Clik collects photos and videos from wedding and event guests for the people who host the event. We only use your data to run that service. We never sell personal data, and we never use your photos or Google data to train AI models. Clik does not show third-party ads. With your consent we measure our own advertising with Google Analytics, Google Ads and the Meta Pixel.
Who we are
This Privacy Policy explains how personal data is handled when you use Clik: the website at clik.camera, the guest upload pages (clik.camera/u/…), and the Clik mobile apps for iOS and Android (together, the “Service”). The data controller under the EU General Data Protection Regulation (GDPR) is:
- Operator
- Szabó Gergő Péter E.V.
- Legal form
- Sole trader (egyéni vállalkozó), Szabó Gergő Péter
- Address
- Barackos utca 1, 2365 Inárcs, Hungary
- Registration no.
- 56162721
- Tax number
- 57524735-1-33
- szabogergo.ev@gmail.com
- Phone
- +36 70 418 6781
We have not appointed a data protection officer, because the law does not require one for a business of our size. You can reach us about any privacy question at szabogergo.ev@gmail.com.
Data we collect
Event owners (account holders)
- Account data: your name, email address, profile picture and a unique account ID. If you sign in with Google, we receive the data described in Google user data. We do not store passwords; sign-in uses one-time email codes or Google.
- Event data: event names, dates, descriptions, cover images, upload links and their labels, the plan you chose and the settings you apply.
- Purchase data: which plan you bought, when, the store transaction ID and its status. Payments are processed by Apple or Google; we never see your card details.
- Profile preferences: for example onboarding status, appearance settings and your chosen language.
Guests who upload
- Photos and videos you choose to upload, including any metadata embedded in the files by your camera (for example the time taken, device model and, if your camera recorded it, GPS location). Remove location data on your device before uploading if you do not want it shared.
- Your name and a caption, if you enter them. Guests do not need an account.
- Guestbook messages you leave for the event owner: the text you write and, on paid plans, a voice recording made with your microphone. Recordings are stored with the event's media and deleted with it.
Photos and videos may show other people. Please only upload content you are entitled to share; see the Terms.
Everyone
- Usage and device data: pages and app screens viewed, taps and clicks, device type, operating system, browser, app version, language, a pseudonymous device identifier and an approximate location (country or city) derived from your IP address.
- Technical logs: IP address, request time and user agent, kept by our hosting providers for security and operations.
- Push token: if you allow notifications in the mobile app, together with the device platform, model, app version and your notification settings. We delete it when you sign out, delete your account, or the device stops accepting notifications.
- Messages: anything you send us by email.
We do not collect special categories of data on purpose, except for the optional face search described in Find yourself (face search). We do not access your device's photo library except for the items you pick, and when you ask the app to save media, it only writes to it.
Google user data
You can create a Clik account or sign in with your Google account. Sign-in is handled by our authentication provider, Clerk, using Google's standard OAuth flow. We request only the basic sign-in scopes openid, email and profile.
What we access
- Your name
- Your email address and whether Google has verified it
- Your profile picture
- Your Google account ID
We do not access your Gmail, Google Drive, Google Photos, contacts, calendar or any other Google data.
How we use it
- To create your Clik account and sign you in securely.
- To show your name and picture in your account, and to email you about your account and events.
How we share and store it
Google user data is stored by Clerk and, as your account ID, in our database (Convex). It is shared only with the service providers listed in Who processes your data as needed to operate the Service, when required by law, or as part of a business transfer with prior notice to you. We do not sell it, use it for advertising, or use it to develop, improve or train generalised AI or machine-learning models.
Clik's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Revoking access and deletion
You can remove Clik's access at any time in your Google Account under Third-party apps & services. Revoking access stops future Google sign-ins; to delete the data we already hold, follow Deleting your account and data.
Why we use it and our legal bases
We process personal data only for the purposes below, each with a legal basis under Article 6 GDPR.
| Purpose | Legal basis |
|---|---|
| Creating and running your account, events, upload links and gallery | Performance of a contract (Art. 6(1)(b)) |
| Receiving and storing guest uploads for the event owner | Performance of our contract with the event owner (Art. 6(1)(b)) and the legitimate interest of the owner and guests in collecting the event's photos (Art. 6(1)(f)) |
| Processing purchases and keeping accounting records | Performance of a contract (Art. 6(1)(b)) and legal obligation under Hungarian tax and accounting law (Art. 6(1)(c)) |
| Transactional emails and push notifications about your events | Performance of a contract (Art. 6(1)(b)); push notifications only with your device permission (Art. 6(1)(a)) |
| Product analytics, debugging and improving Clik | Legitimate interest in a reliable, usable product (Art. 6(1)(f)); where local law requires consent for analytics storage on your device, consent (Art. 6(1)(a)) |
| Measuring our own advertising with Google Analytics, Google Ads and the Meta Pixel, including reporting a purchase | Consent (Art. 6(1)(a)), which you can refuse in the cookie banner |
| Security, fraud and abuse prevention, handling reports of illegal content | Legitimate interest (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) |
| “Find yourself” face search (comparing a selfie with the event's photos) | Your explicit consent, given before each search (Art. 6(1)(a) and Art. 9(2)(a)); the event owner turns the feature on and informs guests |
| Answering your messages and requests | Legitimate interest (Art. 6(1)(f)) or, for rights requests, legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, you can object at any time (see Your rights). We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
Event owners and guests
The event owner decides which event to create, who receives the upload link, and what happens to the photos afterwards (for example downloading or sharing them). Owners can view, download and delete every item uploaded to their events.
Owners can also choose to show the uploads to others: to the event's guests on the upload page (guest gallery), on a projector at the venue (live slideshow), or on a gallery page they send to family and friends. Anyone with such a link can see the photos and videos shown there, together with the uploader's name and caption. When the owner turns on approval, new uploads appear there only after the owner approves them. Owners can switch these pages off, replace their links and hide or delete single items at any time.
If you appear in a photo or video and want it removed, ask the event owner, or write to szabogergo.ev@gmail.com with the event link and a description of the item, and we will help.
Find yourself (face search)
On the Unlimited plan an event owner can turn on “Find yourself”. Guests and visitors of the couple's gallery can then take a selfie to see the event photos they appear in, and the owner can search the event for a person.
- Only with consent: a facial image is biometric data. A search only runs after you tick the consent box, every time. The owner confirms when turning the feature on that guests are told about it.
- Nothing is stored: we do not build a face index or keep face templates. For each search your selfie and the event's photo previews are sent to TypeSafe AI's Jev model through the Vercel AI Gateway, which answers whether the person in the selfie appears in each photo. The selfie is held in memory for that one request and then discarded; only the list of matching photos is shown to you.
- Who sees the result: only the person who searched. Guests only ever see photos other guests may already see (hidden or not yet approved uploads are never returned).
- Accuracy: matches come from an AI model, so a search can miss photos or show a photo of someone else.
- Your choice: you never have to use it. If you do not want to appear in the event's photos at all, ask the event owner to remove them, or contact us.
Who processes your data
We use the following service providers. Each processes personal data only on our instructions, under a data processing agreement, and only as needed for the purpose listed.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Clerk, Inc. | Sign-up, sign-in (email code and Google), sessions and account profile | Name, email address, profile picture, Google account ID, sign-in history, IP address, device and browser details | United States |
| Convex, Inc. | Application database and backend functions | Account ID, events, upload links, guest names and captions, media metadata, cover images | United States |
| Cloudflare, Inc. (R2) | Storage and delivery of uploaded photos and videos | Photo and video files, including any metadata embedded in them | Global (EU and United States) |
| Vercel Inc. | Hosting of the clik.camera website and guest upload pages; cookieless visitor statistics and page-speed measurement (Vercel Web Analytics and Speed Insights) | IP address, browser details, request logs, pages visited, referrer, page-load performance metrics | Global (EU and United States) |
| TypeSafe AI (through the Vercel AI Gateway) | “Find yourself” face search, only when an event owner turned it on and you agreed to a search: comparing your selfie with the event's photo previews | Your selfie and the event's photo previews, for the duration of one search; nothing is kept by us afterwards | United States |
| Resend (Plus Five Five, Inc.) | Transactional email such as sign-in codes and service notices | Email address, email content and delivery status | United States |
| Stripe Payments Europe, Ltd. | Processing card and other payments for plans bought on the website | Account ID, email address, event ID, purchased plan, amount, payment method details (held by Stripe; we never see full card numbers), billing country | Ireland (EU), with transfers to the United States |
| RevenueCat, Inc. | Managing in-app purchases made through the App Store or Google Play | Account ID, purchased products, transaction IDs, purchase status, device and store country | United States |
| Expo (650 Industries, Inc.) | Delivering push notifications to the mobile app through the Expo push service, which passes them to Apple (APNs) and Google (Firebase Cloud Messaging) | Push token, notification title and text, device platform | United States |
| PostHog, Inc. | Product analytics and error insight | Pseudonymous device ID, account ID, pages and screens viewed, taps and clicks, device and browser details, approximate location derived from IP | EU (mobile app) and United States (website) |
| Meta Platforms Ireland Ltd. | Meta Pixel and Conversions API, only after you accept cookies, to measure visits, sign-ups, event creation and purchases from our ads | Cookie identifiers (_fbp, _fbc), pages and events, IP address, browser details, and a hashed email address on a purchase | Ireland (EU), with transfers to the United States |
| Google LLC / Google Ireland Ltd. | Google sign-in, if you choose it; Google Play billing for Android purchases; with cookie consent, Google Analytics 4 and Google Ads conversion measurement | See the section “Google user data” for sign-in. For Google Analytics and Google Ads, with consent: cookie identifiers, pages viewed, ad click identifiers, approximate location, and a hashed email address for enhanced conversions on a purchase | EU and United States |
| Apple Inc. | App Store distribution and billing for iOS purchases | Purchase records held by Apple under its own privacy policy | United States / Ireland |
Apple and Google also act as independent controllers for purchases made through their stores, under their own privacy policies. We may disclose data to authorities when the law requires it, and to a successor if the Service is transferred, in which case we will tell you first. We never sell personal data.
International transfers
Several providers are based in the United States or process data there. Where data leaves the European Economic Area, we rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework for certified providers, and otherwise on the Commission's Standard Contractual Clauses with appropriate safeguards. You can ask us for a copy of the relevant safeguards.
How long we keep data
- Account data: as long as your account exists; it is deleted as soon as you delete your account (within 30 days if you ask us by email).
- Photos and videos: for the storage period of the event's plan (Free: 30 days, Starter: 90 days, Pro: 1 year, Unlimited: until the owner deletes them), or until the owner deletes the item, the event or their account, whichever is first. The storage period counts from the event date, or from the day the event was created if that is later; the owner is emailed about a week before it ends.
- Purchase and invoicing records: 8 years, as required by Hungarian accounting law.
- Analytics data: up to 24 months.
- Technical logs: typically up to 30 days.
- Emails with us: up to 3 years after the matter is closed, unless needed longer to establish or defend legal claims.
Backups may keep deleted data for up to a further 30 days before it is overwritten.
Deleting your account and data
You can delete your data at any time:
- Single items or whole events: open the event in the Clik app or on clik.camera and delete the photos, videos, guestbook messages or the event. Deleted media is removed from storage.
- Your whole account: in the Clik app open Profile, or on clik.camera open Account, choose “Delete account” and confirm. Your account, profile, events, upload links and all photos, videos and guestbook messages collected for your events are deleted right away, including the files in storage. This cannot be undone, so download anything you want to keep first.
- If you can’t sign in: email szabogergo.ev@gmail.com from the address linked to your account with the subject “Delete my Clik account”. We will delete your account and all of its data within 30 days and confirm by email.
Records we must keep by law (such as invoices) are retained for the legally required period and then deleted. Guests without an account can request deletion of their uploads the same way, including the event link and a description of the items.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict how we process it;
- receive your data in a portable format;
- object to processing based on legitimate interests, including analytics;
- withdraw consent at any time, without affecting earlier processing (for example by turning off notifications in your device settings).
Email szabogergo.ev@gmail.com. We answer within one month, and may ask you to confirm your identity first.
You can also complain to a supervisory authority, in particular in the EU country where you live or work. In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), Falk Miksa utca 9–11, 1055 Budapest, naih.hu. You may also go to court.
Children
Accounts are for adults (18+). Guests under 16 should only upload with the involvement of a parent or guardian. Events may include photos of children taken by guests; event owners and guests are responsible for sharing them appropriately. If you believe we hold a child's data that should be removed, contact us and we will act promptly.
Security
Data is encrypted in transit (HTTPS) and at rest at our storage providers. Upload links use random codes, media is shown to owners through short-lived signed links, and only the owner can manage an event's gallery or see what isn't shared (see Event owners and guests). No system is perfectly secure; if a breach affects your data, we will notify you and the authority as the law requires.
Changes to this policy
We may update this policy when the Service or the law changes. The date at the top shows the latest version. For material changes we will notify account holders by email or in the app before they take effect.
Contact
Questions or requests about privacy: szabogergo.ev@gmail.com or by post to Szabó Gergő Péter E.V., Barackos utca 1, 2365 Inárcs, Hungary.