Privacy policy

1. Controller

The controller responsible for processing personal data on this website and in the customer account is:

If you have any questions about data protection, you can reach us at any time at the e-mail address above.

2. Overview: two roles

pic2gether is a service for live photo galleries at events. Our customers are businesses such as photo booth operators, photographers, wedding planners, venues, DJs and event agencies as well as private individuals who book a gallery for their own celebration (together “providers” or “organisers”). We process data in two different roles:

• As controller: for our customers’ data (providers) – customer account, orders, payments, e-mails – and for visits to this website.
• As processor: for the photos and data in the event galleries. The provider who booked the gallery is the controller. We process this data only on their instructions under a data processing agreement (Art. 28 GDPR, see the annex to our terms). If a private individual books a gallery for a purely private celebration, their own use usually falls under the exemption for purely personal or household activities (Art. 2(2)(c) GDPR); even then, we process the photos and data only on their behalf and only to provide the service.

If you were a guest at an event, please contact the provider (e.g. photo booth operator or photographer) or the hosts first with any questions about photos. We are happy to support them.

3. Hosting and server logs

This website and the database are hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The server is located in Frankfurt am Main, Germany. We have a data processing agreement with Hostinger.

The photos and videos of the galleries are stored in the object storage of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The storage location is Nuremberg, Germany. When you view a gallery, your browser loads the images directly from there; Hetzner processes technically necessary connection data such as your IP address. Logos, cover images and guest book photos remain with Hostinger. We have a data processing agreement with Hetzner. All data therefore stays within the EU.

If the organiser has turned on the check for inappropriate content, we send a reduced preview of the photo as well as the text, name and photo of guest book entries to the Sightengine service (sightengine.com) after upload. It automatically checks whether content contains e.g. nudity or insults; detected content is not shown in the gallery until the organiser approves it. No other contact details are transmitted. Sightengine processes requests in data centres in the EU but may also process them in Canada or the USA; such transfers are governed by the data processing agreement with Sightengine. The legal basis is our legitimate interest and that of the organiser in not publishing inappropriate content (Art. 6(1)(f) GDPR).

When you visit the website, the server processes technically necessary data: IP address, date and time, requested address, browser identifier and amount of data transferred. This is necessary to deliver the website and keep it secure (Art. 6(1)(f) GDPR – legitimate interest in secure, stable operation). Logs are kept by the host for a short time only.

To protect against misuse (e.g. too many login or PIN attempts, excessive uploads), our server briefly counts requests per IP address in memory. These counters are not stored permanently and are discarded after 24 hours at the latest or on restart (Art. 6(1)(f) GDPR).

4. Customer account and orders

When you register and buy galleries, we process:

• name, company (optional), e-mail address and password (stored only as an encrypted hash),
• your chosen language,
• if two-factor login is enabled: the secret key for the codes of your authenticator app,
• redeemed coupons (code, discount, time),
• your galleries with title, date, duration and settings,
• order and payment data (amount, date, payment status, invoice link) – but no card data.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). We store the data as long as your account exists. Payment and invoice data is kept for seven years due to statutory retention obligations (§ 132 Austrian Federal Fiscal Code, Art. 6(1)(c) GDPR).

Demo: If you use “Try the demo”, you get an anonymous test account without an e-mail address. It is automatically deleted with all uploaded photos after 24 hours – or immediately with “End demo”.

5. Payments via Stripe

Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your payment details directly with Stripe; we do not receive them. We share your e-mail address, the amount and a description of the order with Stripe; you enter your billing address, company name and, if applicable, VAT ID directly with Stripe, which issues the invoice. For a plan, Stripe stores the payment method for the recurring payments; we only receive the plan status from Stripe (e.g. active, cancelled, end of period).

Stripe may also transfer data to the USA on the basis of the EU-US Data Privacy Framework or the EU Commission’s standard contractual clauses. The legal basis is Art. 6(1)(b) GDPR. More information: stripe.com/privacy.

6. E-mails

We only send you e-mails that belong to the service: purchase confirmations, reminders before a gallery is deleted, confirmations about your plan, reminders before a (former) Pro membership expires and password reset links. E-mails are sent via our mailbox at Hostinger. There is no newsletter. The legal basis is Art. 6(1)(b) GDPR.

A few days after an event we ask you by e-mail – at most once per event and at most every 60 days – to review our service on Trustpilot. You can object to this at any time via the link in each of these e-mails or informally by e-mail to us. The legal basis is our legitimate interest in feedback on our service (Art. 6(1)(f) GDPR, § 174(4) TKG 2021). No data is transferred to Trustpilot when you visit our website; displayed reviews are copied by us.

7. Event galleries and photos (processing on behalf)

In the galleries we process, on behalf of the respective provider:

• photos uploaded by the provider (e.g. from the photo booth or camera) and photos uploaded by guests – in preview and original size. Original files may contain metadata (e.g. time taken, camera model and, for phone photos, possibly the location).
• for guest uploads: the name entered voluntarily and a random device identifier (to limit the number of uploads); if approval is switched on, also the status “awaiting approval” or “approved”,
• likes with a random device identifier so that each photo can only be liked once per device,
• for photo challenges: which task a guest photo was uploaded for,
• on the preview page before the event: the cover image uploaded by the provider and their message to the guests; the cover image is deleted when the gallery expires,
• in the guest book (if the provider turns it on): name, text and possibly a photo of the entry as well as a random device identifier (to limit the number of entries). Entries are visible to all guests with the gallery link – if review is on, only after approval – and can be deleted by the provider and the hosts at any time,
• for automatic sorting (if turned on): a sharpness value and a short image fingerprint per photo. Both are calculated on the uploading device from the preview image and do not allow conclusions about people; no face recognition takes place,
• for the upload app on the provider’s PC: file name, folder, time taken and regular status messages (time, app version). No other data from the PC is transmitted.

Galleries are not public: they can only be reached via a random link that cannot be guessed, are blocked for search engines, and the host view is additionally protected by a PIN. If the gallery link is shared in a messenger (e.g. WhatsApp), it shows a neutral preview image by default. Only if the provider turns it on for their gallery does the messenger fetch the most-liked photo as the preview.

For the statistics in the customer area we count views and downloads of a gallery – only as a number, without data about visitors. If the provider sends the host access by e-mail, we store this address to inform the hosts about new guest photos awaiting approval.

The provider decides per gallery whether guests may like or download photos; downloads for guests are switched off by default. If downloads are switched on, guests can save photos to their device. Neither we nor the provider have any control over these copies; they are not deleted when the gallery is deleted. Guests may only publish downloaded photos showing other people with those people’s consent. With their PIN, hosts can delete photos, empty the trash and download all photos as a ZIP.

Deletion: a gallery is automatically deleted with all photos and guest book entries when the booked period ends (20 or 30 days from the start of the event). Individual photos deleted by hosts or providers first go to the trash and are permanently removed with “Empty trash”, or at the latest together with the gallery.

8. Cookies and browser storage

We only use technically necessary cookies and browser storage – no analytics, tracking or advertising cookies. No consent is required for this (§ 165(3) Austrian Telecommunications Act 2021).

• Login cookie: keeps you logged in to the customer area; deleted when you log out.
• Language cookie “lang”: remembers your chosen language (German/English) for one year – also when you open a link with “?lang=en” or “?lang=de”.
• Browser storage (local/session storage) in the galleries: access key after entering the PIN, the random device identifier for likes, uploads and guest book entries and, if applicable, the name entered for uploads or in the guest book. This data stays on your device and can be deleted at any time in your browser settings.

9. Fonts

All fonts (including the gallery fonts chosen by customers) are served exclusively from our own server. When you visit our pages, your browser does not connect to Google or any other font provider, and no data is passed on to third parties in the process. Our server downloads the openly licensed font files once and stores them on our side.

10. Recipients

Your data is only received by: our host Hostinger (website, database, e-mail delivery), Hetzner (photo storage), Sightengine (check for inappropriate content, if turned on), Stripe (payments). Data is never passed on for advertising purposes. Photos in galleries can only be seen by people to whom the provider or hosts give the link or PIN.

11. Data security

All connections are encrypted via TLS. Passwords are stored only as a secure hash. Links to photos are signed and time-limited. Access to galleries is protected by random links, PINs and a lock after repeated wrong entries.

12. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR). Simply send us an e-mail.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority. In Austria this is the Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

13. Changes

We update this privacy policy when the service or the legal situation changes. The version published here applies.