Privacy Policy

Confetti Cam is operated by Artygroup LLC, Los Angeles, California (“we”, “us”). Contact: privacy@confetti.cam.

Confetti Cam lets event hosts (usually a couple getting married — “hosts”) invite their guests to take a limited number of photos and short videos that are collected into one private album for the host.

• We collect what the product needs to work: your photos and videos, the name you claim, and your email if you’re a host. Nothing else.
• Photos and videos belong to the people who take them and the couple they’re taken for — we don’t sell them, mine them, use them to train AI, or use them for advertising.
• Albums are private by default. Only the host, and people the host shares the album with, can see them.
• No face recognition. We record who took each photo, never who appears in it.
• We strip GPS location from photos when we process them.
• Everything is deleted 12 months after the event unless the host downloads or extends it.

From hosts (the account holders): account email and name; event details (event name, date, the guest list the host uploads, settings); payment status and receipt details from Stripe — never card numbers, which we don’t touch.

From guests (no account required): the name you claim; the photos and videos you capture or upload through the event camera, with the time they were taken; a device token we generate so your shot count and photos stay attached to you for the event (our own identifier, not an advertising ID); and basic technical data (device type, upload success or failure) so we can make sure no photo gets lost.

About people who appear in photos: guests photograph the event, so you may appear in photos taken by others even if you never use Confetti Cam. The host controls the album. To request removal of a photo you appear in, see “Your rights” below.

We do not collect: precise location (GPS metadata is stripped during processing), biometric data or face templates, contacts, or browsing history. We use no third-party advertising or tracking on any Confetti Cam surface.

• To run the product: collect, store, process (apply the disposable filter, create thumbnails), and deliver media to the host’s album; enforce per-guest photo counts; attribute photos to the guest who took them.
• Reliability and safety: monitor upload success, prevent abuse, moderate reported content.
• Communication: transactional email to hosts (receipts, “your album is ready,” deletion reminders). Marketing email only to hosts who opt in.
• Legal compliance.

Where GDPR applies, our legal bases are: performance of a contract (hosts); legitimate interests in operating the event service guests choose to participate in (guests); consent where required; and legal obligation for compliance matters.

For guest-list names and event photos, the host decides what the album is for, who is on the guest list, whom the album is shared with, and what is hidden or deleted. We act on hosts’ instructions for their event content, and independently for account, billing, security, and legal-compliance purposes.

Service providers who process data on our behalf, under contract, and only as needed to run the product: Vercel (hosting), Supabase (database), Cloudflare (media storage and delivery), Stripe (payments), Resend (email), and Sentry (error monitoring). We disclose data if legally required. We never sell personal information and never share it for cross-context behavioral advertising.

• Event media and guest data are deleted 12 months after the event date. Hosts are reminded before expiry and can download everything first, or purchase an extension.
• Host accounts are kept while active and deleted on request (see below).
• Reported-content records, payment records, and security logs are kept as long as legal requirements demand.
• Deletion is end-to-end: database records and all stored media copies (originals, filtered, web, thumbnails). Backups age out within 30 days.

Depending on where you live (GDPR, UK GDPR, CCPA/CPRA, and similar), you can request access, correction, deletion, portability, or restriction, and you will never be discriminated against for exercising these rights.

• Hosts: delete your account and events in the app or dashboard, or email privacy@confetti.cam.
• Guests: you can request deletion of the media you captured or your claimed name — from your device during the event, or by emailing privacy@confetti.cam afterward (we’ll verify via the event and host).
• Anyone appearing in a photo: email privacy@confetti.cam with the event and photo details; we will assess removal requests and involve the host where appropriate.

We respond within the legally required window (30 days GDPR / 45 days CCPA), and aim for much faster. You can also complain to your local data-protection authority.

Confetti Cam is not directed at children. Hosts must be 18 or older; guests must be 16 or older, or have a parent or guardian’s OK. Wedding photos naturally may include children; those photos are controlled by the host like all event media, and parents or guardians may request removal via privacy@confetti.cam.

Media uploads and all traffic are encrypted in transit; media is stored on access-controlled infrastructure; database access is protected with row-level security; guest access is scoped to a single event via signed tokens. No system is perfectly secure — report concerns to privacy@confetti.cam. If a breach affects your data, we will notify you and regulators as the law requires.

Data is processed in the United States and in our providers’ regions; where GDPR applies, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

We’ll post changes here and, for material changes, email hosts. Continued use after the effective date means the updated policy applies.

Contact: privacy@confetti.cam · Artygroup LLC, Los Angeles, California. See also our Terms of Service and Guest Terms.