Privacy Policy | PhotoWallz

Overview

At PhotoWallz, we are committed to providing a secure, engaging, and premium live photo experience for you and your guests. This Privacy Policy outlines our strict data collection, storage, and protection practices. We believe in total transparency and keeping your information safe.

Information We Collect

We collect only the minimum amount of operational data required to establish and run your event workspace:

Workspace organizers: We collect a workspace name, email address, optional phone number, plan and billing status, and an organizer password stored as a salted cryptographic hash. PhotoWallz does not store or email the readable organizer password.
Guests and contributors: We collect uploaded photos, captions or comments, event identifiers, contributor names when supplied, and basic technical information needed to complete and troubleshoot an upload. The current product accepts photos; it does not advertise video storage.
Verification and security records: We temporarily store hashed one-time verification data, expiring session tokens, password-reset status, and operational logs used to protect accounts and diagnose failures.

How We Use Your Information

The data collected is used strictly to power your live event experience:

To authorize workspace access and prevent unauthorized administrative logins.
To render and display uploaded photos in real time on the event wall and guest gallery selected by the organizer.
To send single-use email verification codes, password-reset links, event communications requested by an organizer, and essential service notices.
To process purchases, apply plan entitlements, moderate uploads when safety filtering is enabled, prevent abuse, and provide support.

Service Providers and Public Event Links

PhotoWallz relies on service providers that process data only to deliver their contracted service. These may include Supabase for database and media storage, Netlify for application hosting and serverless functions, Stripe for card payments, Google Cloud Vision for optional image-safety screening, and configured email or messaging providers. Payment-card details are handled by the payment processor and are not stored by PhotoWallz.

Event upload links and QR codes contain an event identifier and event code. Anyone who receives a working event link may be able to submit photos until the organizer changes or disables access. Organizers are responsible for distributing event links appropriately and obtaining any permissions required for event photography.

Data Storage & Media Security

Organizer sessions are signed and expire automatically. Organizer passwords are salted and hashed using a memory-hard password derivation function. Administrative operations are checked on the server against the authenticated workspace scope. Media intended for an event wall is stored in the configured cloud storage service and may be accessible through generated media URLs, so an event wall should not be treated as a private vault.

Retention depends on the purchased plan and the organizer's settings. Organizers can remove event media and request workspace deletion. Backup, logging, billing, fraud-prevention, or legal records may remain for a limited period when reasonably necessary. Contact support from the application for access, correction, export, or deletion requests.

Changes to this Policy