Privacy Policy

1. Data controller

EQ Web Solutions AB (corporate reg. no. 559314-1301), hereinafter referred to as "we", "us" or "Digipic", is the data controller for the processing of your personal data in connection with your use of the service Digipic (digipic.se).

Contact: contact@digipic.se

2. What data we collect

Organizers (account users)

• Account details: Email address and password (hashed) at registration; alternatively, details from social login (e.g. Google).
• Event data: Event names, dates, settings and invite links you create.
• Payment details: Handled by Stripe. We never store your card number — only a reference to your Stripe customer.

Guests (anonymous users)

• Uploaded files: Photos and videos that you upload to an event.
• Technical metadata: IP address (for abuse protection), file names and timestamps.

Guests do not need to create an account, and we do not collect names or email addresses from guests unless they choose to provide them.

3. Where data is stored

We use carefully selected service providers to store and process data. All data is stored within the EU/EEA.

4. Legal basis for processing

• Contract: The processing of organizers' account details and event data is necessary to fulfil our agreement with you (providing the service).
• Legitimate interest: Technical metadata (e.g. IP addresses) is processed to protect the service against abuse and ensure operational reliability.
• Consent: Guests give their implicit consent by voluntarily uploading media to an event.

5. Storage period and deletion

Uploaded media files are stored for the period the event's plan allows (14 days to 2 years depending on the chosen plan). When the storage period has ended, the files are deleted automatically.

Account details are stored for as long as you have an active account. You can request deletion of your account and associated data at any time by contacting us.

6. Third-party services

We share your personal data with the following categories of recipients:

• Supabase Inc. — Database management and authentication (data within the EU).
• Microsoft Azure — File storage for uploaded media files (data within the EU).
• Stripe Inc. — Payment processing. Stripe may process data in the USA under the EU-US Data Privacy Framework.
• Hetzner Online GmbH — Web hosting for the application (data within the EU).

7. Cookies and web analytics

We use necessary cookies for login and session management. We use no third-party marketing or tracking cookies.

To understand how the service is used, we run a self-hosted instance of Umami — a privacy-friendly, open-source analytics tool. Umami only collects aggregated and anonymized statistics (e.g. page views, referring website, approximate country and device type). No cookies are set, no IP address is stored in plain text, and no data is ever shared with third parties. The analytics data is stored on the same servers (Hetzner, EU) as the rest of the service and is used solely internally by us to improve Digipic.

8. Your rights

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access — You can request to know which personal data we process about you.
• Right to rectification — You can request that incorrect data be corrected.
• Right to erasure— You can request that your data be deleted (the "right to be forgotten").
• Right to data portability — You can request your data in a machine-readable format.
• Right to object — You can object to processing based on legitimate interest.

Contact us at contact@digipic.se to exercise your rights.

9. Supervisory authority

If you believe we process your personal data in violation of the GDPR, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY).

10. Changes to this policy

We may update this privacy policy. Significant changes are announced by email to registered users or through a notice in the service. The latest version is always available on this page.