Privacy Policy

1. Who We Are

Lumenlio, LLC dba Fotify. Contact: hello@fotify.app

2. Scope

This Policy applies to hosts, guests, and visitors using our websites and services. If you are in the EEA or UK, the GDPR and similar laws apply.

3. Data We Collect

• Account and event data: host name, email, organization, event details, RSVPs, plus-ones, dietary notes if provided by host.
• Content data: photos and related metadata you upload, captions, timestamps, device info such as EXIF if present.
• Technical data: IP address, device and browser type, cookies, usage logs, approximate location from IP.
• Payment data: limited billing details handled by our payment processor. We do not store full card numbers.
• Messaging data: phone numbers provided by event organizers or guests, as well as SMS delivery status, opt-out status, and communication metadata when SMS invitations, reminders, or updates are sent through the Service.
• Email engagement data: whether the emails we send to hosts were delivered, opened, or had a link clicked, and whether the host unsubscribed.
• AI assistant connection data: the AI assistants a host connects to their account, the permissions the host granted, sign-in tokens (stored only in hashed form), and a log of which actions an assistant requested. See Section 8.

4. How We Use Data

• Provide and operate the service and core features.
• Display photos in live galleries and event screens.
• Moderate content using automated tools or manual review.
• Improve performance, security, and user experience.
• Communicate with you about the service and changes.
• Send hosts emails about their account and purchases and, unless they switch them off, product tips, offers, and reminders about a purchase they started but did not finish. Each optional email has an unsubscribe link, and all of them can be switched off under Email notifications in account settings.
• Measure whether our emails to hosts are useful, for example by comparing versions of an email or not sending a reminder to a small group of hosts.
• Send event-related SMS communications, including invitations, RSVP links, confirmations, reminders, and event updates, using phone numbers provided to the Service. SMS communications are used solely for event-related purposes and not for third-party marketing.
• Comply with legal obligations and enforce our Terms of Use.

5. Legal Bases (GDPR)

• Contract: to deliver the service to hosts and guests.
• Legitimate interests: service improvement, security, fraud prevention, sending hosts product tips, offers, and reminders about unfinished purchases, and measuring how those emails perform. You can object at any time through the unsubscribe link in each email or in your account settings.
• Consent: email marketing or optional features where required. You can withdraw consent at any time.
• Legal obligation: record keeping where applicable.

6. Roles and Responsibility

Event Hosts act as data controllers regarding guest data and uploaded photos. Fotify acts as a data processor that processes personal data on behalf of Hosts according to their instructions.

7. Subprocessors and Sharing

We use trusted third parties to deliver the service, such as hosting, storage, CDN, analytics, AI moderation, and payments. We do not sell personal data.

We may share phone numbers and messaging data with third-party messaging providers solely for the purpose of delivering event-related communications. We do not sell or share phone numbers with third parties for their own marketing purposes.

8. Connected AI Assistants

Hosts can connect an AI assistant, such as ChatGPT or Claude, to their Fotify account and manage their events by chatting with it. A connection exists only after the host signs in to Fotify and approves the permissions shown on the connection screen, such as viewing or managing events, guest lists and invitation designs. We never connect an assistant on a host's behalf.

• What the assistant receives: when the host asks the assistant to do something, the assistant sends a request to Fotify and we return only the data that request needs, for example event details, guest names and contact details, RSVP answers, or links to photos. The company that provides the assistant (for example OpenAI for ChatGPT or Anthropic for Claude) processes that data under its own terms and privacy policy. Fotify does not control how that company stores or uses it.
• What we receive: anything the host asks the assistant to add or change in Fotify, such as a pasted guest list, is stored the same way as data entered in the Fotify dashboard. We do not receive the host's conversation with the assistant, only the specific requests it sends to Fotify.
• What we keep about a connection: the assistant's name, the permissions granted, its sign-in tokens in hashed form, and when it was last used. To keep the service reliable we record which actions were requested, when, how long they took and whether they succeeded, but not the event or guest data they contained. If an assistant reports a problem to our team on the host's behalf, the report and the host's account email are kept as a support ticket.
• Guest data: sharing guest data with an AI assistant is the host's decision as controller of that data (see Section 6). Hosts should only connect assistants they are permitted to use with their guests' information.
• Retention and control: an assistant's access expires after one hour and is renewed while the connection is in use; a connection not used for 90 days expires. A host can disconnect any assistant at any time under Connected AI assistants in their account settings, and it is signed out immediately. Sign-in records of expired or disconnected connections are deleted 30 days later, and the last-used date 90 days after the last use.
• Safeguards: emails to guests are only sent after the host has seen who will receive them and confirmed, and the deletion of photos, sub-events, guest perks, registration links and custom domains is refused unless the host has explicitly confirmed it.

9. International Transfers

When personal data is transferred outside the EEA or UK, we implement safeguards such as Standard Contractual Clauses or rely on certified programs where applicable.

10. Retention

We retain personal data only as long as needed to provide the service, comply with law, or resolve disputes. Event photos may be deleted after the event unless the host enables archival features. Retention settings may be configurable by the host. Deleted content may persist in encrypted backup systems for up to 35 days before being permanently purged. Retention of AI assistant connection data is described in Section 8.

11. Security

We implement technical and organizational measures such as encryption in transit, access controls, and logging. No system can be guaranteed 100 percent secure.

12. Cookies and Analytics

We use essential cookies for core functionality and, where permitted, analytics or performance cookies. You can adjust preferences in your browser or via our cookie banner when available.

13. Your Rights

• Access, rectification, deletion.
• Restriction or objection to processing.
• Portability.
• Withdraw consent where processing is based on consent.

Requests can be made to your Event Host or to Fotify at hello@fotify.app. We may ask for verification. We will respond within applicable legal timeframes.

14. Children

The service is not directed to children under 13 or the age of digital consent in your jurisdiction. Hosts are responsible for any required consents for minors featured in photos.

15. EU or UK Representative

If required by law, we will designate a representative and publish the contact details here.

16. Changes to this Policy

We may update this Privacy Policy. Changes will be posted with a new effective date. Material changes will be highlighted.

17. Contact

Email: hello@fotify.app

Operator: Lumenlio, LLC, Delaware, United States