Skip to content
ESCEvent Snaps Collective
Wedding photo sharingFAQTermsPrivacyhello@eventsnapscollective.comInstallable, never required
Legal

Privacy Policy

Last updated: August 14, 2026

1. What this covers

This policy explains what personal data Event Snaps Collective (“the Service”) collects when you join an event as a guest or run an event as a host, why we collect it, where it's stored, and how you can exercise your rights over it. Event Snaps Collective is built for use at events in the Philippines — weddings, debuts, showers, birthdays, reunions, anniversaries, graduations, corporate gatherings, and similar — and is written with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, “DPA”) in mind.

2. Who controls the data (roles under the DPA)

Two different relationships sit inside one product, and the distinction decides who you should ask for what.

  • For an event's guest data — first names, table numbers, photos, and messages — the event host is the personal information controller. They decide who is invited, what the photo prompts ask for, what stays in the gallery, and what leaves it in an export. Event Snaps Collective is the personal information processor, holding and serving that data on the host's instructions so their gallery works.
  • For our own customer data — the contact and billing details of the person who buys a package — we are the controller.

In practice: ask us about the Service, our storage, and our security; ask the host about who was invited to their event and what they do with the photos afterwards. Where a request reaches the wrong one of us, we will point you to the other.

3. Data we collect

As a guest, joining and using an event collects:

  • The first name you type in to join — shown next to your shots in the host's gallery.
  • A device token — a random identifier saved as a cookie on your phone when you join, used to recognize your browser session on future visits and to prove you're the one allowed to delete your own shots. We store a one-way hash of this token, not the raw value; the raw token only ever lives in your device's cookie.
  • Your table number, if the host has assigned one.
  • The photos you upload, in full resolution, together with: file size, image width/height, file type, the embedded EXIF metadata your phone camera writes into the photo file (which can include the date/time the shot was taken and, depending on your phone's settings, GPS coordinates of where it was taken), and the server-recorded time of upload.

As a host, setting up and running an event additionally involves:

  • the host/event name and date you enter at setup;
  • a hashed copy of your host access token;
  • every guest's name, table number, and photos, as described above, which you as host can view, filter, favorite, and export.

4. Photos may include images of minors

Weddings and similar events in the Philippines commonly include children as guests. Event Snaps Collective does not ask for or verify the age of anyone photographed, and photo prompts are not filtered by subject. If children are photographed through the Service, that is personal data (and potentially sensitive personal information) about a minor, and the DPA's heightened protections for children's data may apply. Hosts are responsible for ensuring guests understand that photos taken at the event — including of children — will be visible to the host in a shared gallery, and for obtaining any parent/guardian awareness or consent that applicable law requires before those photos are collected.

5. Where data is stored

Event, guest, and photo metadata (names, device-token hashes, prompt text, EXIF data, timestamps, and similar fields) is stored in a Supabase-hosted Postgres database. The photo files themselves — both the original full-resolution upload and generated thumbnail versions — are stored in Cloudflare R2 object storage. Guest photos upload directly from your phone to Cloudflare R2 using a short-lived, single-use upload link; the application server itself never receives or handles the raw image bytes.

6. Advertising, tracking, and analytics

Event Snaps Collective does not embed third-party advertising trackers or analytics scripts (no Google Analytics, Meta Pixel, or similar) on guest- or host-facing pages. We do not sell or share your data with advertisers, and we do not use cookies for advertising or cross-site tracking anywhere on this service.

On our public marketing pages only — the home page, FAQ, pricing and sign-up pages, and these legal pages — we use Vercel Web Analytics and Vercel Speed Insights to count page views and measure page load performance. These are cookie-less: they set no advertising identifier, do not follow you across other websites, and are not loaded at all on event, guest, host, or account pages. Their purpose is limited to understanding which parts of our own marketing are used and whether our pages load acceptably.

The third-party infrastructure involved in running this service is Supabase (database hosting), Cloudflare (file storage and, where applicable, CDN), Vercel (application hosting and the marketing-page analytics described above), and Resend (transactional email). Each processes data on our behalf as a service provider under our instructions, not as an independent controller of it.

7. How long we keep data

Two separate things are worth keeping apart here: how long an event stays open, and how long we hold the files.

Every paid package includes an access window — a set number of days after the event date, shown on the pricing page and on the host's own setup page. While it is open, guests can upload and the host can download. Once it closes, new uploads are refused and the bulk ZIP export is switched off. The gallery itself remains viewable, and nothing is deleted at that moment.

Separately, Event Snaps Collective does not automatically delete photos or guest data on a schedule — there is no purge job. Photos and guest records persist until someone actively deletes them:

  • a guest can delete their own shots from the “my shots” page for as long as their device session is active on that event;
  • a host can delete any photo from their event's gallery console.

Deleting a photo removes the original file and its generated thumbnails from Cloudflare R2 and the corresponding database row — this is a permanent action, not a soft hide. Because there is no automatic deletion, hosts should not assume event data disappears on its own after the event; if you want your event and its guests' photos removed, contact us using the details below. Equally, because the access window does close, hosts should export anything they want to keep before it does.

8. Your rights under the Data Privacy Act (RA 10173)

If you're a data subject under the DPA (which includes guests whose photos or name were collected through the Service), you have the right to:

  • Be informed that your personal data is being collected and processed, which this policy is intended to satisfy;
  • Access your personal data held by us or an event's host;
  • Object to, or withdraw consent for, further collection or processing of your data;
  • Correct inaccurate or outdated personal data (for example, a misspelled name);
  • Erasure or blocking of your personal data under the conditions set out in the DPA;
  • Damages for harm caused by inaccurate, incomplete, or unlawfully obtained personal data; and
  • File a complaint with the National Privacy Commission (NPC) if you believe your rights under the DPA have been violated — privacy.gov.ph.

To exercise any of these rights against data held directly by us, contact us using the details in section 11. For data an event host controls (such as asking a specific host to remove your photo from their gallery), you may also need to contact that host directly, since hosts independently control their own event's guest list and gallery.

9. If something goes wrong (breach notification)

If we become aware of a personal data breach that is likely to give rise to a real risk of serious harm to affected data subjects, we will notify the National Privacy Commission and the affected hosts and guests in line with the timeframes the DPA and its implementing rules require, describing what happened, what data was involved, and what we are doing about it. Where we are acting as a processor for a host's event, we will inform that host promptly so they can meet their own obligations as controller.

10. Changes to this policy

We may update this policy as the Service changes or as our legal obligations change. We'll update the “last updated” date above whenever we do. See also our Terms of Service.

11. Contact

Questions about this policy, or requests to exercise your data privacy rights, can be sent to hello@eventsnapscollective.com. Please tell us which event you are asking about and, if you are a guest, the name you joined under, so we can find the right records. We aim to acknowledge requests within five working days and to resolve them within the period the DPA allows.

If your request concerns data an event host controls — for example asking for your photo to be taken out of a particular gallery — contact that host as well, since they decide what stays in their own event. We will help you reach them where we reasonably can.