Privacy Policy for Guest.Gallery

Last Updated: 05/11/2026

Thank you for choosing Guest.Gallery. We are committed to protecting your personal information and respecting your privacy. This Privacy Policy outlines how we collect, use, and safeguard your data when you use our services.

Guest.Gallery is operated by Kyca ApS, CVR 45054098, Aage Berntsens Alle 38, 2750 Ballerup, Denmark. Guest.Gallery ApS is a registered secondary name (binavn) of Kyca ApS. Contact: contact@guest.gallery.

If You Are a Guest at an Event

You can open a host's guest page (the link or QR code the host shares) and upload without an account. This section says what we process when you do.

Our role: We are responsible (controller) for our own processing to run Guest.Gallery: storing and showing uploads, keeping the service secure, and sending the reminder e-mail you ask for. The host decides who gets the link and whether guests can see each other's uploads. At a private event, the host's own use of the photos can be a purely personal activity; we remain responsible for our processing on the platform. For questions about a particular event, you can contact both the host and us.

  • When you upload: the photos and videos you choose, stored as your device sends them, including any information your device saved in the file, such as when and where a photo was taken. We also store each file's size, type and capture time and the event it belongs to. We don't ask for your name or e-mail address to upload, and we don't store your IP address or browser details with your uploads. In a shared gallery, anyone with the event's link can download the original file, including that information (for example the place a photo was taken).
  • Your device number: a cookie ("guest_device_id", and a signed copy, "gd") holds a number we give your browser, so it can show you your own uploads and let you delete them. It is not your name, and it stays in your browser for up to 10 years unless you clear it. The page also sets a language cookie ("NEXT_LOCALE", for the visit) and, for 30 days, "gg-country" (the country our hosting provider reads from your IP address) and "gg-currency" (from the page's language, or from that country on English pages), used to show prices in the right currency on our site.
  • Who sees your uploads: the host always. If the host shares the gallery, anyone with the event's link can see them; in a private gallery, other guests don't see them in the gallery. The event's photo wall is always available to anyone with the event's link (the link followed by "/photowall"), also for a private gallery, until the gallery closes; it shows the photos without saying who uploaded them. Our storage, media-processing and hosting providers process the files for us, and if the host orders a photo book or prints, the chosen photos go to our print partner.
  • The reminder e-mail: if the host has turned it on and you ask for it, we store your e-mail address, the event, your language, the time to send and your device number (which links the request to your uploads), and send you one e-mail with the gallery link the next morning, through our e-mail provider (Resend). We don't use your address for marketing or send you anything else. We don't yet delete the request automatically after sending it; write to us and we delete it.
  • Limits against abuse: we briefly use your IP address to limit how many requests one connection can make (in memory or as a hash, for at most an hour), and our hosting provider keeps short-lived request logs.
  • Counting and the "Made with Guest.Gallery" line: the guest page shows no cookie banner and loads no advertising pixels, and your browser sends nothing to our analytics provider (PostHog) unless you have already accepted analytics cookies on our main site. Our servers count guest page views and uploads per event, with no cookie, IP address or identity attached. The page shows a small line, "Made with Guest.Gallery", linking to our website; a visit through it is counted the same way.
  • Why: to provide the gallery you contribute to and keep it secure (legitimate interests, GDPR art. 6(1)(f)), and to send the reminder e-mail because you asked for it (GDPR art. 6(1)(b)).
  • How long: uploads are removed after the event's archive date, as described under Data Retention below.

Your rights: you can ask for access, correction, deletion and restriction, object, and ask to have your data moved. You can delete your own uploads from the same device under "My uploads", and the host can delete them too. Otherwise, write to contact@guest.gallery with the event's link and the files or e-mail address it is about. You can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).

1. Personal Data We Collect

  • Account Information: When you sign up using Google, we collect your email address and any other information provided by Google, such as your name.
  • User Content: Photos and videos you upload from your events.
  • Transaction Information: Payment, billing, and purchase metadata related to your order, subscription status, or event purchase. Payment card details are processed by Stripe and are not stored by us in full.
  • Print Order and Delivery Information: If you buy printed products, we may collect order customization details, selected designs, quantities, event links, QR code destinations, delivery name, delivery address, phone number, email address, shipping status, tracking information, and support messages or photos related to the order.
  • Usage Data: Information about how you interact with our service, including analytics, device, browser, and event interaction data.

2. How We Use Your Personal Data

  • Service Provision: To provide and maintain the service, including account access, event galleries, uploads, downloads, ZIP generation, storage, and archival workflows.
  • Communication: To send important updates regarding your events, purchases, archive dates, login links, or account.
  • Print Order Fulfillment: To produce, review, ship, support, and document printed product orders, including handling delivery questions, freight damage claims, missing or incorrect item reports, and customer support requests.
  • Analytics and Improvement: To analyze usage and improve our platform.
  • Security and Abuse Prevention: To secure the service, prevent fraud or misuse, troubleshoot issues, and enforce our Terms.
  • Marketing: Only if you have expressly opted in to receive marketing communications.

3. Cookies and Tracking Technologies

We use cookies and similar technologies for:

  • Functionality: To ensure our website operates smoothly.
  • Analytics and Measurement: To understand how our site and marketing pages are used (PostHog and Google Analytics). Only with your consent: your browser then sends usage events (such as pages viewed, clicks and errors) to PostHog, which stores an identifier on your device so it can recognise your visits, and we use Google Analytics. Without your consent, your browser sends nothing to PostHog. Whatever you choose, our own servers keep first-party usage statistics (such as sign-ins and purchases) and send them to PostHog. When you sign in, these statistics are linked to your account, and to this browser's PostHog identifier if it has one. Purchases are recorded to count sales (amount, product and the account the purchase belongs to). Whatever you choose, we also note which of our ads brought you to us when you click to buy, start a free trial, or sign up with a login code after following a link to our login page, if the web address of the page you're on names an ad. We note the campaign, ad set and ad numbers, the campaign labels our ads add to their links, and whether the link carried an ad platform's click ID. We never keep the click ID itself. We read this from the page's address at the moment you click. Nothing is stored on your device for it; it travels only in our own page addresses, never in a login e-mail or a Google sign-in, so a sign-up with Google carries no ad reference. When you start a checkout, we keep it with the checkout at Stripe, even if you don't complete it. In PostHog, we keep it with the sign-up, trial, checkout and order events; a checkout without an account is recorded anonymously, and events after you have an account are linked to it. Our legal basis is our legitimate interest in knowing which of our ads work (GDPR art. 6(1)(f)). We don't send this record to Meta, Google or any other ad platform. If you allowed advertising cookies, their tags see our page addresses, which can contain these ad numbers, the same ones that were in the ad's own link.
  • Advertising: To measure and tailor our ads (Meta, Google Ads, TikTok, LinkedIn and OpenAI). Only with your consent. If you gave this consent when you paid, our servers also report new plan orders to Meta and Google Ads; new plan orders, upgrades and extensions to TikTok; and every order to OpenAI, so they can measure which ads lead to orders. Meta, Google Ads and TikTok get the order number, the amount and currency, your email address as a hash (a code the platform can match to one of its own users but can't turn back into your address) and the platform's own ad click ID when present (for Meta, its click and browser cookies); Meta also gets your account ID with us, your IP address and browser type; TikTok also gets your event's gallery link; and OpenAI gets only the order number and the web address of the order's confirmation page, which for print, card and photo book orders includes your event's gallery link.
  • Localization: To tailor content based on your location.

You choose in our cookie banner, and can change or withdraw your choice at any time under "Cookie settings" at the bottom of our pages. We keep your choice in a cookie for up to 12 months and then ask again.

4. Data Sharing

  • Service Providers: We share personal data with service providers only where reasonably necessary to operate, secure, maintain, and improve Guest.Gallery. These recipients may include providers in the following categories: authentication and identity, hosting and database infrastructure, cloud storage and media processing, payment processing, transactional email, print production, fulfillment, shipping and delivery, analytics, and security or fraud-prevention services.
  • Current Provider Examples: Our principal service providers currently include Google, Supabase, Stripe, Cloudflare, Backblaze, Hetzner, Resend, PostHog and Google Analytics. For print orders, we may also share the information needed to produce and deliver the order with relevant production, fulfillment, and shipping partners.
  • Legal Compliance and Protection: We may disclose information where necessary to comply with applicable law, regulation, court orders, or lawful requests from public authorities, or to establish, exercise, or defend legal claims, protect our rights, investigate suspected fraud or abuse, or help keep the service secure.
  • No Sale or Rental: We do not sell or rent your personal data to third parties.

5. Data Retention

  • User Content: Stored until the archive date associated with your plan and selected activation or event date. After that date, content may be retained temporarily while we run archival, ZIP, deletion, recovery, or storage-migration workflows.
  • Account Information: Retained as long as your account is active or as needed to provide services.
  • Order and Delivery Records: Retained as needed to fulfill orders, provide support, document delivery, handle complaints or freight damage cases, prevent fraud, comply with accounting obligations, and establish, exercise, or defend legal claims.
  • Deletion Targets: We aim to remove active media from primary systems shortly after the archive date. In many cases this happens around 14 days after the archive date, but timing may vary.
  • Residual Copies: ZIP files and temporary archival, backup, cache, or recovery copies may remain for a limited period and are generally removed within six months after the archive date, unless a longer retention period is required for legal, security, fraud-prevention, or recovery purposes.
  • Analytics Data: Retained for analysis of user behavior and trends.

6. Your Rights

  • Access and Correction: You can access and update your personal information through your Google account or by contacting us.
  • Deletion: Request the deletion of your personal data by emailing us at contact@guest.gallery.
  • Opt-Out: Unsubscribe from marketing communications at any time.
  • Regulatory Compliance: We comply with GDPR and CCPA regulations, granting you additional rights regarding your personal data.

7. Data Security

We implement technical and organizational measures designed to protect your data:

  • Transmission Security: Data is transmitted over encrypted connections where supported.
  • Provider Security Controls: We rely on reputable infrastructure, storage, and payment providers to help secure hosted data.

8. International Data Transfers

We currently aim to keep core application data and uploaded media on infrastructure configured within the European Union where available.

However, some of the providers we use for email delivery, analytics, payments, identity, support, or security may process or access personal data outside the EU or EEA. Where required, we rely on lawful transfer mechanisms and safeguards such as adequacy decisions, the European Commission's Standard Contractual Clauses, the EU-U.S. Data Privacy Framework, or equivalent safeguards recognized under applicable law.

9. Children's Privacy

  • Age Restrictions: Our services are not intended for individuals under the age of 13.
  • No Collection from Children: We do not knowingly collect personal data from children under 13. If we become aware of such data, we will take steps to delete it.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

11. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at: