Who We Are
Momentzy is a photo-sharing platform for events, operated by Momentzy, headquartered in Lisbon, Portugal. We are the data controller for your personal data under the GDPR (General Data Protection Regulation). For privacy inquiries, contact us at: privacidade@momentzy.com.
Data We Collect
We collect only the data strictly necessary to provide the service:
- Account data: name, email address and encrypted password upon registration.
- Content data: photos, associated metadata (including EXIF, if present), captions and submission information.
- Technical data: IP address, device type and browser, session cookies and usage logs.
- Biometric data: if the event organiser enables the optional face-recognition feature, facial embeddings (a numeric representation of faces, not photos) are generated from event photos so guests can find pictures of themselves. This is off by default, requires the organiser's explicit opt-in, and the data is not shared outside the event.
How We Use Your Data
- Operate and provide the platform and all its features.
- Moderate content to ensure community safety and quality.
- Communicate with you about the service, updates and technical support.
- Improve the platform based on aggregated and anonymised usage patterns.
We do not sell, rent or share your identifiable personal data with third parties for commercial purposes.
Payments
Payments are securely processed by Stripe, Inc. Momentzy does not store full credit card details on its servers. For more information, please refer to the Stripe Privacy Policy to understand how payment data is handled.
Third-Party Processors
We rely on the following processors, who process your data on our behalf under their own terms of service and applicable data-protection law, to provide the service:
- Payments: Stripe, Inc. (see Section 4).
- Email delivery: Brevo (Sendinblue SA), for transactional and marketing emails. Only your email address and first name are shared with Brevo.
- File storage: Cloudflare R2, an object-storage service used to store and serve your photos and videos.
- Error monitoring: Sentry, used to detect and diagnose technical errors in the application; it may process your IP address and technical session data.
Photographer Galleries: Two Data Controllers
A professional with a Momentzy account can create a gallery to show their photographs to their own clients. When you view that gallery, submit a request in it, or download a photograph where the professional has downloads switched on, your data is processed by two distinct entities, each a data controller in its own right and independently of the other - neither processes the data on the other's behalf:
- Momentzy: responsible for the platform that hosts the gallery, confirms your access when you view the photographs, and records your request or your download. If you tick the corresponding box, Momentzy also uses your name and email address to send you news about Momentzy, with a view to an event of your own. For that purpose Momentzy acts in its own name and not on the professional's behalf.
- The professional who owns the gallery: identified by name in the gallery itself. For a request, they receive your name, email and phone number in order to answer you, and they handle everything else - pricing, delivery and payment take place outside Momentzy. For a download, your name and email are recorded on their gallery, so they know who took the work they produced. If you tick the corresponding box, they also use those contact details to send you their own news. For those purposes they are the data controller.
Identification is mandatory at all three moments, because it is a condition of access and does not depend on consent. To view the gallery's photographs, we ask for your name and email only to confirm access: they are not kept - the platform issues an encrypted access pass to that gallery, carrying no personal data, valid for 30 days. To submit a request you are asked for your name, email and phone number, and those details are emailed to the professional. To download a photograph you are asked only for your name and email, and those are not emailed to anyone: they are recorded on the gallery, together with the photograph downloaded and the date. Without those fields there is no viewing, no request and no download.
The two news options are two separate consents, both unticked by default, and they are exactly the same for a request and for a download. Neither is a condition of access: if you tick neither, your request is submitted and your photograph is downloaded all the same. Each consent is recorded separately, with the date it was given and the version of the wording you were shown.
You may withdraw each consent independently, at any time and without giving a reason: withdrawing one does not withdraw the other. Use the form below - enter the email address you gave on the gallery and choose which consent to withdraw. It takes effect immediately and covers every request and download made with that address. The record that you gave the consent, and of the version of the text you were shown, is kept: it is what makes the withdrawal itself demonstrable.
On a request, the contact details you enter are emailed to the professional the moment you submit it - that is how they reply to you. The professional therefore already holds a copy of those details outside Momentzy, and that copy is theirs. The withdrawal you make here is recorded with us, but it does not delete that copy and it does not reach their own lists: to stop them using it, you have to contact the professional named in the gallery directly.
For any other question about your data, or if you would rather ask in writing, write to privacidade@momentzy.com.
A gallery has a duration set by the professional, up to a maximum of 365 days. Once that period ends, the link stops working immediately; the gallery is then archived automatically and, 30 days after archiving, the photographs and all associated data - including your request, the record of the downloads you made and the contact details you provided - are permanently deleted. Regardless of the gallery's duration, the contact details provided in a request or in a download are erased after 180 days, and immediately if you delete a Momentzy account registered with the same email address.
Your Rights (GDPR)
As a data subject, you have the following rights:
- Access: request a copy of your personal data that we process.
- Rectification: correct inaccurate or incomplete data we may hold.
- Erasure: request deletion of your account and all associated personal data.
- Portability: export your data in a structured, machine-readable format.
- Objection: object to certain types of processing, including processing for marketing purposes.
Access your account settings or send a request to support@momentzy.com.
If you took part in an event as a guest, without creating a Momentzy account, you can exercise these rights by contacting the event organiser directly, using the data-erasure link included in emails sent to you, or by writing to us at the address below.
Cookies
- Essential: necessary for the basic functioning of the platform (session, authentication). Cannot be disabled.
- Preferences: store your language, theme and other personal settings choices.
We also count aggregate visits to campaign links (flyer and poster QR codes): country, city, device type and language, per day. We do not use cookies for this, and nothing about it identifies who visited.
Data Retention
We retain your personal data for as long as necessary to:
- Active account: for as long as you maintain an active account on Momentzy.
- After deletion: data is securely deleted within 30 days of account deletion, unless we are legally required to retain it.
- Archived events: if an organiser archives an event, all of its data - including photos, comments and guest information - is permanently deleted 30 days after archiving.
- End of subscription: when a paid subscription ends, content remains accessible for 15 days, is then retained but inaccessible for a further 30 days, and is permanently deleted after that (45 days in total). The account and the holder's personal data are not deleted by this process.
Event photos may be automatically deleted after the deadline set by the organiser or at most 12 months after the event date, unless explicitly renewed.
Contact and Complaints
To exercise your rights or ask privacy questions, contact us at:
support@momentzy.com
You also have the right to lodge a complaint with the Portuguese supervisory authority: CNPD - Comissão Nacional de Proteção de Dados (cnpd.pt).