Privacy policy

Who is responsible?

Shared Moments is operated by Nourhair Aslo, Liljevalchsgatan 41, 151 45 Södertälje, Sweden. Email: info@sharedmoments.se. Phone: +46 76 407 43 19. We are responsible for account management, operation, support and payment administration.

The host decides whom to invite and whether to enable the guest gallery. For private events we provide storage and sharing within that group. An organisation or professional organiser may instead be the controller of event content and we its processor. Contact us before such use to establish the roles and any required data processing agreement.

Information and purposes

At registration we record the time, wording and version of your acceptance of the terms. The newsletter is optional and not preselected. If chosen, we record your request and consent wording and version, and send a confirmation email. News and offers may only be sent after email confirmation. Unsubscribe through a marketing email or Email and reminders. Withdrawal stops future marketing without affecting the account or past lawful processing.

Service reminders before the final event download date help us provide the service and are separate from marketing. Disable them in Email and reminders. Delivered message copies are removed from the new mail queue after 30 days. Older consent history is deleted after consent has been withdrawn for at least two years. Provider logs follow their own retention periods.

Account name, email, password hash and login information enable accounts and password recovery. Event name, date, timezone, host names, welcome text, card design and optional cover image enable the ordered service. The legal basis is our contract with the account holder.

Guest photos, videos, optional uploader name, filenames, types, sizes and timestamps enable event sharing. Original files may contain location and capture-time metadata; remove it before uploading if you do not want to share it. For our processing at private events we rely on legitimate interests: hosts and guests sharing memories within a limited group. You can object and request removal.

Plan, amount, currency, payment time and references enable payment and complaints handling, based on contract and applicable accounting obligations. Stripe processes card information; we do not store complete card numbers.

IP addresses, browser details, sessions, error logs and support messages may be used for security and troubleshooting, based on legitimate interests in secure operation and support, or a legal obligation where applicable. Withdrawal requests include contact details, contract reference and receipt time.

Who can access content?

The host can view and download uploads. If the guest gallery is enabled, anyone with the event link or QR code may also view them. Guest links do not require login. Share them only with intended guests; recipients can forward links and save copies.

Only upload content you have the right to share. Respect people who do not wish to appear, take special care with children and avoid sensitive or offensive content. We do not use customer event photos in advertising without separate permission or sell that content.

Providers and international transfers

Render provides the app and database, Cloudflare R2 stores files, Resend sends service emails, Stripe processes payments and one.com hosts our contact mailbox. They receive information needed for those functions. Stripe may also act as a controller for fraud prevention and legal obligations.

Our web server and database on Render are located in Frankfurt, Germany. Uploaded photos, videos and cover images are stored in a Cloudflare R2 bucket with EU jurisdiction. These storage locations do not mean that all processing by providers and their subprocessors takes place within the EU/EEA.

Resend stores email data in the United States, including recipient email addresses, message content and delivery logs. Selecting a European sending region does not change where this data is stored.

Providers and subprocessors may process information outside the EU/EEA, including the US. Transfers require a valid mechanism, such as an applicable adequacy decision or EU standard contractual clauses and any necessary additional safeguards. Contact us for information and copies of the safeguards applicable to your data.

Retention

Uploads and downloads end at midnight on the event date plus 30 calendar days in the event timezone. Download your copies before then. Changing the date changes this deadline. Files and the cover image become due for scheduled deletion; deletion is not guaranteed exactly at midnight and technical failures can delay it. An event without a date has no calculated automatic deadline: add a date or contact us for deletion.

Account information remains for the account until closure or when no longer needed. Deleting media does not automatically delete the account, event record or all file metadata. We limit such retention to operational, support, legal-claim and legal requirements and handle it when responding to deletion requests. Accounting records are retained for the legally required period where applicable.

Backups and provider logs may remain after removal from the active service until their retention period expires. Copies downloaded by hosts or guests are outside our automatic deletion. Contact us about a particular copy.

Your rights

Contact info@sharedmoments.se with the event link and your request. Do not send passwords, card details or unnecessary identity documents. We may need enough information to verify identity and locate content. We normally respond within one month and explain any permitted extension.

You may request access, correction, erasure, restriction, objection to legitimate-interest processing and, where applicable, portability. Consent can be withdrawn where processing relies on it without affecting previous lawful processing. Rights have exceptions, including legal retention. You may complain to the Swedish Authority for Privacy Protection at www.imy.se or your local EU/EEA supervisory authority.

We do not make automated decisions with legal or similarly significant effects. Account and payment details are required for purchases; guests need no account and uploader names are optional. See the cookie information for browser storage.