∙ gdpr · personal data

Privacy.

Last updated · April 22, 2026

Photobooth is a private-event photo gallery service published by Le Bris Consulting. This page describes precisely which data we collect, why, for how long, and the rights you have.

Data controller

Le Bris Consulting — Rennes, France — fred@flebris.com.

Data collected

Nickname
alphanumeric string chosen by the guest (e.g. “marie”)
contract performance
6-digit PIN
stored as a bcrypt hash — never in clear
contract performance
Uploaded photos
image files uploaded by the guest, with size and date
contract performance
Contact email
only if you fill in the universe-request form
pre-contractual measures
Google email
if the administrator connects a Google Drive account for backup
explicit consent
Session cookies
strictly necessary httpOnly cookies (guest, tenant, admin)
legitimate interest

No browsing data, no advertising pixels, no third-party analytics is deployed on the site. No user account is created with an email: guests sign in only with a nickname and PIN.

Purposes

  • Let every guest upload and retrieve their photos from any device.
  • Let the event administrator browse, download and moderate guest photos.
  • With explicit opt-in, back up photos to the administrator's personal Google Drive.
  • Answer contact requests (universe creation, support).

Retention periods

  • Photos and nicknames: duration defined by the selected plan (30 days for Discover, 6 months for Night, unlimited for Studio). Automatic deletion or on administrator request.
  • Contact email: 24 months after the last exchange, then deleted.
  • Google Drive refresh token: kept as long as the administrator keeps the connection active. Deleted immediately on disconnection.
  • Login attempts: rolling purge over 10 minutes (anti-brute-force).

Sub-processors

Vercel Inc.
hosting of the site and photos (Blob)
USA · standard contractual clauses
Neon Inc.
PostgreSQL database — AWS eu-central region
EU
Google LLC
only if the administrator connects Google Drive
USA · explicit consent · SCC
Resend Inc.
contact email delivery (if enabled)
USA · standard contractual clauses

Your rights

Under GDPR you have the following rights over your data:

  • Access, rectification, erasure
  • Restriction and objection to processing
  • Portability (ZIP export of all your photos)
  • Withdraw consent at any time (for the Drive connection)

To exercise these rights, write to fred@flebris.com. We reply within 30 days.

You may also lodge a complaint with the French data-protection authority CNIL.

Cookies

The site only uses cookies that are strictly necessary for the service (guest session, active tenant, admin session). These cookies are httpOnly, sameSite=lax, secure in production, and are not used for analytics or advertising. Under CNIL guidance their deployment does not require prior consent.

Security

Administrator passwords and guest PINs are stored as bcrypt hashes. Transfers are encrypted in TLS 1.2+. Photos are stored on Vercel Blob with non-guessable URLs.