01Who we are
GuestGrid is an online platform that lets hosts collect and share photos, videos, audio messages and guestbook messages from their guests at weddings, birthdays, parties, corporate events and other occasions.
GuestGrid is a Belgian service developed by Lamont Ceremonie and Hostinglama. For the processing described in this policy, GuestGrid is the data controller unless stated otherwise. You can reach us at info@guestgrid.app.
02Hosts, guests and our role
Account holders
If you create an account (as a host, co-host or professional partner), we are responsible for your account, payment and communication data.
Event content and guest lists
The host decides to create a gallery, who receives the link, which features are switched on and which guests appear on the guest list. We store and display this content on behalf of the host so the gallery works. Hosts are responsible for informing their guests and for having a valid reason to add personal data such as names and dietary requirements.
Events managed by a professional
If a photographer, planner, venue or other professional created your event through a partner account, that professional can also manage the event and its content.
03What data we collect
Account holders
- Email address and password (passwords are stored encrypted and we cannot read them)
- Language preference and account type (host, partner or administrator)
- Event details you enter: title, date, location, cover image, schedule, menu, seating plan, design and settings
- Co-hosts you invite and clients you invite as a partner (name and email address)
- Payment details: Mollie payment reference, amount, status and any discount code used. We never receive your full card or bank details.
Guests
- The name you enter when you join a gallery
- Photos, videos and audio messages you upload, plus captions
- Comments, likes and guestbook messages
- A random guest ID stored on your device so we can recognise your own uploads and likes
- If you turn on notifications: a push subscription linked to your guest name and guest ID
Guest lists and seating
- First and last name and table number, entered by the host
- Dietary requirements and allergies, and notes, if the host enters them
- Dietary information can reveal health or religious information. Hosts should only enter it with the guest's permission. It is only visible to the host and co-hosts, never to other guests.
Orders
- Prints: delivery name, address, postal code, city, country, delivery notes and payment reference
- Photobooks (via YAY Photobooks): name, email address, delivery address, optional phone number, book title, selected photos and language
Google Photos export
- If you connect Google Photos, we store an access key that only lets us add photos to your library. We cannot view, change or delete anything already in your Google Photos.
Communication
- Messages sent through our contact form (name, email address, subject and message)
- Emails we send you and whether they were delivered. We do not track whether you open emails or click links in them.
Technical data
- Gallery visit statistics: an anonymous session ID, browser type, time zone and language. No IP address is stored.
- A security log of administrative actions, which can include IP address and browser information
- Standard server logs from our hosting providers (such as IP address and time of the request), kept for security
- Analytics data, only if you accept analytics cookies (see the Cookie Policy)
Information inside photos
- Photos can contain hidden information (EXIF data) such as the date taken, camera model and sometimes GPS location. We only read the date to sort photos. Original files are kept as uploaded, so this information stays in the file and is included in downloads. Turn off location tagging on your camera or phone if you do not want to share it.
04Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your account, running galleries, storing and showing content | Contract (Art. 6(1)(b)) |
| Processing payments, orders, invoices and bookkeeping | Contract and legal obligation (Art. 6(1)(b) and (c)) |
| Service emails: verification, payment confirmations, event reminders, deletion notices | Contract (Art. 6(1)(b)) |
| Asking for a review and telling customers about prints and photobooks after their event | Legitimate interest (Art. 6(1)(f)). You can unsubscribe in every email. |
| Security, preventing abuse and fraud, handling reported content | Legitimate interest (Art. 6(1)(f)) |
| Website analytics with Matomo | Consent (Art. 6(1)(a)) |
| Measuring advertising campaigns with Google Ads | Consent (Art. 6(1)(a)) |
| Sending your order to YAY Photobooks, exporting to Google Photos, push notifications | Consent (Art. 6(1)(a)) |
| Dietary requirements on a guest list | Explicit consent, obtained by the host (Art. 9(2)(a)) |
05Who can see what in a gallery
- Galleries are not listed anywhere and we ask search engines not to index them. They can only be opened with the unique link or QR code.
- Anyone who has the link can see approved photos and videos, the guestbook, schedule and menu, and can add their own contributions. Treat the link like an invitation.
- Hosts can require approval before uploads appear and can mark messages as visible to the host only.
- If the host switches on the seat finder, anyone with the link can search for a name (at least two letters) and see first name, last name and table number. Dietary requirements and notes are never shown. The seating plan image is also visible.
- Uploads from a connected photobooth use a private access code that only the host and authorised people can see.
- Galleries stay online until the host deletes them.
07Photobooks through YAY Photobooks
When you order a photobook, and only after you agree to it in the order form, we send your name, email address, delivery address, optional phone number, book title, the selected photos and your language to YAY Photobooks. They use this data to design, print and deliver your book.
YAY Photobooks is an independent data controller for this data, and its own privacy policy applies. We keep a copy of the project details so you can find your order again.
08International transfers
Our database and files are stored in the EU. Some providers, such as Google and Netlify, are based in the United States. Transfers to them are protected by the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
09How long we keep data
- Galleries and everything in them: until the host deletes the event or the account. Deleted events can be restored for 90 days and are then permanently deleted, including all files.
- Account data: as long as your account exists. Ask us to delete your account and we will remove it.
- Payment records and invoices: as long as Belgian tax and accounting law requires.
- Orders: as long as needed to deliver them and handle questions or complaints, and then as long as accounting law requires.
- Google Photos access: until you disconnect it or delete your account.
- Push subscriptions: until you turn notifications off or the event is deleted.
- Contact messages: as long as needed to answer your question.
- Backups: deleted data can remain in encrypted backups for a limited time before it is overwritten.
- Data stored on your device: until you clear it in your browser (see the Cookie Policy).
10How we protect your data
- All connections are encrypted (HTTPS/TLS) and data is encrypted at rest
- Passwords are stored encrypted and are never visible to us
- Database access rules make sure people can only see and change what they are allowed to
- Private access codes are protected and only visible to the host and authorised people
- Administrative actions are logged, and access is limited to people who need it
11Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Have your data deleted
- Restrict how we process your data
- Object to processing based on legitimate interest, including direct marketing
- Receive your data in a structured, machine-readable format
- Withdraw your consent at any time, for example through "Cookie settings" in the footer. This does not affect processing that happened before.
Email info@guestgrid.app to use your rights. We reply within one month. Are you a guest and want a photo or message removed from a gallery? Ask the host, who can delete it straight away, or contact us and we will arrange it.
12Complaints
If you think we are not handling your data properly, please contact us first. You also have the right to file a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, or with the supervisory authority in your own EU country.
13Children
You must be at least 16 years old to create an account. Younger guests should only upload with a parent's or guardian's permission. Photos of children are often shared at events, so we ask hosts and guests to be careful about this. Contact us if a child's data needs to be removed.
14Automated decisions
We do not use automated decision-making or profiling with legal or similarly significant effects. We do not use facial recognition or AI analysis of your photos.
15Changes to this policy
We update this policy when our service changes. The date at the top always shows the latest version. If we make important changes, we will notify account holders by email or in the app.
Questions about this document?
Email us at info@guestgrid.app or use our contact form. We reply within a few working days.
Contact usRelated documents