Privacy notice

Augusto Sanchez Cardarelli is the controller of the personal data collected through Fotini. We decide what data is collected and for what purpose, and we are accountable for its use. You can contact us at augusto.sanchez.cardarelli@gmail.com.

• Account data: email address, display name and, if you sign in with Google, the identifier that provider shares with us.
• Guest data: the name each guest types when joining a roll and an anonymous identifier stored on their device.
• Content: the photos uploaded to rolls and the event details (roll name, limits, reveal mode).
• Technical data: IP address, device and browser type, access and error logs.
• Support: the messages you send us.

• Creating and managing your account and providing the service — performance of the contract.
• Hosting and displaying each roll's photos according to the host's settings — performance of the contract.
• Security, abuse and fraud prevention, and error diagnosis — legitimate interest.
• Product improvement through aggregated metrics — legitimate interest.
• Customer support — performance of the contract.
• Marketing communications, if you subscribe — consent, withdrawable at any time.
• Compliance with legal and accounting obligations — legal obligation.

• Service providers (sub-processors): hosting, database and file storage, email delivery and support tools.
• Paddle.com, our Merchant of Record, for the sale of the product, payment processing, tax compliance and invoicing.
• Professional advisors: legal and accounting, where necessary.
• Authorities: when the law requires us to.

We do not sell personal data or the photos in your rolls.

Our providers may host data outside your country. Where this involves a transfer from the European Economic Area or the United Kingdom, it is carried out on the basis of adequacy decisions or approved standard contractual clauses.

We keep account data while the account is active. A roll's photos and data are kept while the roll exists or until the host deletes them. Technical logs are kept for a limited period for security purposes, and billing records for as long as the law requires. When data is no longer needed, it is deleted or anonymised.

Depending on applicable law, you can request access, rectification, erasure, restriction or portability of your data, object to certain processing and withdraw your consent. Write to augusto.sanchez.cardarelli@gmail.com and we will respond within one month. If you are in the EEA or the UK, you can also lodge a complaint with your supervisory authority.

We apply reasonable technical and organisational measures: encryption in transit, access control and private photo storage, accessible only through temporary links for the host and authorised guests.

We use local storage and essential cookies to keep your session and remember a guest's participation in a roll. We do not use advertising cookies. If we add analytics or marketing in the future, we will ask for consent and you will be able to manage your preferences.

Fotini is not directed at people under the applicable minimum legal age. If we detect a minor's data without authorisation, we delete it.