Privacy

1. Controller and contact

Leo Grützner, Motzstr. 27, 10777 Berlin, Germany. For privacy enquiries and to exercise your rights, contact: [email protected].

The event organizer is also responsible for taking, uploading and sharing the event photos. Where we process this data on their instructions, we act as a processor. The respective roles and legal basis must be clarified before using the service for an event.

2. Website, hosting and contact

Connection data is processed to deliver and secure the website, including IP addresses, timestamps, requested addresses, browser information and technical errors. The hosting provider is 1blu; information about its processing is available in the 1blu privacy policy. The application and face search run on our own server installation; search images are not sent to an external AI API provider.

Providing and securing the website is based on Article 6(1)(f) GDPR (legitimate interest in a functional and secure service). We process email enquiries to respond under Article 6(1)(b) or (f) GDPR. Your email provider and ours process the message and connection data.

Fonts and sample images load directly from this website. No external font providers, advertising pixels or analytics services are embedded on page visits. External links connect you to the respective website only when clicked.

3. Accounts, galleries and photos

For an organizer account, we process names, email addresses and a password hash. For an event, we store the supplied event details, access credentials, photos, previews and, where provided by the organizer, guest details and portraits. This data enables the requested gallery, its management and photo delivery (Article 6(1)(b) GDPR for using the service). The organizer must ensure a valid legal basis for the data and photos of everyone depicted and inform them.

A gallery is accessible to people with its link and, where required, its password or a personal guest link. People with access can also view and download photos of other guests. Share links, passwords and personal guest links only with the intended recipients.

Payments and billing

When you select a paid plan, we redirect you to Stripe checkout. Stripe processes your payment details, billing address and, where applicable, tax identification details, issues invoices and calculates applicable taxes. We store Stripe customer and transaction identifiers and payment and subscription status to provide your plan; full card details are not stored on our server. The legal basis is contractual performance (Article 6(1)(b) GDPR) and statutory retention obligations. More information is available in the Stripe privacy policy.

4. Face search and biometric data

When preparing a gallery, the software detects faces in uploaded photos and creates mathematical facial characteristics. These are compared with an uploaded search portrait or a selected face to find matching photos within the event. These characteristics may constitute biometric data for unique identification under Article 9 GDPR.

In addition to a legal basis under Article 6 GDPR, this processing requires an exception under Article 9(2) GDPR, generally the explicit, informed and freely given consent of the person concerned under Article 9(2)(a). A cookie notice does not replace this consent. Organizers must ensure the necessary conditions for everyone concerned before uploading and analyzing faces. Another person’s portrait may only be used with appropriate authorization.

In general portrait search, the uploaded search image is sent to the server for analysis. The resulting search characteristics are stored for repeat searches. “Clear portrait search” removes this stored search identity. In personal guest galleries, the guest portrait and search characteristics may remain stored until the guest or event is deleted.

The general gallery can be viewed without uploading a portrait. Searches may produce incomplete or incorrect results. No solely automated decisions with legal or similarly significant effects under Article 22 GDPR are made.

Referral links

When you open a referral link, we store its code for up to 30 days in a signed cookie (lumen_referral). When a new account is created, we attribute it to the first valid referral. The referrer sees your name, the signup date, and whether a first qualifying purchase triggered the commission stage. Your email address is not shown. The feature currently measures referrals only; no commissions are paid. The attribution stays until one of the accounts is deleted.

5. Cookies and browser storage

We use only functional storage for features you request. No cookie consent is required for this under Section 25(2)(2) TDDDG. The small notice provides information; “Got it” is not consent to tracking.

Depending on the feature, functional processing of personal data is based on Article 6(1)(b) or (f) GDPR; biometric data is additionally subject to the conditions in Section 4. You can delete or block cookies and website data in your browser. Sign-in, saved selections and gallery unlocking may then not work as expected.

6. Recipients and transfers

Access is provided to authorized gallery recipients, the organizer and technically necessary hosting and, where applicable, email providers. Operator access takes place where necessary for operations, support or legal obligations. No data is transferred to advertising or analytics networks. Normal gallery operations do not involve transfers to an external AI service. Processing by email providers depends on the provider; please do not send unnecessary sensitive images or data by email.

7. Retention and deletion

Gallery availability follows your plan: Free galleries are available for six months from first publication, Single Event galleries for 365 days from first publication, and Organizer galleries while the subscription is active. After an Organizer subscription ends, Free limits apply. Expiry of access does not by itself mean that stored photographs, previews, portraits or facial characteristics have been deleted. Organizers can delete galleries when they are no longer needed. Account data is retained for account use; deletion can be requested by email. Data required for statutory obligations or legal claims may be retained with restricted use.

Deleting data from the server does not remove copies already downloaded or images previously cached in a browser. Technical logs and backups may be subject to the respective provider’s retention periods. For information about a specific gallery and its deletion, contact the organizer or the address above.

8. Your rights

Under the GDPR, you have rights including access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18) and data portability (Article 20), subject to the applicable conditions. For processing based on legitimate interests, you may object on grounds relating to your particular situation (Article 21). You may withdraw consent at any time with future effect; the lawfulness of prior processing remains unaffected.

Contact [email protected] and, for event photographs, the organizer as well. We generally respond within one month. Reasonable identity verification may be required to identify the relevant data.

You may complain to a data protection supervisory authority, particularly where you normally live, work or believe a violation occurred. For the operator, you can contact the Berlin Commissioner for Data Protection and Freedom of Information .