Privacy Policy

Picture a Moment — Interaktive Event-Foto-Plattform
Peter Fleschurz (Einzelunternehmer)
Gabesstraße 20, 4030 Linz, Austria
E-Mail: office@captureyourmoments.app

As of: July 2026

1. Privacy at a glance

The protection of your personal data is important to us. This privacy policy informs you about what data we collect, how we use it and what rights you have.

The use of our platform is generally possible without providing personal data. Where personal data is collected, this is done on a voluntary basis or is required for contract fulfilment.

2. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR):

Peter Fleschurz
Gabesstraße 20
4030 Linz, Austria
E-Mail: office@captureyourmoments.app

3. Legal bases for data processing

We process personal data on the basis of the following legal grounds:

• Contract fulfilment (Art. 6(1)(b) GDPR) — when processing is necessary for the performance of a contract (e.g. registration, event creation, photo upload).
• Legitimate interest (Art. 6(1)(f) GDPR) — when we have a legitimate interest in processing and your interests do not override (e.g. cookie-less web analytics, fraud prevention).
• Consent (Art. 6(1)(a) GDPR) — when you have consented to the processing. Consent may be revoked at any time.
• Legal obligation (Art. 6(1)(c) GDPR) — when we are legally required to process data (e.g. tax retention obligations).

4. What data we collect

4.1. When visiting the website (automatically)

When you visit our website, the following data is automatically collected by the hosting provider (server log files):

• IP address (anonymised)
• Date and time of request
• Requested page / URL
• Browser type and version
• Operating system
• Referrer URL (previously visited page)

This data is used for the technical provision of the website and is not combined with other data sources. Legal basis is Art. 6(1)(f) GDPR.

4.2. When registering and creating events

When you create an account or set up an event, we collect:

• Email address
• Name (if provided)
• Event name and settings
• Payment data (transmitted directly to Stripe, see section 7.2)

4.3. When participating as a guest

Guests can participate in events without registration (via QR code). The following data is collected:

• Display name (freely chosen)
• Uploaded photos
• Voting data
• Technical access data (see 4.1)

4.4. Photos

Uploaded photos may contain personal data (e.g. depicted persons, EXIF data with location information). Responsibility for the content of uploaded photos lies with the uploading user. The event creator is responsible for informing their guests about the use of the platform and the visibility of photos to other event participants.

5. Storage and deletion

Personal data is only stored for as long as necessary for the respective purpose or as required by statutory retention periods.

• Event data and photos: After the contract ends, the customer has 30 days to download their data. After that, event data and photos are deleted.
• Account data: Deleted when the account is deleted, unless statutory retention obligations apply.
• Billing data: Retained for 7 years in accordance with tax retention obligations.

6. Cookies

Our platform uses only technically necessary cookies that are essential for the operation of the application:

These cookies are essential for the use of the platform and are set without consent (§ 165 para. 3 TKG 2003). No tracking or marketing cookies are used.

7. External service providers (processors)

We use the following third-party providers who process personal data on our behalf:

7.1. Supabase

• Provider: Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992
• Server location: AWS eu-central-1, Frankfurt am Main, Deutschland
• Purpose:Platform provision, storage of user data, photos and event data, authentication
• Legal basis: Art. 6 Abs. 1 lit. b DSGVO
• Although the company is headquartered outside the EU, all data is exclusively processed and stored on servers in the EU (Frankfurt). A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place.

7.2. Stripe

• Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Irland
• Purpose:Payment processing
• Data:Payment data (credit card number, bank details), name, email address, IP address
• Legal basis: Art. 6 Abs. 1 lit. b DSGVO
• Stripe primarily processes data in the EU (Ireland). Where data is transferred to the USA, this is done on the basis of the EU-US Data Privacy Framework.
• Payment data is transmitted directly to Stripe and is not stored on our servers.

7.3. Firebase Hosting

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland
• Purpose:Hosting and delivery of the website
• Data:IP address, technical access data
• Legal basis: Art. 6 Abs. 1 lit. f DSGVO
• Google primarily processes data in the EU. Where data is transferred to the USA, this is done on the basis of the EU-US Data Privacy Framework.

8. Data transfer to third countries

Where personal data is transferred to countries outside the European Economic Area (EEA), we ensure an adequate level of data protection through:

• Adequacy decisions by the EU Commission (e.g. EU-US Data Privacy Framework), or
• Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.

9. Your rights

Under the GDPR, you have the following rights:

• Access (Art. 15 GDPR) — You can request information about your stored data.
• Rectification (Art. 16 GDPR) — You can request the correction of inaccurate data.
• Erasure (Art. 17 GDPR) — You can request the deletion of your data, unless statutory retention obligations apply.
• Restriction (Art. 18 GDPR) — You can request the restriction of processing of your data.
• Data portability (Art. 20 GDPR) — You can request that we provide your data in a commonly used, machine-readable format.
• Objection (Art. 21 GDPR) — You can object to the processing of your data based on legitimate interests at any time.
• Withdrawal of consent (Art. 7(3) GDPR) — You can withdraw a given consent at any time with effect for the future.

To exercise your rights, contact: office@captureyourmoments.app

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with the competent data protection authority:

Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Wien
Telefon: +43 1 52 152-0
E-Mail: dsb@dsb.gv.at
Website: www.dsb.gv.at

10. Security

We take appropriate technical and organisational measures to protect your data, including:

• Encrypted data transmission (TLS/HTTPS)
• Encrypted storage of sensitive data
• Access control and authentication
• Regular security updates
• Server location within the EU (Frankfurt am Main)

11. Changes to this privacy policy

We reserve the right to amend this privacy policy to reflect changes in the legal situation or changes to the service. The current version is always available on this page.