Privacy Policy

1. Data Controller and Data Processor

SnapUtsav is a product of Wolkn Minds, registered in the Netherlands. Depending on the type of data, SnapUtsav acts in different capacities:

Data Controller for platform account data, billing information, usage analytics, and contact form submissions. We determine the purposes and means of processing this data.
Data Processor for event-specific attendee photo data. We process this data on behalf of Event Organizers, who are the Data Controllers for their events.

For any privacy-related inquiries, contact us at support@snaputsav.com.

2. Roles and Responsibilities

SnapUtsav involves three distinct parties, each with defined responsibilities:

SnapUtsav (Wolkn Minds)

Provides the platform. Processes photos on behalf of Organizers. Ensures secure infrastructure, enforces retention policies, and handles platform account data as Data Controller.

Event Organizers

Data Controllers for their events. Responsible for informing attendees about photo collection, ensuring a lawful basis, configuring retention periods, and managing data subject requests for their events.

Event Attendees

Upload photos voluntarily and knowingly. The act of uploading a photo to an event page constitutes consent to its processing with the organizer's frame template for the duration of the retention period.

3. What Data We Collect

3.1 Data Collected from Event Organizers

Account Information: Email address, name, and profile data upon registration
Payment Information: Billing details processed through Stripe (we do not store full card numbers)
Billing and Tax Details: Legal or organisation name, billing address, country, and VAT/GST identification number where provided. These are stored so we can issue legally compliant invoices and apply the correct tax treatment (including EU B2B reverse charge).
Tax and Invoice Records: Purchase amounts, currency, tax amounts and rates, Stripe session/invoice references, and sequentially numbered invoice documents containing a frozen snapshot of the billing details shown on the invoice
Event Configuration: Event names, descriptions, dates, locations, hashtags, watermark and retention settings, and frame templates

3.2 Data Collected from Event Attendees

Uploaded Photos: Images voluntarily submitted by attendees on event pages, together with the generated framed versions in each requested size
Optional Contact Details: Name, email, or phone number if the organizer has enabled these fields for their event
Technical Data: Browser type, IP address, and device information collected automatically during the upload, used for security, abuse prevention, and rate limiting

Public Photo Walls and Share Links

Where the organizer enables it, generated photos may appear on a public event photo wall and can be opened through short share links. Each generated size receives its own link, and anyone holding a link can view and download that photo until the retention period expires. Link previews on social and messaging apps display the generated photo. Only the photo, event name, and organizer-configured caption are included — attendee contact details are never published.

3.3 Data Collected from All Visitors

Usage Data: Pages visited, features used, and interaction patterns
Contact Form Submissions: Name, email, subject, and message content when you contact us

4. Legal Basis for Processing

We process personal data under the following legal bases (GDPR Article 6):

Contract Performance: To provide the Service to Organizers (account management, photo processing, event hosting)
Consent: Attendees consent to photo processing by voluntarily uploading their photos to an event page
Legitimate Interest: To improve and secure the Service, prevent fraud, and provide customer support
Legal Obligation: To comply with applicable laws, such as tax and financial regulations

Organizer Responsibility

Event Organizers are responsible for ensuring they have a lawful basis for collecting attendee photos at their events. SnapUtsav processes photos solely on the Organizer's instructions and is not responsible for the Organizer's compliance obligations.

5. How We Use Your Data

To provide, maintain, and improve the Service
To process photos with frame templates as instructed by Organizers
To process payments and manage subscriptions
To send transactional notifications (account confirmations, billing receipts)
To respond to inquiries and provide support
To detect and prevent abuse or security threats

6. Organizer Obligations

By using SnapUtsav, Event Organizers agree to:

Have a lawful basis for collecting and processing attendee photos at their events
Inform attendees that their photos will be processed by SnapUtsav using the organizer's frame templates
Respond to data subject requests from their event attendees, with SnapUtsav's reasonable assistance
Download any photos they wish to retain before the configured retention period expires
Ensure that any optional attendee data fields (name, email, phone) they enable are collected lawfully

When an attendee uploads a photo to an event page, they do so voluntarily and with knowledge that:

The photo will be processed with the event organizer's frame template
The processed photo will be available for viewing and sharing during the event's retention period
The photo will be automatically and permanently deleted after the retention period expires

Attendees may request early deletion of their photos by contacting the event organizer or by emailing support@snaputsav.com with the event details and photo reference.

8. Data Storage and Security

Your data is primarily stored on secure cloud infrastructure within the European Union/European Economic Area (EU/EEA). Some data may be processed through global content delivery networks (CDNs) to ensure fast access worldwide. We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. All data transfers are encrypted using TLS/SSL.

9. Third-Party Processors

We share data with the following third-party processors, each bound by data processing agreements:

Stripe: Payment processing, tax calculation, VAT/GST ID validation, and billing portal (PCI DSS compliant). See Stripe's Privacy Policy.
Resend: Delivery of transactional email (account confirmations, password resets, receipts, and service notifications). See Resend's Privacy Policy.
AI Image Processing Provider: Used only when an organizer generates AI frame designs. Prompts and generated frame artwork are processed; attendee photos are never sent to AI providers.
Cloud Infrastructure Provider: Hosting, database, storage, and serverless processing, primarily within the EU/EEA. Where processing occurs outside the EU/EEA, it is covered by Standard Contractual Clauses (SCCs) or adequacy decisions.
Geolocation Lookup (ip.guide): A coarse country lookup of your IP address is performed to decide whether a cookie consent banner is legally required for your region. No lookup result is stored against your account.

SnapUtsav as a Processor

For event photo data, SnapUtsav itself acts as a data processor on behalf of Event Organizers (the data controllers). We process attendee photos only as instructed — applying the organizer's frame template, storing during the retention period, and deleting upon expiry.

10. Data Retention

Account Data: Retained while your account is active and for 30 days after deletion
Uploaded Photos: Automatically deleted after a retention period configured by the Event Organizer. Free plan: 7 days after the event. Paid plans: 30, 60 (default), 90, or 180 days. Administrators may also manually delete photos after the event ends.
Payment, Tax, and Invoice Records: Retained for 7 years as required by Dutch and EU financial and VAT regulations. Because these records are a statutory obligation, they are not deleted on an erasure request, even after account closure.
Contact Messages: Retained for 2 years after resolution
Operational Logs: Security, delivery, and processing logs used for monitoring and abuse prevention are retained for up to 12 months

Irreversible Deletion

Once the retention period expires, all original and generated photos are permanently and irrecoverably deleted. Organizers are responsible for downloading any photos they wish to keep before expiry.

11. Your Rights

Under the GDPR and equivalent global regulations, you have the right to:

Access: Request a copy of the personal data we hold about you
Rectification: Request correction of inaccurate data
Erasure: Request deletion of your data ("right to be forgotten")
Portability: Receive your data in a structured, machine-readable format
Restriction: Request restriction of processing in certain circumstances
Objection: Object to processing based on legitimate interests
Withdraw Consent: Where processing is based on consent, withdraw it at any time

Event-Specific Requests

For data related to a specific event (e.g., your uploaded photos), please contact the event organizer first. The organizer is the data controller for event data and can instruct SnapUtsav to fulfil your request. You may also contact us directly and we will cooperate with the organizer to assist.

To exercise these rights, visit our Data Rights page or contact us at support@snaputsav.com.

12. Cookies and Similar Technologies

We use the following types of cookies:

Essential Cookies: Required for authentication, session management, and security. These cannot be disabled as the Service cannot function without them.
Functional Cookies: Remember your preferences (e.g., currency selection, theme).

No Tracking or Advertising

We do not use third-party advertising or tracking cookies. We do not sell your data or use it for targeted advertising. If we introduce analytics cookies in the future, we will update this policy and obtain your consent where required.

13. International Data Transfers

SnapUtsav is based in the Netherlands, and your data is primarily processed within the EU/EEA. When data is transferred outside the EU/EEA, we ensure appropriate safeguards including:

Standard Contractual Clauses (SCCs) approved by the European Commission
Transfers to countries with an adequacy decision from the European Commission
Additional technical and organizational measures where necessary

14. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice on the Service. The "Last updated" date at the top reflects the most recent revision.

16. Supervisory Authority

Our primary supervisory authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). You can contact them at autoriteitpersoonsgegevens.nl.

If you reside in another EU/EEA member state, you may lodge a complaint with your local Data Protection Authority via the European Data Protection Board.

For UK residents, contact the Information Commissioner's Office (ICO) at ico.org.uk.

17. Contact

For privacy inquiries, data requests, or questions about this policy:
Email: support@snaputsav.com
SnapUtsav, a product of Wolkn Minds
The Netherlands
Or use our contact form.

18. Region-Specific Disclosures

California, United States (CCPA/CPRA)

California residents have specific rights under the CCPA/CPRA, including the right to know, delete, and opt out of the sale of personal information. We do not sell or share your personal information. To exercise your rights, contact support@snaputsav.com.

United Kingdom (UK GDPR)

UK residents have rights substantially similar to those under the EU GDPR. Your supervisory authority is the ICO at ico.org.uk.

Australia (Privacy Act 1988)

Australian residents may access and correct personal information and lodge complaints with the OAIC at oaic.gov.au.

Canada (PIPEDA)

Canadian residents may access and challenge the accuracy of personal information. Complaints may be filed with the Privacy Commissioner at priv.gc.ca.

Singapore (PDPA)

Singapore residents may contact the PDPC at pdpc.gov.sg.

Malaysia (PDPA 2010)

Malaysian residents may contact JPDP at pdp.gov.my.

India (DPDP Act 2023)

Indian residents have rights including access, correction, and erasure under the DPDP Act. Contact the Data Protection Board of India once established.

Middle East

For residents of the UAE, Saudi Arabia, Bahrain, or other Middle Eastern countries with data protection legislation, we comply with applicable local requirements. Your data is processed under the GDPR framework. For inquiries, contact support@snaputsav.com.