Privacy Policy

1. Scope of this policy

This Privacy Policy explains how CrowdSnaps, Inc. (“CrowdSnaps”, “we”) handles personal information when you use our website and event media service.

It covers three groups of people:

• Customers — photographers, planners, and venues who hold an account with us.
• Hosts — people invited by a Customer to moderate an event.
• Guests — event attendees who upload or view photos and videos.

For Customer account data, we act as the controller. For photos, videos, guest names, and messages collected during an event, we act as a processor on behalf of the Customer who created that event — they decide what is collected and why, and we handle it on their instructions.

2. Information we collect

Information you give us

• Account details — name, email address, business name, and a hashed password. We never store passwords in readable form.
• Branding — your subdomain, display name, logo URL, brand color, and optional website and support email.
• Event details — event name, date, type, location, welcome message, photo prompts, and the host’s email address.
• Support messages — anything you send us by email or through the contact form.

Information guests provide

• Photos and videos, including any metadata embedded in the files by the guest’s device.
• An optional display name shown as a caption if the host enables captions.
• An optional short message attached to an upload.

Guests are not required to create an account and we do not ask them for an email address, phone number, or any other contact detail.

Information collected automatically

• A hashed IP address for guests who upload, used solely to enforce per-event rate limits and prevent abuse. We store a keyed hash, not the address itself.
• Aggregate counts such as page views for an event’s upload page and gallery. These are simple counters and are not tied to individuals.
• Standard server logs generated by our hosting and CDN providers, retained for a short period for security and debugging.

We do not load third-party advertising or analytics trackers on guest event pages, and we do not build behavioral profiles of guests. On the marketing site and account pages, optional analytics and advertising tags (Google Analytics, Google Tag Manager, and Meta Pixel) run only if you accept them. See our Cookie Policy.

Payment information

Card details are collected and stored by Stripe. We receive only a customer identifier, subscription status, and the plan you are on. We never see your full card number.

3. How we use information

We do not sell personal information or use customer or guest content to train machine learning models. If you accept optional advertising cookies, we share a truncated identifier and the page URL with Google and/or Meta so we can measure ads. You can refuse or withdraw that consent at any time from Cookie settings.

4. Who we share information with

We share personal information only with service providers that help us run the Service, and only to the extent needed:

We also disclose information when:

• a Customer or Host accesses media from their own events — this is the core purpose of the Service;
• required by law, subpoena, or to protect our rights or the safety of others;
• we are involved in a merger, acquisition, or sale of assets, in which case we will notify you before your information becomes subject to a different policy.

5. How long we keep information

Deleting an event removes both its database records and the underlying stored files. Deleting your account removes your account and every event and media file associated with it.

6. How we protect information

• All traffic is encrypted in transit with TLS.
• Media is stored encrypted at rest in Amazon S3.
• Media is never publicly readable — every view or download uses a short-lived signed URL.
• Passwords are hashed with bcrypt using a per-password salt and a high work factor.
• Event links use long random tokens that cannot reasonably be guessed.
• Access to event data is scoped to the owning business account and checked on every request.

No system is perfectly secure. Read more on our security page.

7. Your privacy rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct information that is inaccurate or incomplete;
• delete your information;
• receive a portable copy of information you provided;
• object to or restrict certain processing;
• withdraw consent where processing relies on consent;
• not be discriminated against for exercising any of these rights.

Customers can exercise most of these directly: update your profile and branding in the dashboard, download event media as a ZIP, delete individual events, or delete your account entirely from account settings.

For anything else, email privacy@crowdsnaps.com. We respond within 30 days and may need to verify your identity first.

If you are a guest at an event

Photos you upload are controlled by the business that created the event. Ask them first — they can remove your upload immediately from the host portal. If you cannot reach them, contact us and we will forward your request and assist where we are able.

UK and EU residents

You have the right to lodge a complaint with your local supervisory authority. We would appreciate the chance to address your concern first.

California residents

We do not sell personal information. If you accept optional advertising cookies, we share identifiers with Google and/or Meta for ads measurement as described above; that is “sharing” under the CPRA and you can opt out by rejecting those cookies. We do not process guest event activity for cross-context behavioral advertising. You may exercise your rights using the contact address above.

8. International transfers

We operate from the United States and our providers may process data in the United States and other countries. Where personal information is transferred out of the UK or European Economic Area, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with the technical measures described above.

9. Children

The Service is not directed at children under 13, and Customer accounts may only be created by adults. Events may take place where children are present and may appear in guest photos; the Customer and Host are responsible for obtaining any consent required from parents or guardians. If you believe we hold information about a child that should be removed, contact privacy@crowdsnaps.com and we will delete it promptly.

10. Cookies

We use strictly necessary cookies for sign-in and security, browser local storage for your theme preference and cookie choice, and optional analytics cookies on marketing and account pages only after you accept. Guest event pages never load those tags. See our Cookie Policy for the full list.

11. Changes to this policy

We may update this policy as the Service evolves. Material changes will be announced by email to account holders or by an in-product notice at least 14 days before taking effect. The “last updated” date at the top of this page always reflects the current version.

12. Contact us

Privacy questions and requests:

CrowdSnaps, Inc.
2261 Market Street, San Francisco, CA 94114, USA
privacy@crowdsnaps.com