Privacy Policy
Last Updated: July 2, 2026
1. Introduction
Festa (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our event-based photo sharing and chat platform (“the Service”).
2. Information We Collect
2.1 Information You Provide
- Account Information: Such as your name, email address, and profile photo
- User Content: Such as photos, messages, and other materials you upload or share within events
- Payment Information: Such as billing details when you make a purchase (processed by our third-party payment processor; we do not store full payment card numbers)
- Communications: Such as messages you send through the Service and correspondence with our support team
2.2 Information Collected Automatically
- Device and Technical Information: Such as device type, operating system, browser type, and identifiers
- Usage Information: Such as features used, interactions, and activity patterns
- Log Data: Such as IP address, access times, and error logs
- Approximate Location: Derived from IP address (we do not collect precise GPS location unless you explicitly enable it)
2.3 Information from Third Parties
- Authentication Providers: If you sign in through a third-party service, we receive basic profile information as permitted by your settings with that provider
- Other Users: Such as when another user uploads a photo that includes you, or adds you to an event
3. How We Use Your Information
We use your information for the following purposes:
- Providing the Service: Operating and delivering the Service’s features to you and other participants
- Account Management: Creating and maintaining your account, authenticating your identity
- Communication: Sending service-related notifications
- Improvement: Analyzing usage to improve features and develop new functionality
- Safety and Security: Detecting and preventing fraud, abuse, and security threats
- Legal Compliance: Fulfilling legal obligations, responding to lawful requests, and protecting our rights
4. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA), UK, or Switzerland, we process your data under the following legal bases:
| Purpose | Legal Basis |
|---|---|
| Providing the Service | Performance of contract (Article 6(1)(b)) |
| Account management | Performance of contract |
| Service notifications | Legitimate interest (Article 6(1)(f)) |
| Improvement and analytics | Legitimate interest |
| Safety and security | Legitimate interest |
| Legal compliance | Legal obligation (Article 6(1)(c)) |
5. How We Share Your Information
We do not sell your personal information. We share your information only in the following circumstances:
- With Event Participants: Photos and messages you share within an event are visible to other participants of that event
- Service Providers: We use third-party processors to help operate the Service (such as hosting, payments, and email). These providers are contractually bound to use your data only as instructed by us.
- Legal Requirements: We may disclose information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others
- Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction
- With Your Consent: We may share information with third parties when you explicitly consent
6. Data Retention
We retain your information according to the following schedule:
| Data Type | Retention Period |
|---|---|
| Account information | Until you request deletion of your account |
| User Content (photos, messages) | Until the event expires, you delete the content, or you request deletion of your account — whichever comes first |
| Deleted content | Removed from the Service and permanently deleted within 30 days |
| Usage and log data | 12 months, then anonymized |
| Payment records | As required by tax and financial regulations (typically 7 years) |
| Content flagged for legal compliance | As required by law (e.g., CSAM reported to authorities) |
| Support correspondence | 2 years after resolution |
7. Your Rights
7.1 All Users
Regardless of your location, you may:
- Access your personal data
- Download/export your photos and data
- Request deletion of your account and associated data
7.2 EEA/UK Residents (GDPR)
You additionally have the right to:
- Rectification: Correct inaccurate personal data
- Erasure: Request deletion of your data (“right to be forgotten”)
- Restrict Processing: Limit how we use your data
- Data Portability: Receive your data in a structured, machine-readable format
- Object: Object to processing based on legitimate interests
- Withdraw Consent: Where processing is based on consent, withdraw it at any time
To exercise these rights, contact us at privacy@festa.film. We will respond within one month (extendable by two months for complex requests).
7.3 California Residents (CCPA/CPRA)
If you are a California resident, you have the right to:
- Know: Request what personal information we collect, use, and disclose
- Delete: Request deletion of your personal information
- Correct: Request correction of inaccurate personal information
- Opt-Out: Opt out of the sale or sharing of personal information (we do not sell or share your personal information as defined by the CCPA)
- Non-Discrimination: We will not discriminate against you for exercising your privacy rights
To exercise these rights, contact us at privacy@festa.film or use the controls in your account settings.
8. Data Security
We implement industry-standard technical and organizational security measures to protect your information, including encryption, access controls, and secure infrastructure. However, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.
9. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. When we transfer data outside the EEA/UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.
10. Children’s Privacy
Festa is not intended for children under 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected information from a child under 18, we will delete it promptly. If you believe a child under 18 has provided us with personal information, please contact us at privacy@festa.film.
11. Local Storage and Tracking Technologies
We do not use cookies. We use browser local storage to maintain your authentication session. We do not use tracking technologies for advertising purposes.
12. Photos of Other People
When you upload photos to Festa, those photos may contain images of other people. You are responsible for ensuring you have the right to share photos of others. Event participants whose likeness appears in photos may request removal by contacting the photo uploader or by reaching out to us at privacy@festa.film.
13. Changes to This Policy
We may update this Privacy Policy at any time. Changes take effect when posted. The “Last Updated” date at the top indicates the most recent revision. Your continued use of the Service constitutes acceptance of the revised policy.
14. Contact Us
For privacy-related questions or to exercise your rights:
- Email: privacy@festa.film
- Data Protection Inquiries: privacy@festa.film
If you are in the EEA and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.