Privacy Policy

Last updated: October 9, 2026

Galeira ("we", "us", "our") is an event photo-sharing platform — weddings, but also funerals, school events, company offsites, conferences, and more. This page describes what we collect, why, and how to exercise your rights. It is written in plain English because legalese is the enemy of consent.

For region-specific addenda (CCPA / CPRA, UK GDPR, LGPD, PIPEDA, Australia Privacy Act, India DPDP, Japan APPI, South Korea PIPA), see /legal/regions.

1. What we collect

From hosts (the couple paying for the event)

• Email address — for sign-in via magic link and event notifications.
• Event metadata — title, date, slug, plan tier you selected.
• Optional cloud-mirror credentials — encrypted tokens or credentials for connected providers such as Google Drive, Dropbox, or OneDrive. Existing S3 and WebDAV credentials may remain for hosts who connected them before they became unavailable for new connections.
• Payment information — handled exclusively by Stripe; we never store card numbers.

From guests (anyone uploading via your event QR)

• Photos, videos, and voice messages uploaded to the event.
• Optional name entered on the upload page.
• Technical metadata — IP address, user agent, file size, content type, and upload timestamp. This is used to debug uploads and detect abuse.
• Camera metadata (EXIF) — we do not extract or store it. Galeira runs no EXIF extraction on your uploads. (When we build the small preview image we do consult the camera’s orientation flag so the photo is not shown sideways; nothing is read beyond that and nothing is kept.) But we keep your original file exactly as you sent it, so any metadata the camera wrote — including GPS coordinates — stays inside that file, and travels with it when the host downloads the originals or mirrors them to their own cloud. The images shown in a public gallery and lightbox views use metadata-stripped photo copies wherever one has been generated; if a copy is still pending or could not be generated, the original is shown instead. Videos and other non-photo media are not stripped.
• Face-vector data — host-controlled, event-scoped. When a host enables the optional "Find your photos" / face-grouping feature, we compute mathematical face vectors (embeddings) from uploaded photos using Amazon Rekognition. These vectors group guests across an event so each guest can find their own pictures. They are biometric data under GDPR Article 9 / Illinois BIPA / CCPA "sensitive personal information" and are treated accordingly: stored encrypted, used only for that event, never shared, never used to train any model, never matched across events or against third-party face databases. Hosts who turn this on must obtain guest consent before the event — we provide a template wording at /legal/consent.
• RSVP and event-planning answers — optional and host-controlled. A host may ask for attendance, party size, meal and dietary choices (including allergen, kosher, or halal preferences), accessibility needs, arrival or departure details, seating preferences, children's counts or age bands, a music request, contact email, or a free-text note. Some of these answers can reveal health, religious, disability, or children's information. They are collected only for the host's event-planning instructions; the host is the controller for those answers and must obtain any explicit consent required by applicable law. Galeira is the processor and does not use them for advertising, profiling, or model training.

From everyone

• Necessary cookies and browser preferences such as auth_session, locale, private-gallery unlock, OAuth state, theme, and consent preferences. See our Cookie Policy.
• Optional analytics and diagnostics only when analytics consent is granted in the cookie banner, plus strictly necessary server-side security and abuse-prevention logs.

2. Why we collect it

• To provide the service: store and serve photos, send sign-in emails, generate QR codes, run optional cloud-mirror jobs.
• To moderate uploaded content when the host enables the optional AI moderation add-on (Amazon Rekognition for photos only). Without that add-on, uploads are published to the host's gallery without automated screening and can be moderated manually by the host.
• To prevent abuse: rate-limit uploads, detect malicious files, comply with DMCA.
• To improve the service: aggregate, anonymized usage analytics.
• To tell account holders about Galeira — a welcome note after your first sign-in, your year-in-photos recap, a reminder if you left a purchase unfinished, and occasional news about features and plans. We send these because you hold a Galeira account, under the existing-customer rule in Article 13(2) of the EU ePrivacy Directive rather than on consent — so they are on by default. Turn them off at any time under Notification preferences in your account settings, or with the unsubscribe link in every one of them. The newsletter you can sign up for separately is consent-based and carries the same link. Service emails — sign-in links, receipts, security notices, and warnings before anything is deleted — are not marketing and continue regardless.

2.1 What we will NEVER do with your content

This commitment is binding:

• We do not use any photo, video, voice message, comment, or face vector to train any AI model — neither our own models nor any third party's. Amazon Rekognition (used for moderation + the optional face-grouping feature) is contractually configured to discard the source image after the API call returns; we do not include uploads in any training corpus we control.
• We do not sell, rent, license, or distribute your uploaded content for advertising, data brokerage, or analytics-product purposes.
• We do not include guest content in Galeira's marketing without explicit, per-photo opt-in consent from both the host and the uploading guest.
• We do not match face vectors across separate events, against third-party face databases, or for any purpose other than letting a single event's guests find their own photos within that event.

These commitments survive any future changes to this policy: a future revision cannot retroactively re-authorize uses we promised never to do with content uploaded before the revision. If we ever need to expand permitted uses (e.g. a new AI feature), the change applies only prospectively + only with affirmative opt-in.

3. Who we share it with

We use a small set of named processors, each contractually bound by GDPR-compliant data-processing agreements (and equivalent under UK GDPR, LGPD, PIPEDA, etc.):

We never sell your data, and we never use your photos, videos, voice messages, guest lists, or any other content you or your guests upload for advertising, targeting, or building a profile of you. There is no advertising inside Galeira — no ad slots, no sponsored content.

We do advertise Galeira itself on other platforms. On our public marketing pages only, and only with your consent, the Google tag described in our Cookie Policy measures whether an ad click led to a sign-up, and Google may use those signals for remarketing. It never runs on the dashboard, an upload page, an invitation, or any other signed-in or guest-content surface, so it never sees event content. Beyond that, we share your data with third parties only to deliver the service you signed up for, as listed in the table above.

We do not use your photos, voices, or any other content to train AI models — ours or anyone else's.

4. Where data is stored

Primary infrastructure runs in EU regions (Hetzner, Germany — application + self-managed Postgres; Resend eu-west-1). Cloudflare R2 is jurisdiction-agnostic with EU residency available on request.

5. How long we keep it

• Free: Galeira normally retains its copy for 30 days from the first upload, or 90 days when a connected cloud is used. Memorial, baby-shower, gender-reveal, family, and reunion events receive an extended window: 180 days without a connected cloud or 365 days with one.
• New Event & Plus offers: hosted storage is included for 365 days from the event date. Exact deadlines use the event time zone and are recorded before checkout. An existing purchase or gift retains its recorded deadlines; deletion remains subject to the applicable notices, grace process and holds.
• Legacy Event Duo & Account events: the one-year hosted gallery follows the terms recorded for the event, including the applicable warning and grace process. Copies successfully mirrored to a connected cloud remain subject to that provider's storage, quota and deletion rules.
• Legacy Wedding/Forever/Pro plans: retention follows the windows in effect at purchase (e.g. Forever's 5-year archive) — we do not shorten what you already bought.
• Account data: retained as long as your account is active. Deleted within 30 days of account closure.
• Do-not-email list: when you unsubscribe, and when you delete your account, we keep a one-way fingerprint of your email address — not the address itself — so that we never email it again, even if a host later imports it in a guest list. The fingerprint cannot be turned back into your address, is used only to block sending, and is kept indefinitely; re-subscribing marks it withdrawn rather than removing it.

6. Support diagnostics

When you contact support from the app or website, we attach technical context to your ticket so we can help faster — without making you describe your setup. We collect:

• App version and build number, platform, device model, OS version, locale, and theme;
• The route you were on and the last error message you saw;
• The event the request relates to (event ID, title, date, plan) and its storage/backup state and readiness, only when you are the host or a cohost of that event;
• The cloud provider involved (e.g. Google Drive), if any.

We never collect or store your password, OAuth access or refresh tokens, session cookies, magic-link tokens, signed file URLs, or payment card details. Free text and logs you send are scrubbed of anything that looks like a token or secret before storage.

Why: to diagnose and resolve your issue and prioritise time-sensitive, event-day problems. Who can access it: our support and engineering staff only. How long: support tickets and their diagnostics are retained for up to 24 months, then deleted or anonymised; they are removed when your account deletion completes, unless a legal or abuse hold applies. To request deletion of a support ticket, email privacy@galeira.com.

7. Your rights (GDPR, CCPA)

You have the right to:

• Access — request a copy of all data we hold about you.
• Rectification — correct anything wrong.
• Erasure — ask us to delete your account and associated data. Empty events and their stored media are deleted, and their face collections are removed. Events that contain guest uploads or payment history are preserved for the other participants but anonymised: your host identity is severed and the event content remains subject to its event retention window. Ask privacy@galeira.com if an event requires full destruction. The hashed do-not-email entry described in section 5 is retained so a deleted address is never emailed again.
• Portability — export your event in a structured, machine-readable format.
• Object — opt out of any non-essential processing. For Galeira's own emails you do not need to write to us: use Notification preferences in your account settings, or the unsubscribe link in the email, and it takes effect immediately.

Email privacy@galeira.com for any of the above. We respond within 30 days.

8. Children

Galeira accounts may only be created and administered by adults. Events hosted on Galeira — school recitals, family gatherings, sports days — can and do include photos of children. For that content the host (the school, organiser, or family) acts as the data controller: the host is responsible for obtaining parental or guardian consent before photos of minors are collected, and we provide template wording at /legal/consent. Galeira processes that content only on the host's instructions.

For under-16s we apply GDPR-K / COPPA principles: no marketing, no profiling, no advertising use, and no face grouping without explicit parental consent obtained by the host. If a parent or guardian requests removal of a minor's image, we action it within 7 days via /report or privacy@galeira.com.

9. Security

TLS everywhere, hashed credentials, scoped API tokens, principle-of-least-privilege access, and incident response within 72 hours of detection.

10. Changes

If we make material changes, we'll email registered hosts 30 days before they take effect.

11. Abuse, takedowns, and reporting

To report content that violates our rules or your rights, use /report. Reports go to a moderation queue reviewed daily. Priority categories (CSAM, terrorism, non-consensual intimate imagery) get same-day attention; CSAM is additionally reported to NCMEC (US) and the relevant national authority (e.g. NCMEC's CyberTipline, IWF).

12. Contact

Galeira — privacy@galeira.com. Data Protection Officer inquiries: same address, subject line "DPO". EU/UK GDPR Article 27 status and contact: see EU / UK GDPR contact. No named in-region Article 27 representative has been appointed at this time.

This policy was drafted in good faith and reviewed against GDPR / CCPA / CPRA / LGPD / UK GDPR / PIPEDA / Australia Privacy Act / DPDP / APPI / PIPA requirements as of the date above. If you find a gap, email privacy@galeira.com and we will fix it.