Capture Snaps
Last Updated: August 18, 2026
This Privacy Policy explains how Capture Snaps ("we", "us", "our", or "the Service") collects, uses, stores, shares, and protects personal data when you use the Capture Snaps desktop application, phone upload web interface, online slideshow, and admin dashboard.
We are committed to protecting your privacy and handling your data responsibly. This policy applies to all users of the Service, including event operators and event guests.
1. Who We Are
Capture Snaps is a photo booth monitoring and event management platform. For the purposes of data protection law, we act as a data processor on behalf of event operators (who act as data controllers) for guest-uploaded content. For operator account data and subscription management, we act as the data controller.
Contact:
Capture Snaps
Email: james@capturesnaps.com
2. Information We Collect
2.1 Operator Account Data
When you use Capture Snaps as an operator, we collect and store:
- Stripe Customer ID and subscription status
- Device and instance identifiers used for licence validation
- App settings and preferences (print configuration, upload settings, cache preferences)
- Integration credentials for optional connected services (stored locally on your device)
2.2 Event and Media Data
When you create and manage events, we process:
- Event metadata (names, event codes, dates, scheduling, and configuration)
- Uploaded and captured photos, including generated derivatives (thumbnails, composites)
- Upload metadata (timestamps, source identifiers, device fingerprints, moderation status, print status)
- Event admin passwords (stored as hashed values, never in plain text)
2.3 Guest Upload Data
When event guests upload photos via the phone upload interface, we process:
- Uploaded image files
- Technical metadata required to process the upload (device/session identifiers, timestamps)
- Background removal selections (where enabled by the operator)
We do not require guests to create accounts and do not intentionally collect guest names, email addresses, or other personal profile information through the upload interface.
2.4 Automatically Collected Technical Data
- Local operational logs generated for troubleshooting (stored on-device only)
- Subscription validation requests (containing licence and device identifiers)
3. Legal Basis for Processing (GDPR / UK GDPR)
We process personal data on the following legal bases:
| Purpose | Legal Basis |
|---|---|
| Providing the Service and core functionality | Performance of a contract (Article 6(1)(b)) |
| Subscription validation and billing | Performance of a contract (Article 6(1)(b)) |
| Security, abuse prevention, and fraud detection | Legitimate interests (Article 6(1)(f)) |
| Optional third-party integrations | Consent (Article 6(1)(a)) |
| Compliance with legal or tax obligations | Legal obligation (Article 6(1)(c)) |
Event operators are responsible for establishing their own legal basis for collecting and processing guest photos and data at their events.
4. How We Use Your Data
We use collected data to:
- Provide, operate, and maintain the Service
- Enable event creation, phone uploads, photo moderation, gallery management, slideshow display, and printing
- Validate subscription status and enforce plan limits
- Process and deliver optional cloud integrations you enable
- Protect the security and integrity of the Service
- Respond to support requests and deletion enquiries
- Comply with applicable legal obligations
We do not sell your personal data. We do not use your data for advertising or profiling.
5. Where Your Data Is Stored
5.1 Local Storage (Operator Device)
The desktop application stores operational data locally, including preferences, cached files, and runtime state.
Sensitive credentials for integrations are encrypted using the operating system's secure storage (e.g. Windows Credential Manager, macOS Keychain) where available.
5.2 Cloud Storage and Backend
| Provider | Location | Purpose |
|---|---|---|
| Supabase | AWS (US regions) | Database, backend APIs, authentication, fallback media storage |
| Cloudflare R2 | Global (nearest region) | Primary media and asset storage |
5.3 Billing
Subscription checkout and billing are handled by Stripe. We store subscription-related identifiers required to validate access and manage entitlements. We do not store credit card numbers or payment details directly.
6. International Data Transfers
Your data may be processed in countries outside the UK or European Economic Area (EEA), including the United States, where our cloud infrastructure providers operate.
Where personal data is transferred internationally, we rely on:
- Standard Contractual Clauses (SCCs) adopted by the European Commission
- UK International Data Transfer Agreements (IDTAs) where applicable
- Adequacy decisions where available
By using the Service, you acknowledge that your data may be transferred to and processed in these regions.
7. Third-Party Services
Capture Snaps connects to the following third-party providers:
| Service | Purpose | Data Shared |
|---|---|---|
| Stripe | Subscription billing and customer portal | Customer ID, subscription status |
| Supabase | Database, APIs, and storage | Event metadata, upload records, media files |
| Cloudflare R2 | Primary media storage | Photos and generated assets |
| SmugMug (optional) | Media sync | Photos synced by operator |
| Dropbox (optional) | Media sync | Photos synced by operator |
| Resend | Transactional email delivery | Customer ID, email address |
Each third-party service operates under its own terms and privacy policy. We encourage you to review them.
8. Data Retention
| Data Type | Retention Period |
|---|---|
| Local app data and preferences | Until the app is uninstalled or data is manually cleared |
| Cloud event and media data | Up to 60 days after the event end date, unless deleted earlier by the operator or through a valid deletion request |
| Subscription and billing records | As required for accounting, fraud prevention, and legal compliance |
| Third-party synced copies | Subject to each provider's own retention policy |
| Operational logs (local only) | Overwritten on app restart or cleared manually |
Capture Snaps automatically deletes managed event records and associated managed cloud media 60 days after the event end date. Operators can delete an event or upload earlier; associated cloud data is removed as part of that process. Copies already synced to a third-party service remain subject to that provider's retention and deletion controls.
9. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- TLS/HTTPS encryption for all network communication
- Encrypted credential storage using OS-level secure storage where supported
- Hashed event admin passwords (never stored in plain text)
- Role-based access controls on backend services
- Row-level security (RLS) policies on database tables
No system is completely secure. While we take reasonable precautions, we cannot guarantee absolute security of data transmitted over the internet or stored electronically.
10. Your Rights
Under the UK GDPR, EU GDPR, and other applicable data protection laws, you may have the following rights:
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Request correction of inaccurate or incomplete data |
| Erasure | Request deletion of your personal data (see our Data Deletion Policy) |
| Restriction | Request that we limit processing of your data |
| Portability | Request your data in a structured, machine-readable format |
| Objection | Object to processing based on legitimate interests |
| Withdraw consent | Withdraw consent at any time where processing is based on consent |
For operators: You can exercise most of these rights directly through the app (deleting events, uploads, disconnecting integrations, clearing local data).
For guests: Contact the event operator in the first instance. If the operator is unavailable, contact us at james@capturesnaps.com with enough detail to identify the relevant event and upload.
We will respond to valid requests within 30 days (or sooner where required by law).
You also have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) at https://ico.org.uk.
11. Children's Privacy
The Service is not directed at children under 13. We do not knowingly collect personal information from children as standalone user accounts.
Event operators are responsible for ensuring compliance with applicable laws regarding the photographing and data collection of minors at their events.
12. Analytics and Tracking
Capture Snaps does not include third-party behavioural analytics, advertising trackers, or tracking pixels. We do not track users across websites or applications.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last Updated" date at the top of this page. We encourage you to review this policy periodically.
14. Contact Us
For privacy questions, data access requests, or any concerns about how your data is handled:
Capture Snaps
Email: james@capturesnaps.com
For data deletion requests, please also refer to our Data Deletion Policy.