Privacy notice

CR OU OÜ, Nõmme tee 64-3, 11311 Tallinn, Estonia (registry number 16778262). For any question about your data: [email protected].

From the person who creates an album: the email address, the album title, and the date and place of the event if you give them.

From guests: the name they choose to type (optional) and the photos, videos and any voice messages they upload, with the technical data inside the files (for example the date and time a photo was taken).

From the person who pays: Stripe tells us the outcome of the payment, the email, the country and the billing details you enter. We never receive the card number.

Technical data: IP address and browser information in the server logs, used for security and to limit abuse.

We do no facial recognition and we build no profiles. On the public site we use advertising measurement tools only if you consent (see the Cookies page); there are none in the albums or the management pages.

To provide the service you asked for: creating the album, showing photos to people with the link, making previews and films, letting you download everything (performance of the contract).

To take payment and keep our accounts (contract and legal obligations).

To protect the service from abuse and attacks (legitimate interest).

To answer you when you write to us.

What goes into an album is decided by the host and their guests: we store and show it on their behalf, as they choose. If you appear in a photo and want it removed, you can ask the host or ask us: we take it down.

Whoever uploaded a photo can remove it themselves, from the same device they uploaded it with.

Photos, videos, voice messages and films: until the album expires (12 months from the event for full albums, 24 with the extra; 90 days from creation for albums that are not unlocked), then permanently deleted. Sooner, if the host deletes the photo or the album.

Photos uploaded as a test to the demo album on the site: removed within a few hours.

Payment data and invoices: for the period required by Estonian tax law (7 years).

Server logs: for a limited period, as long as security requires.

Photos and videos are kept in storage located in the European Union, with no public access: they open only through temporary links generated for people who have the album link.

We use these providers, who handle data only on our instructions:

Cloudflare (file storage in the EU jurisdiction and protection of the site);

Hetzner (servers, in the European Union);

Stripe (payments; for payment data Stripe also acts as an independent controller).

Where a provider is based outside the European Union, the transfer is covered by the safeguards the GDPR provides (adequacy decisions or standard contractual clauses). We do not sell or pass data to anyone.

You can ask us at any time to access your data, correct it, delete it, restrict its use, receive a copy of it or object to its processing. Write to [email protected]: we answer within one month.

If you think we got something wrong you can complain to the supervisory authority of your country (in the UK the ICO, in Ireland the Data Protection Commission) or to the Estonian one (Andmekaitse Inspektsioon, aki.ee).

Festapix is not aimed at anyone under 16. It is natural for children to appear in a family album: responsibility for what is uploaded lies with the host and the guests.