lead to visits, event creation, account registration or purchases, and stores cookies in your browser (_fbp, _fbc). Without consent the pixel is not loaded, and it never runs on the guest event page (gallery).
We save your choice when you click "Accept" or "Reject" in the bar at the bottom of the page. You can withdraw consent at any time with the "Cookie settings" button in the page footer: the bar appears again and the pixel cookies are removed from your browser.
6. Data Processors (Sub-processors)
To provide the service, we use the following external providers:
- Supabase — user authentication and database
- Stripe — payment processing
- Cloudflare — photo storage
- Resend — email delivery
- Vercel — Platform hosting and traffic statistics (Web Analytics, Speed Insights) without cookies
- PostHog — Platform usage statistics (EU servers), without cookies
- Sentry — technical error monitoring (EU servers)
- OpenAI — generating short scene descriptions (gallery chapter names) for the Full plan. A single photo representing the scene is sent to the service; the provider does not use the submitted data to train its models.
Meta Pixel data (only with consent) is collected and transmitted jointly with Meta Platforms Ireland Ltd.; Meta then processes it as a separate controller under its own privacy policy.
7. Data Retention
- Photos — stored for the plan validity period. After the event expires, they remain available for 30 days (grace period), then are permanently and automatically deleted.
- Basic event data (name, date, photo count) — after the photos are deleted, this remains in the account as event history for up to 24 months, then is permanently deleted.
- Account data — stored until the user deletes their account.
- Payment data — stored by Stripe in accordance with applicable law. The Platform only stores the transaction identifier, amount, payment method, and buyer email.
- Cookies — device identifier: up to 1 year; organizer session: up to 7 days; account session: until browser session ends; Meta Pixel cookies (only with consent): up to 90 days or until consent is withdrawn.
- Your cookie choice — 6 months after a refusal, 12 months after consent (then we ask again), unless you change it or clear your browser data earlier.
- Local browser storage (offline cache) — cached gallery: up to 24 hours; queued offline photos: until sent, no longer than 7 days. Removable at any time by clearing your browser data.
8. Your Rights (GDPR)
As a user, you have the right to:
- access your personal data,
- rectify inaccurate data,
- erase your data ("right to be forgotten"),
- restrict processing,
- data portability to another controller,
- object to processing based on legitimate interest,
- withdraw consent — at any time (for the Meta Pixel: the "Cookie settings" button in the page footer), without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, contact us at: kontakt@fotoclick.pl
You also have the right to lodge a complaint with a supervisory authority — the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
9. Data Security
The Controller implements appropriate technical and organizational measures to protect data, including:
- encrypted connections (HTTPS/TLS),
- password hashing (handled by Supabase) and PIN hashing,
- API request rate limiting,
- data storage in secured cloud infrastructure,
- cookies with httpOnly and secure flags (in production).
10. Data Transfers Outside the European Economic Area
Some of the providers we use (Supabase, Stripe, Resend, OpenAI, Vercel, and with your consent Meta) are based outside the European Economic Area or transfer data outside it. Data transfers to these providers are carried out on the basis of Standard Contractual Clauses (SCC) approved by the European Commission or other appropriate safeguards as provided for by the GDPR.
11. Changes to This Policy
The Controller reserves the right to modify this Privacy Policy. The current version is always available on the Platform at fotoclick.pl/privacy.
12. Contact
For matters related to personal data protection, please contact us at: kontakt@fotoclick.pl
Last updated: November 3, 2026