Privacy Policy

For accounts, payments and the running of the service, we are the data controller:

• Name: ALTEQ, obrt za razvoj softvera
• Address: Ulica L. Ružičke 42, 10410 Velika Gorica
• OIB: 07350652712
• Email: info@alteq.hr

The couple (the event owner) decides who gets the QR code or link, which photos stay visible and when the gallery is revealed. For the photos and names guests add to a gallery, the event owner decides what happens to them and we store and show them on the owner's behalf.

• Event owners: email address, name and a password. Passwords are stored only as a one-way hash. If you sign in with Google, we receive your email address and name from Google, never your Google password.
• Event details you enter: title, description, date, venue, gallery settings and bingo tasks.
• Guests: the photos they upload, and optionally their name, a short message, hearts (likes) and bingo progress. Guests do not need an account.
• A random visitor ID that your browser generates the first time you open a gallery. It lets us count a guest's uploads and hearts without knowing who they are.
• The IP address of the device that uploads a photo. It is kept with the photo to prevent abuse.
• Payments: card details are handled entirely by Stripe. We only receive the confirmation that an order has been paid for and a payment reference.
• Orders of thank-you cards or table stands: the delivery name, address and phone number you enter at checkout, your email address and the message to engrave on the cards.
• Basic technical data (IP address, browser type, requested page, time) that our hosting provider records in server logs.

We rely on these legal bases under the GDPR:

• To provide the service you asked for (contract): creating accounts and galleries, storing and showing photos, taking payment, making and delivering the cards and stands you order.
• Our legitimate interests: keeping the service secure, preventing spam and abuse (for example limiting how many photos one device can send in a short time) and fixing problems.
• Legal obligations: keeping payment and accounting records as the law requires.
• Consent, where it applies: a guest chooses to upload photos and a name, and can simply not do so.

We do not use advertising or analytics cookies and we do not track you across other sites. We only store what the service needs to work, so no cookie banner is required:

• A sign-in session cookie for event owners.
• A language cookie (captureit_lang) that remembers your language for one year.
• Browser storage on your device: the random visitor ID, the name you typed as a guest, an unfinished event draft and your checklist progress.

We use trusted service providers to run CaptureIt. They process data only to provide their service to us:

• Vercel: hosting of the website and application.
• Neon: the database that holds accounts, events and photo records.
• Cloudinary: storage, resizing and delivery of photos.
• Stripe: payment processing.
• Delivery services: your delivery name, address and phone number, only when you order cards or stands.
• Google: sign-in, only if you choose to sign in with Google.
• Upstash: short-lived counters (IP address and event) used to limit uploads.

We do not sell personal data, show advertising, or use guests' photos to train AI models.

Some providers, such as Cloudinary, Stripe, Google and Upstash, may process data outside the European Economic Area, including in the United States. In that case the transfer relies on an EU adequacy decision (such as the EU–US Data Privacy Framework) or on Standard Contractual Clauses.

• Accounts, events and photos are kept until the owner deletes the event or asks us to close the account. When a plan's gallery period ends, the gallery closes to guests but the photos stay available to the owner.
• When an event is deleted, its photos, hearts, bingo data and IP addresses are deleted from our database and the images are removed from Cloudinary. Backups and caches may hold copies for a short time before they expire.
• Photos an owner has rejected stay stored, hidden, until the event is deleted.
• Payment and order records, including delivery details, are kept for as long as accounting law requires.
• Upload-limit counters expire automatically after a few minutes.

Wedding photos show people. A gallery can be opened by anyone who has its link or QR code, unless the owner holds photos back with moderation or a scheduled reveal. Galleries are not listed in search engines.

If you appear in a photo and want it removed, please ask the couple first: they can reject or delete it from their dashboard. If that is not possible, write to us at info@alteq.hr and we will help.

All traffic is encrypted with HTTPS, passwords are hashed, and owner tools are only available to the signed-in owner of an event. No online service is perfectly secure, but we take reasonable steps to protect your data.

You can ask us for access to your data, to correct it, delete it, restrict or object to its use, receive a copy in a portable format, and withdraw consent you have given. To do so, write to us at info@alteq.hr.

You also have the right to complain to the Croatian Personal Data Protection Agency (AZOP, azop.hr) or to the data protection authority in your own country.

Accounts are meant for adults. We do not knowingly collect personal data from children through accounts. Photos of children that guests upload to a gallery are the responsibility of the event owner and the guests who share them.

If we change this policy in a meaningful way, we will update the date at the top of this page and, where appropriate, tell you in the app.