Who is responsible
PASAJE 30 S.L. (Spanish tax ID B30326060) operates GuestShoot and is the data controller for the processing described here. Contact us at support@guestshoot.com for privacy questions or to exercise your rights. This policy covers our website, accounts, event pages and support channels.
What data we receive
- Account and contact data: name, email address, authentication details, preferred language and messages you send to us.
- Event data: event details, settings, invitations, co-host access, guest lists, RSVPs, seating information and information entered on an event website.
- Contributions: guest names, photos, videos, captions, comments, guestbook entries and voice messages. Files may contain metadata and information about people appearing or heard in them.
- Purchase data: plan, payment status, billing details and transaction references. Stripe handles card payment details; we do not receive full card numbers.
- Technical data: IP address, browser and device information, logs, security events, cookie choices and, if permitted, usage and campaign attribution data.
Why we use it and our legal bases
- Contract or steps requested before a contract: create and secure accounts, deliver event tools, display and store contributions, process purchases and provide support.
- Legitimate interests: protect the service, prevent misuse, investigate faults, enforce our terms and understand limited, privacy-conscious service use. We balance these interests against your rights.
- Legal obligation: keep records required for tax, accounting, consumer protection and lawful requests.
- Consent: optional analytics and similar technologies, and marketing messages where requested. You may withdraw consent at any time without affecting earlier lawful processing.
Event hosts, guests and visibility
Hosts choose their event's access and sharing settings, invite guests and may download or delete contributions. A link or QR code can be forwarded; password and gallery settings affect who can see content. Guests should review the event before contributing and only upload material they are entitled to share. Hosts may separately decide why they collect guest information and should provide any notices and permissions required for their own event. Please contact the host about their independent use of guest lists, RSVPs or downloaded media.
Where data comes from
We receive data from you when you use the site, from an event host or another guest who invites you or submits information about you, from payment and sign-in providers, and automatically from the device and browser you use. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Who receives data
We disclose data to the host and people allowed into an event according to its settings, and to service providers as needed to run GuestShoot. These include Supabase for authentication and database services, Cloudflare for hosting and media delivery, Stripe for payments, Resend for transactional email, PostHog for product analytics and Microsoft Clarity for optional analytics. Providers act under their own applicable terms and roles; payment providers may also act as independent controllers for their regulated functions. We do not sell personal data or use private event media in advertising without permission.
International transfers
Some providers may process data outside the European Economic Area. Where a transfer requires it, we use an adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses, and assess additional protections where needed. Contact us for information about safeguards relevant to your data.
How long we keep it
We keep account data while the account is active and for a limited period afterwards where needed for legal claims or obligations. Event content is available for the storage period shown for the applicable plan and event; download it before expiry. Hosts may delete it earlier. Billing records remain for statutory accounting and tax periods. Security logs, support correspondence and backups are kept only for the time needed for their purposes and then deleted or anonymised. A deletion request may be limited by a legal obligation or another person's rights.
Security
We use access controls, secure transport, restricted storage access and operational monitoring to protect data. No internet service can promise absolute security. Hosts should protect their account and event access details and choose appropriate sharing settings.
Your choices and rights
Depending on the circumstances, you can request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent. You can withdraw optional analytics consent by clearing the GuestShoot analytics consent cookie and local storage entry, then selecting Reject when the notice reappears. Write to support@guestshoot.com; we may ask for information needed to verify your identity. We generally respond within one month. You may also complain to the Spanish Data Protection Agency (AEPD) or your local supervisory authority.
Children and other people in media
GuestShoot account and purchase features are intended for adults. Event media may include children or other people who have not used the service themselves. The uploader and host must have a lawful basis and any permissions needed to share that material. Contact us if you believe content about you or a child should be reviewed or removed.
Changes and contact
We may update this policy as the service changes. The effective date above shows the current version; material changes will be communicated where required. Privacy questions and requests: support@guestshoot.com.