1 Data controller
The data controller is:
Contact email: info@albumates.com
For any request about your personal data or to exercise your rights, you can write to the email address above.
2 What data we collect
We only process the data needed to let you use the App.
a) Account data
- Email address (for registration and sign-in)
- Password (stored in encrypted form by the infrastructure provider; we have no access to it in plain text)
- Username, first and last name, and the profile information you choose to add, such as a profile photo (optional)
- If you choose to sign in with Google: the name, email address and profile picture of your Google account, which Google sends us when you sign in
b) Content you upload
- The photos, videos and "moments" you post in albums. Before upload, the App removes from photos and videos the location data (GPS) recorded by the camera
- For photos, also an original copy, likewise without location data: it is used only by people authorised to download it
- Any titles, captions or descriptions attached to them
- Information about albums (name, customisations, collaborators)
- Album invitations: who invited you, to which album and with which role, until you reply
- The reactions you add to other people's moments, visible to the album's members
- Your choices about downloading your content (general consent and any per-album exceptions)
c) Location data (optional)
- The geographic coordinates you choose to attach to an album or a moment
- Processed only if you voluntarily decide to add them
d) Technical and usage data
- The minimum data needed for the service to work and stay secure (e.g. technical logs, session identifiers)
- Preferences saved locally on the device (e.g. theme and language)
- Anonymous statistics on the quality chosen when downloading several items (optimal or original): only the choice and the number of items, with no reference to you or to the content
e) Notifications
- Events and preferences related to notifications (e.g. approval of a moment, new activity in an album, deletion of a shared album you belonged to: in this last case we keep the album's title so that we can notify you; if an album is renamed, we keep its previous name to show you which album changed)
- A technical identifier of your device (token), needed to deliver push notifications to you
- The App's language, to write push notifications to you in your language
f) Reports
- If you report content or another user, we record your identifier, the reported content or user, the reason and any note, so that we can review the report. The reported person is not notified.
g) Blocks
- If you block another user, we record who you blocked and when, in order to apply the block: they will not be able to invite you to albums, you will not find each other in search and you will not receive notifications for their actions. The list is visible only to you, and the person you block is not notified.
We do not collect data that you have not provided voluntarily or that is not technically necessary for the service.
3 Why we process your data
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Uploading, storing and sharing moments | Performance of a contract (Art. 6(1)(b)) |
| Making content downloadable, according to the consent of the person who uploaded it | Performance of a contract (Art. 6(1)(b)) |
| Anonymous statistics on the quality chosen when downloading | Legitimate interest (Art. 6(1)(f)) in improving the service; the data is anonymous |
| Attaching a geographic location to moments | Consent (Art. 6(1)(a)), which can be withdrawn |
| Handling reports and moderation | Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) |
| Ensuring security and preventing abuse, including through blocking between users | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
Where processing is based on consent, you can withdraw it at any time; withdrawal does not affect the lawfulness of processing carried out before it.
4 Who can see and download your content
- The content you post in an album is visible to the members of that album, together with your username and the reactions received.
- You join an album only if you accept the invitation: until you reply you cannot see the album and, among its members, only the people who manage it (owner and administrators) know that you have been invited.
- Other members can save your content to their own device only if you allow it, from your profile settings; you can make exceptions for individual albums. Until you give your consent, downloading is not possible.
- In other people's personal albums, the album owner decides about the content you add (see the Terms and Conditions).
- The original copy of photos, without location data, is uploaded automatically, normally when the device is connected to a Wi-Fi network, and is used only for downloads, under the same consent rules.
- If you withdraw your consent, nobody will be able to download your content from that moment on. Copies that others have already saved remain on their devices, outside our control.
5 Who we share data with
To run the App we rely on external providers, which process data on our behalf as data processors:
Other users — the members of the albums you post in see your content and, if you allow it, can download it (section 4).
Supabase — provides authentication, database and storage of photos and videos. Data is hosted on servers in the European Union (Ireland). The provider operates in compliance with the GDPR; any transfers outside the EU take place on the basis of appropriate safeguards (e.g. Standard Contractual Clauses).
OpenStreetMap / Nominatim — used only to convert a text search for a place into its coordinates, when you decide to attach a location. Only the search text is sent to the service, not your account data. The service is run by the OpenStreetMap Foundation.
Google Firebase (Cloud Messaging) — delivers push notifications to your device. It processes a technical identifier of the device (token) and the content of the notification.
Google (Sign in with Google) — only if you choose to sign in with your Google account: Google verifies your identity and sends us your name, email and profile picture. For its own authentication service Google acts as an independent controller; its privacy policy applies.
Resend — sends service emails (registration confirmation, password recovery). It processes your email address and the content of the message. Service emails are written in English, whatever language you have chosen in the App.
Cloudflare — hosts the albumates.com website, forwards emails sent to info@albumates.com and stores backup copies of the data in an archive under EU jurisdiction.
GitHub — runs the automatic backup procedures: data passes through it only while being copied to the backup archive, without being stored there.
We do not sell your data to third parties. The App contains no advertising, does not use advertising profiling and does not share your data with advertisers.
6 Transfers outside the EU
Data is hosted on servers in the European Union (Ireland). Some providers (Google, Resend, GitHub) are based in or have servers in the United States: for the data they process on our behalf, any transfer is made to companies participating in the EU-US Data Privacy Framework or on the basis of the European Commission's Standard Contractual Clauses.
7 How long we keep data
We keep your data for as long as your account remains active and we use it to provide you with the service.
- Deleted content: when content or an album is deleted, the related files are removed from our servers within a few minutes.
- Rejected content: content not approved by the people who manage the album is deleted after 12 hours.
- Account closure: your profile, profile photo, album memberships and invitations, the reactions you added, blocks, notifications and preferences are deleted; your personal albums are deleted together with their content; content awaiting approval is deleted.
- For the content you uploaded to shared albums, you choose when closing the account: delete it, or leave it in the albums without your name, also deciding whether it can still be downloaded. If you choose that it cannot be downloaded, its original copies are deleted.
- The content you added to other people's personal albums remains available to the album owner, without your name.
- If you leave a shared album, you choose what to do with the content you uploaded there: delete it, or leave it with your name, also deciding whether it can still be downloaded. If you choose that it cannot be downloaded, its original copies are deleted.
- If you leave another person's personal album, or if the owner removes you from the album or blocks you, your already approved content stays in the album and content awaiting approval is deleted.
- If the people who manage a shared album (the owner or an administrator) remove you from the album, the content you uploaded there is deleted.
- If the owner deletes a shared album, the content of all members is deleted, and they are notified.
- Invitations: an invitation remains until you reply; if you decline it or it is cancelled, it is deleted.
- Blocks: they remain until you unblock the user or close your account.
- Reports: we keep them for 12 months from the date of the report, even if the content or account concerned is deleted in the meantime, so that we can handle any disputes: the reason, the date, the outcome and the username of the account they refer to are kept. If you close your account, the reports you made remain without your identifier.
- Accounts that were registered but never confirmed, or whose registration was not completed (for example a Google sign-in without choosing a username or accepting the Terms), are deleted automatically after a few days.
- Some information may be kept for a limited period after deletion, where necessary for legal obligations, security or the defence of legal claims.
- Backups: copies of the data may remain in backups for up to 60 days, after which they are deleted. Backups are used only to restore the service in case of failure.
- Anonymous download statistics contain no personal data and may be kept without time limits.
8 Your rights
Under Articles 15–22 of the GDPR, you have the right to:
- Access — know what data we process and obtain a copy of it
- Rectification — correct inaccurate or incomplete data
- Erasure ("right to be forgotten") — also directly from the App through "Delete account", where you choose what to do with the content uploaded to shared albums
- Restriction — ask for processing to be restricted in certain cases
- Portability — receive your data in a structured, readable format
- Objection — object to certain processing
- Withdrawal of consent — at any time, for processing based on consent; consent to download your content can be changed from your profile settings
To exercise these rights, write to info@albumates.com. We will reply within the time limits set by law.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (garanteprivacy.it) if you believe that the processing infringes the law.
9 Minors
The App is reserved for users who are at least 16 years old. On registration you are asked to confirm that you meet the minimum age.
We do not knowingly collect data from children under 16. If we become aware that a child under 16 has created an account without the necessary consent, we will delete it. If you are a parent or guardian and believe that a child has given us their data, contact us at the email address above.
10 Photos showing other people
The App lets you upload photos that may show other people. Whoever uploads content is responsible for having the right to do so and, where necessary, the consent of the people shown (see the Terms and Conditions).
If you appear in a photo uploaded by another user and want to report it or ask for its removal, you can use the report feature in the App or write to info@albumates.com.
11 Data security
We adopt appropriate technical and organisational measures to protect your data, including encrypted transmission (HTTPS) and database-level access controls that limit the visibility of data to authorised users only. No system, however, is 100% secure: we encourage you to choose a strong password and not to share it.
12 Changes to this Policy
We may update this Policy over time, for example for new features or regulatory changes. In case of significant changes we will notify you within the App. The date at the top always shows the latest version in force.
13 Contact
info@albumates.com