Privacy policy

Operator and data controller

Adam Cooper Softwareentwicklung

c/o GAM, Pappelallee 64, 10437 Berlin, Germany

mail@in.photo

Website and hosting

Hetzner Online GmbH, Germany, provides website and mailbox hosting in Germany. We use BunnyWay d.o.o., Slovenia (bunny.net), to deliver public website files, including scripts, fonts and illustrative images, through cdn.in.photo. Private collection photos are not delivered through this public CDN. Requests expose IP address, request time, requested file, browser and connection information to the delivery infrastructure. We configure CDN delivery to use EU locations. Public-asset CDN access logs are retained for up to three days with IP truncation; truncation does not make all request data anonymous. Delivery, performance and protection against abuse serve our legitimate interests (Article 6(1)(f) GDPR). When private photo delivery is enabled, a separate Bunny zone at photos.in.photo serves prepared preview copies of photos, without private metadata. We check current access before issuing a signed link to these copies; each link is valid for about an hour, and the zone verifies the link itself instead of asking us again on every request. After sharing is turned off or someone’s access ends, links already issued and copies already in their browser can keep working for about an hour. This zone uses EU-only routing and has request logging disabled. Original files remain private in Hetzner storage; image processing runs in Germany. We have data processing agreements with these providers. For videos, Bunny Stream receives validated video and audio to encode and deliver playback versions. Originals remain in private Hetzner storage in Germany; Bunny playback storage is configured in Frankfurt, with EU-only CDN and edge-script routing. The locations of ingestion, encoding and temporary processing have not been fully verified; EU routing does not establish that every processing step stays in the EU. Video request logging, AI transcription and other AI features are disabled. Our own player does not embed Bunny's player or its telemetry.

Hetzner privacy information · Bunny privacy information

Accounts and access

We process your email address, account identifier, verification status, login tokens and sessions to provide and protect your requested account (Article 6(1)(b) GDPR). If you add a name, or your Google or Apple sign-in shares one, we store it with your account and show it with your contributions to people who can open the collection. You can change your sign-in address in Account settings; we confirm the new address by email, notify the previous address and end your other sessions. Access is currently restricted to approved in.photo accounts; invited guests can use shared collections without creating an account. Providing an email address is voluntary, but an email-based account cannot function without it. We use keyed hashes of email/IP identifiers and short rate-limit windows to prevent abuse (Article 6(1)(f)). Expired rate-limit records are cleaned when further requests are made.

Email, launch notifications and accounts

We process your email, language, request time and consent record for a requested launch notification (Article 6(1)(a) GDPR). Withdraw by emailing us at any time. Login and service requests use Article 6(1)(b); general enquiries and abuse prevention use Article 6(1)(f). MailPace (OhMySMTP Ltd, UK) is the configured email provider and receives recipients, message contents and delivery data when enabled. MailPace stores email data in France and sends through UK servers. UK transfers rely on the European Commission’s adequacy decision (Article 45 GDPR). Messages are retained for up to 30 days, plus seven days in backups. Delivery also involves your chosen email provider. Providing data is voluntary, but email-based features cannot work without your address. A launch notification is sent only after you open the confirmation link and confirm on the page. We record the confirmation time and consent version. Confirmation links expire after 24 hours; merely opening them does not subscribe you.

MailPace privacy information · MailPace data-processing agreement

Contact and correspondence

When you contact us, we process your contact details, message and any attachments to answer you. The legal basis is Article 6(1)(b) for contractual or pre-contractual enquiries, otherwise our legitimate interest in responding (Article 6(1)(f)). Hetzner hosts our mailboxes. Postal correspondence sent to our c/o address passes through our address provider, Dnkfbrk GmbH (Geschäftsadressemieten.com), for receipt and forwarding. This serves our legitimate interest in reliable business correspondence. Please include only information needed for your enquiry.

Photos, videos and sharing

Galleries are private and are not published in a public gallery or directory. The event host decides whether to share the gallery or show photos on an event wall. The host is responsible for informing guests about the intended display and obtaining their consent before showing their photos on the wall. Uploading a photo or entering an event does not by itself establish that everyone depicted has consented. Enabled collections store uploaded photos, original metadata (potentially location), collection names, identifiers and technical image data. Display images remove private metadata, including GPS, capture time and camera details; private originals retain their metadata. Account and requested sharing functions rely on Article 6(1)(b). Photos may depict people who did not upload them: the uploader is the source, and their contract does not itself justify processing everyone depicted. For incidental depictions, we rely on our legitimate interest in facilitating private sharing requested by participants (Article 6(1)(f)), balanced against the rights of those depicted. Upload only photos you are entitled to share and inform the people shown. Contact mail@in.photo to object or request removal. An enabled invitation provides the guest access selected by the host; revocation cannot recall copies already obtained. Gallery access remains private and invitation-based. Enabling sharing grants access to anyone who obtains the invitation, including through forwarding or a displayed QR code. Shared images and the live wall are visible to those participants. We do not use your photos for advertising, facial recognition or AI training. If you are depicted in a photo uploaded by someone else, that uploader is the source of the image and associated information. Please send us the collection reference and enough information to locate a disputed photo; no account is needed to exercise your rights. These sharing rules and the prohibition on advertising, facial recognition and AI training also apply to videos and their audio. Video uploads store the original and technical data such as duration, codecs, dimensions and rotation. Private originals can retain embedded metadata. Encoding creates playback versions; we do not promise that all embedded video metadata is removed. Upload only video and audio you are entitled to share, and inform the people depicted or heard. We store the collection type, occasion, description, planned places and dates you provide to describe the collection and prepare future photobook functions. Where a photo contains GPS, we derive its city or municipality, region and country locally using downloaded GeoNames and Who’s On First reference data. We distinguish containment within a mapped boundary from a nearby settlement and show available translated place names, falling back to the source name. Coverage and accuracy vary; this is not an address or venue service. We do not send the coordinates to an external geocoding service. Derived places remain separate from original metadata and are visible in private Details to the collection owner and the person who added that photo. For enabled beta photo analysis, we send a metadata-stripped preview of at most 1,024 pixels on its longest side and limited collection context to IONOS Cloud GmbH’s AI Model Hub in Berlin, Germany. The context includes the occasion, description, planned places and dates, and the photo’s recorded capture time and approximate place when available. Exact GPS coordinates, raw EXIF, filenames, invitation credentials and contributor identities are excluded from the request fields. The picture itself and text supplied by users can still contain personal information. The analysis estimates visible subjects, activities, smiles, image quality, suitability for a photobook and possible crop regions. It does not identify people, match faces or infer sensitive personal characteristics, and does not make decisions with legal or similarly significant effects. These estimates may be wrong. When you ask us to prepare a photobook, we use saved analysis, dates, likes and image dimensions to suggest an editable arrangement. A bounded text request to the same IONOS service can help group photos and choose layouts, without another image-analysis pass. You can change the photos, order, crops, captions and theme before ordering; no captions or titles are generated. If inference is unavailable, a rule-based arrangement is used. Results are private to the collection owner and the person who added the photo. Processing supports the requested private photo and book-preparation service (Article 6(1)(b)); for other people depicted, we rely on the balanced legitimate interest described above (Article 6(1)(f)). Contact mail@in.photo to object or request removal. IONOS states that prompts and outputs are processed in Germany without persistent content logging, model training or disclosure to model developers; it records request time, model and token counts for service operation and billing. IONOS’s platform data-processing agreement covers this service. Video content and audio are not sent for this analysis. Hosts may configure a welcome form and record a guest's chosen name, answers and acknowledgement of the host's message. Answers stay private to the host unless the host explicitly attaches an answer to a shared caption, subtitle or download filename. We store the exact acknowledgement message, its link and the acceptance time; this is separate from in.photo terms or DPA acceptance and does not create a marketing subscription. When a host enables photo review categories, the same analysis request also estimates visible adult or suggestive content, violence or possible image manipulation. These uncertain estimates assist the host's gallery review; they can be wrong. Flagged photos, unavailable or unclear results, videos and text posts remain pending for the host to review. Pending contributions are visible to the host and their author; hidden contributions are visible only to the host. The host can publish, hide or delete contributions. Nothing is automatically deleted by these checks. Guest download and contribution permissions depend on the host's settings.

Business customers and processing roles

Where a business customer determines the purposes and essential means of event-photo processing and in.photo processes those data solely on its instructions, the customer is the controller and in.photo is the processor. The customer must establish the lawful basis and provide the required information to the people concerned. The legal bases described here for in.photo apply to its own processing as controller, not as a substitute for the customer’s lawful basis. Requests concerning commissioned event data are forwarded to the customer and supported by in.photo; independent legal duties remain unaffected. The linked B2B data processing agreement is currently a review draft. An effective agreement and verified safeguards are required before processing under that arrangement.

Data processing agreement

Cookies and access

Login sessions use a persistent cookie and last up to 180 days, renewed during use with session updates at most once per day. Signing out ends the session on this browser. Clearing cookies, private browsing, expiry or account-security changes may require another sign-in. Guest access lasts seven days; login links expire after 24 hours. Security and login cookies support requested access (§ 25(2)(2) TDDDG; Article 6(1)(b)/(f) GDPR). The page language is set by its URL. When you choose a language, a first-party cookie remembers that choice for 180 days. Closing the language suggestion is remembered in session storage for the current tab session. Without a saved choice, the homepage uses your browser’s language preferences, with English as the fallback. No advertising cookies are implemented. Non-essential storage or device access needs separate consent before activation. A separate HttpOnly cookie remembers your self-declared contributor name in one collection on this browser for 180 days. It does not grant access: you still need a valid invitation. Clearing cookies or using another browser creates a separate identity, even with the same name. You can correct your name. Names and contributions are visible to people with current collection access; account email addresses are never used as guest names. When you request a guest photobook checkout, a separate HttpOnly cookie identifies your purchases in that collection on this browser for 180 days. Only its hash is stored server-side. It does not grant collection access: a valid invitation is still required. Clearing cookies or using another browser loses access to this browser's in.photo order history; Peecho's purchase confirmation is separate. Shared books are visible to people with collection access, while a member's personal book is private to its creator. Account or collection erasure removes personal drafts and applicable purchaser credentials; a shared print file remains until all dependent checkouts and retention periods permit its removal.

Diagnostics and audience measurement

Self-hosted GlitchTip and operational monitoring receive filtered errors, logs and performance data to keep the service reliable (Article 6(1)(f)). Enabled Umami counts homepage visits using a temporary random identifier; no photos, email, real visitor IP or browser user-agent are forwarded to Umami. DNT/GPC signals are respected. This limited measurement serves our legitimate interest in understanding homepage use (Article 6(1)(f)). You can object using DNT/GPC or by contacting us.

Retention

We retain launch signups until the requested notification is sent, consent is withdrawn or the launch plan is abandoned. Accounts and photos are retained while needed for the requested service; request deletion at mail@in.photo. There is no automatic deletion on logout or invitation expiry. Enquiries are retained until resolved and any necessary follow-up ends. Operational logs: 14 days; traces: seven days; errors and metrics: 30 days. Necessary legal obligations or specific legal claims may require restricted further retention. Collection owners can remove individual photos. Removal blocks further downloads immediately. Browsers may reuse previously downloaded photos for one hour without another download; downloaded or saved copies cannot be recalled. Background tasks delete the stored files and clear the private CDN cache, retrying failures. Temporary upload files expire after one day as a cleanup backstop. You can delete your account in Account settings. After you confirm by email, your account and the collections you host are locked for seven days; signing in during that time cancels the deletion. Afterwards we delete your account, the collections you host with everything in them, including photos and videos others added, and your name, comments, guestbook entries and reactions elsewhere. Photos and videos you added to other people’s collections stay there without your name and keep their embedded file details. Files and caches are removed in the background, usually within two days. A minimal deletion record (a random account identifier and dates, no name or email address) is kept for three years so that the deletion can be repeated if data are ever restored. You can also request deletion at mail@in.photo. Homepage event records have no automatic expiry in the current analytics system. Their continued need and removal must be assessed separately from the time-limited operational logs. Any longer retention for legal claims is restricted to the information needed for that claim (Article 6(1)(f)); mandatory legal retention uses Article 6(1)(c). Unconfirmed launch requests have no automatic deletion deadline. They remain excluded from launch notifications, receive no automatic reminders and can be removed on request at mail@in.photo. Video owners can also remove individual videos. New playback requests are then denied, and background cleanup removes the original and Bunny playback copies with retries. Already buffered or downloaded video cannot be recalled; browsers may cache delivered playback data privately for one hour. Collection owners can also permanently delete an entire collection by typing its name in Collection details. This removes everyone's photos, videos and contributions. Access ends immediately; stored files, CDN copies and archives are removed in the background with retries. Existing upload grants may remain valid until expiry, but cannot publish to the deleted collection. Already saved or cached copies cannot be recalled. A minimal collection deletion record (random collection identifier and deletion dates, no collection name or content) is kept for three years to repeat deletion after a backup restore. Derived places are removed with their photos. Photo-analysis results are retained with the photo and removed when it is deleted. Analysis jobs hold previews in memory, without saving a separate inference copy. Billing records contain usage, costs and status, not photo or prompt content. Links from these records to a photo are removed on photo deletion or after 90 days; anonymous accounting totals remain for cost control. Requests already in progress may complete after deletion, but their results are not made available. Editable book documents remain with the collection. Temporary book-planning snapshots are cleared when preparation completes or fails. Planning billing records use the same content-free accounting; links to a collection are removed on collection deletion or after 90 days.

Your rights

Subject to the GDPR conditions, you may request access, correction, erasure, restriction and portability. You may object on grounds relating to your situation to processing based on legitimate interests, and to direct marketing at any time. Withdrawal of consent does not affect earlier lawful processing. Contact mail@in.photo. We normally respond within one month. You may complain to a supervisory authority, especially where you live, work or the alleged infringement occurred. Our supervisory authority is Berliner Beauftragte für Datenschutz und Informationsfreiheit. We make no solely automated decisions with legal or similarly significant effects. Requests are free unless the GDPR permits a fee or refusal. We may ask for proportionate information to verify identity. For complex or numerous requests, the GDPR permits an extension of up to two further months; we will explain any extension within the first month.

Berliner Beauftragte für Datenschutz und Informationsfreiheit