Privacy policy

Who we are

Vowshot (“Vowshot,” “we,” “us”) is a service operated by Vowshot LLC, a New Jersey limited liability company, that lets wedding couples, the professionals assisting them, and wedding venues collect guest photos and videos in a private online gallery via a QR code. This policy explains what we collect, why, and the choices and rights you have. Contact: hello@vowshot.com.

The roles: host as controller, Vowshot as processor

For the photos and videos in a gallery, the couple or event host who creates the gallery is the “controller” (they decide the gallery exists and who is invited to upload), and Vowshot acts as a “processor” that stores and delivers those files on the host's behalf. For our own account and billing data, Vowshot is the controller. If you are a guest, the host who invited you is your first point of contact for questions about a gallery.

Venue-created galleries

A wedding venue may create a gallery for a couple and brand it with the venue's own name and logo, then invite the couple by email. Before the couple accepts, the venue administers the gallery. When the couple accepts the invite, the couple becomes the host and controller of that gallery's photos and videos.

After the couple accepts, the venue keeps only limited access: it can see that the gallery exists, its activity, and thumbnail previews, but it does not receive full-resolution downloads of the couple's media. On venue-created galleries, the guest upload page and gallery display the venue's branding in place of Vowshot's. If you are a couple and prefer the venue not retain preview access, contact us or the venue.

What we collect

Account holders: email address; event details you enter (couple names, dates, messages); for venues, your venue name, logo, and branding preferences; and billing information processed by Stripe (we receive confirmation and limited details but never your full card number).

Guests: the photos and videos you upload; an optional display name you choose to enter; and standard technical data (IP address, device/browser type, timestamps) used for security, delivery, and abuse prevention. We do not require guest accounts and do not build advertising profiles of guests.

Everyone: basic usage logs and cookies necessary to run the service (for example, keeping you signed in), plus limited advertising/measurement technology described under “Advertising & analytics” below.

Photos of people & biometric note

Photos and videos can show identifiable people, and in some jurisdictions images of a person's face may be considered sensitive or “biometric” information. Vowshot does not perform facial recognition, faceprinting, or any biometric identification, and does not use uploaded media to train AI models. We store and deliver media only as directed by the host. Hosts and guests are responsible for uploading only content they have the right to share; guests should upload images of others consistent with those individuals' reasonable expectations and applicable law.

How we use information

To provide the service: store and deliver media to the host; create QR codes and gallery links; process payments and referral commissions; send transactional email (sign-in links, receipts, storage-expiry reminders, venue invites); provide support; secure the service and prevent abuse; and comply with law. We rely on the following legal bases where GDPR/UK GDPR applies: performance of a contract (running your account/gallery), legitimate interests (security, improving the service), consent (where required, e.g. certain communications), and legal obligation (tax, accounting).

We do not use your photos or videos for advertising. We use the Meta (Facebook) advertising pixel to measure and optimize our own ads, which involves sharing limited website-activity data with Meta as described under “Advertising & analytics” below. Under some U.S. state privacy laws this may be considered “sharing” for cross-context behavioral advertising; you can opt out as described there. We do not sell your personal information for money.

Advertising & analytics

We advertise Vowshot online, and to measure whether our ads work we use the Meta (Facebook) pixel on our public marketing pages. The pixel records certain actions you take on our site — for example, viewing a page, starting a free gallery, or completing a purchase — and shares that activity with Meta so we can understand how our ads perform and reach people who may be interested. This can involve Meta setting or reading cookies and matching activity to a Meta account if you have one.

We use this only to measure and improve our own advertising. We do not send Meta the photos or videos in your gallery, and we do not use your uploaded media for advertising.

Your choices. You can limit this by using your browser's cookie controls or tracker-blocking tools, by adjusting your Meta ad settings, or by contacting us at hello@vowshot.com to request that we not share your activity for advertising. Where required by law, we will honor recognized opt-out preference signals. We do not run the advertising pixel on private gallery or upload pages.

Who can see uploads

Media in a gallery is visible to that gallery's host (the couple or whoever created it). On a venue-created gallery, the venue that created it retains limited preview access (thumbnails and status) as described above, but not full-resolution downloads once the couple has accepted. Galleries are reached through unguessable links/QR codes — treat the link like a key. We access gallery contents only to operate the service, provide support, or when legally required.

Service providers (sub-processors)

We use: Supabase (authentication, database), Cloudflare R2 (media storage), Stripe (payments), Resend (transactional email), and Vercel (hosting). Each processes data only to provide its service to us under contract. Some providers may process data in the United States; see “International transfers” below.

Retention & deletion

Media is retained for 12 months from the event date, then permanently deleted from storage by an automated job. Hosts may request earlier deletion of a gallery at any time. Account and billing records are kept while your account is active and afterward only as required for tax, accounting, or legal purposes, then deleted or anonymized.

International transfers

Vowshot is based in the United States and our providers may store or process data in the US. If you access the service from outside the US (including the EEA, UK, Brazil, or Asia), you understand your information may be transferred to and processed in the US. Where required, such transfers rely on appropriate safeguards (for example, Standard Contractual Clauses).

Your rights (EEA / UK — GDPR)

If you are in the EEA or UK, you have rights to access, rectify, erase, restrict, and object to processing of your personal data, to data portability, and to withdraw consent. You may lodge a complaint with your local supervisory authority. To exercise these rights, contact hello@vowshot.com; if your request concerns a specific gallery's photos, we will coordinate with the host who controls it.

Your rights (California — CCPA/CPRA)

California residents have rights to know, access, correct, and delete personal information, and to limit use of sensitive personal information. We do not sell personal information for money. We do use the Meta advertising pixel, which may involve “sharing” limited activity for cross-context behavioral advertising under California law; you may opt out of this sharing by contacting hello@vowshot.com or using browser/tracker controls (see “Advertising & analytics”). We do not use sensitive information to infer characteristics. You will not be discriminated against for exercising these rights.

Your rights (Illinois & other biometric laws)

Although we do not collect biometric identifiers or perform facial recognition, we note for transparency: we do not sell, lease, or profit from biometric information, and we do not create face templates from uploaded media. If our practices ever change, we will update this policy and obtain any consent the law requires first.

Your rights (other US states: NJ, FL, and comprehensive-law states)

Residents of New Jersey, Florida, and other states with privacy laws may have rights to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising or sale (which we do not do). Contact hello@vowshot.com to exercise these rights.

Your rights (Brazil — LGPD)

If you are in Brazil, you have rights under the LGPD to confirmation of processing, access, correction, anonymization or deletion, portability, information about sharing, and to withdraw consent. Contact hello@vowshot.com.

Other regions (Asia & elsewhere)

Privacy laws vary by country (for example, APPI in Japan, PIPL in China, the DPDP Act in India, and others). We aim to honor core rights — access, correction, and deletion — for all users regardless of location. If local law grants you additional rights, contact us and we will work in good faith to honor them.

Security

We use encryption in transit, access controls, and reputable infrastructure providers. No system is perfectly secure, but we work to protect your information and will notify affected users and regulators of a data breach where required by law and within applicable timeframes.

Children

The service is not directed to children under 13 (or the minimum age in your country), and accounts must be created by adults. Photos of minors may appear in wedding galleries; hosts are responsible for having the right to collect and share such images.

Partner referral program data

If you join our Partner referral program, we and Stripe collect the information needed to pay you and meet legal obligations — for example your name, email, referral activity, and, through Stripe Connect, your bank/payout details, identity verification information, and tax information. Payout and identity details are collected and processed by Stripe as a data controller under its own privacy policy and the Stripe Connected Account Agreement; we receive confirmation of your onboarding and payout status but do not store your full bank credentials or government identifiers. We use this information to calculate and send commissions, prevent fraud, and comply with tax and financial-reporting laws, including issuing tax forms (such as a 1099) where required.

Changes to this policy

We may update this policy; material changes will be notified by email or in the app, and the “last updated” date will change. Continued use after changes means you accept the updated policy.

Contact

Vowshot LLC — hello@vowshot.com. For gallery-specific requests, contact the host who created the gallery; we will assist them as the processor.