∙ gdpr · personal data

Privacy.

Last updated · April 22, 2026

Photobooth is a private-event photo gallery service published by Le Bris Consulting. This page describes precisely which data we collect, why, for how long, and the rights you have.

Data controller

Le Bris Consulting — Rennes, France — fred@flebris.com.

Data collected

Nickname
alphanumeric string chosen by the guest (e.g. “marie”)
contract performance
6-digit PIN
stored as a bcrypt hash — never in clear
contract performance
Uploaded photos and videos
image and video files uploaded by the guest, with size, date and, for videos, duration
contract performance
Guestbook notes and voice messages
text written by the guest, and audio recordings made with the microphone, only when the guest chooses to record (the microphone is never used otherwise)
contract performance
Contact email
only if you fill in the universe-request form
pre-contractual measures
Google email
if the administrator connects a Google Drive account for backup
explicit consent
Session cookies
strictly necessary httpOnly cookies (guest, tenant, admin)
legitimate interest

No browsing data, no advertising pixels, no third-party analytics is deployed on the site. No user account is created with an email: guests sign in only with a nickname and PIN.

Purposes

  • Let every guest upload and retrieve their photos and videos from any device, and leave notes and voice messages in the guestbook.
  • Let the event administrator browse, download and moderate guest photos.
  • With explicit opt-in, back up photos to the administrator's personal Google Drive.
  • Answer contact requests (universe creation, support).

Retention periods

  • Photos, videos, guestbook notes, voice messages and nicknames: duration defined by the selected plan (30 days for Discover, 6 months for Soirée, unlimited for Studio). At the end of that period new uploads stop; viewing and download remain available for 30 more days (time to get the ZIP), then everything is permanently deleted. Earlier deletion on administrator request.
  • Contact email and order details (name, email, message): 24 months after the last exchange, then deleted. The amount and date of payment are kept for accounting.
  • Google Drive refresh token: kept as long as the administrator keeps the connection active. Deleted immediately on disconnection.
  • Login attempts: rolling purge over 10 minutes (anti-brute-force).

Sub-processors

Vercel Inc.
hosting of the site and photos (Blob)
USA · standard contractual clauses
Neon Inc.
PostgreSQL database — AWS eu-central region
EU
Google LLC
only if the administrator connects Google Drive
USA · explicit consent · SCC
Resend Inc.
contact and credentials email delivery
USA · standard contractual clauses
Stripe Payments Europe Ltd.
online payment of the Soirée plan (card data never reaches us)
Ireland · EU

Your rights

Under GDPR you have the following rights over your data:

  • Access, rectification, erasure
  • Restriction and objection to processing
  • Portability (ZIP export of all your photos)
  • Withdraw consent at any time (for the Drive connection)

To exercise these rights, write to fred@flebris.com. We reply within 30 days.

You may also lodge a complaint with the French data-protection authority CNIL.

Cookies

The site only uses cookies that are strictly necessary for the service (guest session, active tenant, admin session). These cookies are httpOnly, sameSite=lax, secure in production, and are not used for analytics or advertising. Under CNIL guidance their deployment does not require prior consent.

Security

Administrator passwords and guest PINs are stored as bcrypt hashes. Transfers are encrypted in TLS 1.2+. Photos are stored on Vercel Blob with non-guessable URLs.