Privacy Policy for Guest Gala

1. Information we collect

We collect information you provide, information supplied by hosts or other guests, and technical information generated when the service is used. You can choose what to upload, but some information is needed to create an account, process payment, or complete an upload.

• Account information: email address, name, verification status, account and sign-in records, and any profile information you provide.
• Wedding information: the couple's names, page title and message, cover image, appearance choices, and sharing settings.
• Guest content: photos, videos, uploader names, guest messages, upload dates, file type and size, and identifiers used to associate uploads with a wedding and browser.
• Payment information: payment status, purchase records, and transaction details returned by Stripe. Payment-card details are collected by Stripe; our application does not store full card numbers or card security codes.
• Technical and usage information: IP addresses and user-agent information in sign-in records, browser and device information, browser identifiers, page visits and interactions, error reports, and upload progress, timing, retry, and failure information.
• Communications: information you send when contacting us, reporting content, requesting support, or exercising privacy rights.

2. Information inside uploaded files

Photos and videos can identify people and reveal personal or sensitive information. Files may retain embedded metadata, including dates, camera information, and location information. Remove information you do not want to share before uploading.

Upload only content you have the right to provide, and obtain any permission required from the people depicted, the copyright owner, or a parent or guardian. A person appearing in a photo does not automatically have an account with us or agree to every use of that photo.

3. How we use information

We use personal information for the following purposes and only to the extent reasonably needed for those purposes:

We do not sell or rent uploaded photos, videos, or messages, or use them to train artificial intelligence models. We use uploaded content to operate the service. Promotional use requires separate permission; submitting content does not give us a blanket right to use it in advertising.

• Create and administer accounts, send sign-in links, and authenticate hosts.
• Process purchases and refunds and maintain necessary transaction records.
• Receive, store, organize, display, resize, and deliver wedding media and messages, including download archives and sharing chosen by the host.
• Provide support, investigate upload failures and other technical problems, and improve the service.
• Understand use of the website and service through analytics and error monitoring.
• Protect the service, prevent fraud and misuse, respond to complaints, enforce our terms, and meet legal obligations.

4. Hosts, guests, and sharing

The host can view, download, and delete content submitted to their wedding. If the host enables the shared gallery, people with the event link can view the gallery and uploader names. Guest messages are provided to the host. Hosts are responsible for their own collection and sharing decisions and for explaining those decisions to participants.

Event links and QR codes can be forwarded and are not protected by a guest password or verified guest account. A host can disable the guest page. The 'My Photos' feature associates uploads with an identifier stored in the guest's browser; it is not proof of a person's identity. Clearing browser storage or using another browser can change which uploads are associated with that browser.

Recipients can retain copies they download or otherwise save. Deleting content from Guest Gala does not remove copies held by a host, guest, or another recipient. Public posting by a host requires the uploader's permission and any other necessary consent.

5. Service providers and other disclosures

We disclose information to providers that perform functions needed to run the service. These include the following providers, which operate outside Canada, including through entities in the United States. Their infrastructure and subprocessors may operate in additional countries.

Access to content by us and our providers is limited to service purposes such as processing, support, security, and responding to valid legal requests. We may also disclose information where required or permitted by law, to protect rights or safety, or in connection with a merger, acquisition, or transfer of the business, subject to applicable privacy obligations.

• Cloudflare: media storage through R2, media delivery, image transformations, and website delivery and security.
• Stripe: payment processing, transaction verification, and refunds. Stripe receives the information you provide at checkout and may receive your account email and an analytics identifier used to associate the purchase with the service.
• Postmark: delivery of sign-in emails and their associated recipient and delivery information.
• PostHog: website and product analytics, error monitoring, and technical diagnostics, as explained in the next section.
• Google Fonts: delivery of website fonts, which involves requests from your browser to Google.
• Hosting and database providers: operation of the application and storage of account, wedding, message, and other service records.

• Cloudflare privacy policy
• Stripe privacy policy
• Postmark privacy policy
• PostHog privacy policy
• Google privacy policy

6. Cookies, browser storage, and PostHog

We use authentication cookies to keep hosts signed in. Browser storage also remembers a guest's entered uploader name and a browser identifier used for the 'My Photos' feature. These identifiers and preferences can be cleared through your browser settings, but doing so may affect sign-in or the association with previous uploads.

PostHog uses cookies, browser storage, and similar technologies to collect page visits, interactions, browser identifiers, and technical information. For signed-in hosts, we send PostHog the account identifier, email address, and name so activity can be associated with the account. We also send payment and upload diagnostics, including file type and size, timing, progress, retries, and error details.

Depending on the enabled PostHog features, analytics may include session replay, which reconstructs pages and interactions and may include visible page content. We do not promise that all names, messages, or wedding media are excluded from analytics or replay. PostHog processes analytics and diagnostic information separately from our storage of original uploads.

You can use browser controls to restrict cookies and storage, and contact our Privacy Officer about processing choices or withdrawing consent where applicable. Browser controls may not prevent every type of collection. This policy describes our processing; it does not replace any consent that applicable law requires.

7. International processing

Guest Gala is operated from Alberta, Canada, and serves customers internationally. Personal information may be stored or processed outside Canada, including in the United States, where we use providers such as Cloudflare, Stripe, Postmark, and PostHog. We do not promise that information remains in Canada or a particular country.

Information processed abroad may be subject to that country's laws and lawful access by courts, law enforcement, or government authorities. Where applicable law requires safeguards for an international transfer, we are responsible for using the safeguards required for that transfer. Contact our Privacy Officer for information about our overseas-provider policies, processing purposes, and the arrangements applicable to your information.

8. Consent and grounds for processing

Under Canadian privacy law, we collect, use, and disclose personal information for reasonable purposes with the consent required by law or under an applicable legal exception. Consent may be express or implied where legally permitted. You may withdraw consent, subject to legal or contractual limitations; we will explain if doing so affects our ability to provide the service.

Where the EU or UK GDPR applies, processing must have an applicable legal basis. Depending on the information and purpose, this may be performance of a contract with you, compliance with a legal obligation, legitimate interests such as operating and securing the service after considering affected people's rights, or consent where required. Our contract with a host does not automatically provide a contractual legal basis for processing every guest's information. When we act as a processor of guest content for a host, we process it on the host's instructions, subject to applicable law.

9. Retention and deletion

The purchased media-storage period is 12 months from purchase, followed by a 30-day download-only grace period. New uploads end when the 12-month period ends, and wedding media is deleted after the grace period. We do not send storage-expiry reminders. Keep your own copies and download the media you want before the grace period ends.

Hosts can delete individual media and guest messages through the service. Guests and people appearing in content can contact our Privacy Officer about removal or other privacy rights; we may involve the host when appropriate. Already-generated download archives can retain copies until they expire and are cleaned up. Temporary archives have a 24-hour availability period; removal from storage may follow in the cleanup cycle.

We retain account, transaction, support, security, and analytics records only for as long as reasonably necessary for their purposes or as required by law. Relevant criteria include whether an account is active, legal accounting and recordkeeping duties, dispute or fraud investigations, and the need to resolve support issues. Closure of an account does not require destruction of records we must lawfully retain.

We complete eligible deletion from active systems within 30 days of a verified request, or sooner where required by law. Some information may remain in temporary archives, caches, backups, or legally retained records until the applicable cleanup or retention cycle ends. If an exception or lawful extension applies, we explain it. We do not promise immediate erasure from every copy or deletion of copies downloaded by other people.

10. Security

We use reasonable safeguards appropriate to the information and service, including authenticated host access and controls on upload and download requests. No system or method of transmission is completely secure. Protect your email account and sign-in links, share event links carefully, and contact us promptly if you suspect unauthorized access.

We investigate security incidents and provide notifications to individuals and regulators where required by applicable law. Access to a gallery through a shared event link is governed by the host's settings and the limitations described above.

11. Children and younger guests

Host accounts and purchases are for people who have reached the age of majority where they live. Guest uploaders must be at least 16 and have parent or guardian permission where they are below the age of majority or permission is otherwise required. Younger guests should have an adult submit their contributions. Direct uploading by children under 16 is not permitted under our Terms and Conditions.

Wedding media may depict children. The person providing it must have the necessary authority and any required parent or guardian permission. Our age rules for users do not mean that uploaded content never includes children's personal information. If you believe a child has submitted information contrary to these rules or you have a concern about a child's image, contact our Privacy Officer.

12. Your rights and requests

Contact our Privacy Officer using the details below to request access to or correction of your personal information, withdraw consent, request eligible deletion or account closure, or make a privacy complaint. You do not need a host account to raise a concern about information about you. We may request information reasonably needed to verify your identity and locate the relevant records; avoid sending unnecessary identity documents or sensitive information.

Depending on your location and the law that applies, you may also have rights to portability, restriction of processing, objection, information about disclosures, or an appeal of a request decision. Under applicable US state privacy laws, additional rights may include opting out of qualifying sales, sharing, or targeted advertising and using an authorized agent. We assess requests under the law applicable to the processing and explain any refusal or exception. We do not penalize you for exercising applicable privacy rights.

We respond within the deadline required by applicable law, generally within one month for requests under the EU or UK GDPR. Where a lawful extension is necessary, we notify you within the required period and explain the reason. Request response deadlines and the time needed to complete eligible deletion are subject to the applicable legal requirements.

You may complain to the relevant privacy regulator, including the Office of the Information and Privacy Commissioner of Alberta, the Office of the Privacy Commissioner of Canada, the UK Information Commissioner's Office, or the supervisory authority in your EU country, as applicable. Contacting us first can help resolve a concern but does not limit your right to complain to a regulator.

• Alberta privacy commissioner
• Privacy Commissioner of Canada
• UK Information Commissioner's Office
• EU data protection authorities

13. Third-party sites and policy changes

Third-party websites and services have their own policies. Review them when following a link or providing information directly to a third party.

We may update this policy as the service or legal requirements change. The date above identifies the current version. For material changes, we provide additional notice or obtain consent when required by law. A revised policy does not by itself authorize a new use of information for which additional consent is required.

Contact us

Roman Software Inc., Alberta Corporation No. 2026742201

12153 Fort Road NW, Edmonton, Alberta, Canada, T5B 4H2

Privacy Officer and legal contact: [email protected]