Privacy Policy — Capture

1) Summary in plain language

We process the data needed to provide Capture, secure the service, support users, and improve reliability.

• When you create or join an event, we process the account, guest, event, and profile information needed for that experience.
• Photos, videos, comments, reactions, captions, and guest-book entries are processed to provide the event gallery features you request.
• The website uses functional browser storage and privacy-focused web analytics as described below.
• We do not sell personal data and the current website does not use marketing or interest-based advertising cookies.

2) Controller

Nexanum is the controller for account administration, operation and security of Capture, website analytics, support, and subscription administration:

For event content, the host determines the event’s purpose, audience, access, and use of photos or messages and may therefore be a separate controller. Depending on the context, Capture processes platform data under its own responsibility and handles event content to provide the service for the host. Hosts remain responsible for their own notices and lawful basis; this does not limit Nexanum’s own data-protection obligations.

3) Information you provide

Content you upload or create

• Event photos and videos uploaded to shared galleries
• Event details such as name, date, cover image, and settings
• Comments, reactions, captions, and guest-book entries, including text, handwriting, selfies, and optional voice recordings
• Display name, avatar, and other profile information

Account and support information

• Email address, name, login identifiers, and subscription information used for a host account
• Guest identifiers and the display name used when joining an event; guests do not need to register
• Messages and contact details you provide when requesting support
• Notification preferences and, if notifications are enabled, an Expo push token
• Purchase, subscription, and entitlement identifiers handled through the app store and RevenueCat

4) Information collected automatically and browser storage

When you use Capture, we or our service providers process technical information needed to operate and protect the service.

• Device, browser, operating-system, app-version, and language information
• App and website interactions such as pages or features used and privacy-safe product events
• Diagnostic, security, and performance information
• Approximate region derived from a network request where a provider supplies it

Cookies and local storage

Vercel Web Analytics

The website sends page views and allow-listed custom product events to Vercel Web Analytics. Custom event properties are not intentionally supplied with event names, guest names, join codes, user IDs, captions, media URLs, or error messages. Dynamic join codes and event IDs are removed from page paths before analytics events are sent.

According to Vercel’s Web Analytics privacy documentation, Web Analytics does not use third-party cookies, identifies a visitor through a hash derived from the request, records aggregated anonymous data, and discards the visitor session after 24 hours.

If optional marketing or advertising technologies are added later, we will request consent before using them where required.

5) Purposes and legal bases

Where the GDPR applies, we rely on the following legal bases to the extent the relevant information is personal data:

• Contract and requested steps (Article 6(1)(b) GDPR): providing host accounts and downloads, and administering subscriptions, purchases, and support requested in connection with a host’s contract.
• Legitimate interests (Article 6(1)(f) GDPR): operating the guest experience and requested event functions, securing Capture, preventing abuse, troubleshooting, measuring aggregated usage, and improving a reliable and usable service. Our interests are the safe and efficient operation of Capture; an event host must determine the lawful basis for processing under the host’s responsibility.
• Consent (Article 6(1)(a) GDPR): optional processing for which we specifically ask permission. Consent can be withdrawn for the future at any time.
• Legal obligations (Article 6(1)(c) GDPR): meeting tax, accounting, regulatory, or lawful disclosure duties.

Information marked as required, or technically necessary for a requested feature, must be provided for that feature to work. Uploading content and using optional profile fields are otherwise voluntary.

6) Recipients and sharing

We disclose data only where needed for the service, an event’s sharing settings, or a legal obligation. Recipient categories include:

• Hosts and authorized event participants, who can see event content and profile information according to the event settings
• Cloud and app infrastructure providers, including Firebase/Google services for authentication, database functions, and file storage
• Vercel for website hosting and privacy-focused Web Analytics
• Expo and the applicable Apple or Google notification service for optional push notifications
• RevenueCat and the applicable app store for subscription, purchase, and entitlement administration
• Resend for welcome emails sent to host email addresses
• Diagnostics and customer-support providers where those services are used
• Authorities, advisers, or other parties where required by law, needed to protect rights and safety, or connected with a business reorganization

Processors handle data under the applicable processing agreements and our instructions. Other recipients, such as app-store or payment providers, may process data under their own responsibility and privacy terms. We do not sell personal data.

7) Storage and retention

We retain personal data only for as long as needed for the relevant purpose, to provide an active account or event, meet contractual obligations, protect the service, resolve disputes, and satisfy statutory retention requirements.

Accounts and event content

• Account and profile data remain while the account is used and until deletion is requested, except where limited continued storage is required by law or for the establishment, exercise, or defense of legal claims.
• Event content is stored while the event remains. When a host deletes content or an event, Capture starts removal of the associated database and storage items. Technical residual files can remain if provider cleanup fails; contact us if deletion needs to be verified or completed. Capture does not currently apply a general automatic expiry period to all events.
• Uninstalling the app removes local app data but does not by itself delete cloud data associated with an account or event.
• Capture attempts to remove the push token from the profile during sign-out. If that provider update fails, the token can remain until it becomes invalid or is removed through support or profile deletion. Notification permission can also be revoked in the device settings. Notification preferences remain with the profile until changed or the profile is deleted.
• Purchase and subscription records are retained according to app-store, RevenueCat, accounting, and statutory requirements.

Website storage and analytics

• The language cookie lasts for up to one year; its local-storage copy remains until overwritten or browser data is cleared. The selected tab ends with the browser session, a per-event guest profile is removed when that event is left, and theme plus last-event or join-code values remain until overwritten or cleared.
• Vercel discards its request-based visitor session after 24 hours; aggregated reporting data is retained according to the applicable Vercel service settings.
• Support correspondence is retained for the time needed to answer the request and meet any related legal obligations.

To request deletion of account-associated data, contact info@nexanum.de.

8) Your choices and rights

Depending on the applicable law, you may have rights to:

• Access and receive a copy of your personal data
• Correct inaccurate personal data
• Request deletion or restriction of processing
• Object to processing based on legitimate interests
• Receive data you provided in a portable format where the legal requirements apply
• Withdraw consent at any time for future processing where consent is the legal basis
• Lodge a complaint with a competent data protection supervisory authority

To exercise a right, contact info@nexanum.de. We may need to verify the request before acting on it.

You can also control device permissions in your operating-system settings, manage app subscriptions in your app-store account, and clear browser data through your browser. Capture does not use automated decision-making that produces legal or similarly significant effects.

9) Security

We use reasonable administrative, technical, and organizational measures to protect data, including access controls and protected transmission. No online or storage system can be guaranteed to be completely secure.

10) Children and young people

Capture is not directed specifically at children. Where consent is required for a child to use an online service directly, the statutory minimum age in the relevant country applies. We do not knowingly process personal data contrary to those requirements.

Event content can depict minors even when they do not use Capture themselves. Depending on the context, hosts, uploaders, and Nexanum each retain their own legal responsibilities. Hosts and uploaders should provide appropriate notices and obtain any permission required for photographing, uploading, or sharing that content.

11) International transfers

Some providers are established in, or may process data in, countries outside the EEA or UK. If a transfer is subject to the GDPR, the applicable mechanism under Chapter V GDPR may include an adequacy decision or appropriate safeguards such as standard contractual clauses. You can contact us for information about the safeguard applicable to a particular transfer.

12) Changes to this policy

We may update this policy when the service, data flows, or legal requirements change. The effective date identifies the current version. We will provide an additional notice in the app, on the website, or through another appropriate channel when a change materially affects users.

13) Contact

For privacy questions, requests, or complaints, contact info@nexanum.de.