Data processing agreement
Last updated 4 September 2026
1. What this covers
This agreement is part of the terms of service and applies when you run an album for a business. For the photos, videos and voice notes your guests upload you are the controller; the company named in the legal notice processes them on your behalf under Art. 28 GDPR. Where the two documents disagree about processing, this one decides.
2. What we process, and why
We process what your guests upload — photos, videos, voice notes — together with the technical data that arrives with them, for one purpose: running the album you created. The people concerned are you as the host and the guests you invite. The processing lasts as long as the album does.
3. What we undertake
We process personal data only on your documented instructions. Everyone with access is bound to confidentiality, we keep the technical and organisational measures Art. 32 GDPR requires, we help you answer a guest who exercises their rights, and we tell you without undue delay once we learn of a personal data breach.
4. Sub-processors
You authorise these sub-processors: Spaceship, a Namecheap brand (our servers, in Phoenix, Arizona, USA), Cloudflare (media storage and the voice transcription), Stripe (payment), Resend (email), Google (sign-in, analytics, advertising) and PostHog EU (product analytics). Each acts under a processing agreement with us. We announce any change to this list before it takes effect, and you may object to it.
5. Where the data is
Our servers stand in the United States and media is stored at Cloudflare, so guest media leaves the EEA and the United Kingdom. Those transfers rest on Chapter V GDPR: the EU standard contractual clauses agreed with each provider, the EU-US Data Privacy Framework where that provider is certified, and the supplementary measures those safeguards require.
6. Deletion, and proving it
Albums are deleted at the end of their retention window, and yours is deleted earlier if you ask. Download the originals first — deletion is permanent and takes the copies with it. We keep only what the law obliges us to keep, and we answer questions about these measures in writing.