Privacy Policy

Overview

SimplyCandid is a platform that helps event hosts collect, display, and manage guest photo uploads through event upload pages, live slideshows, galleries, and host tools. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use SimplyCandid as a host, guest, viewer, website visitor, or support contact.

Who this policy covers

• Hosts who create accounts, purchase plans, configure events, and manage galleries or downloads.
• Guests who upload media, add optional uploader names, or use the live event experience.
• Viewers who open a gallery, slideshow, preview link, or other event experience shared by a host.
• Visitors who browse our public website, request support, or otherwise interact with us outside a hosted event.

Roles and responsibilities

SimplyCandid operates the SimplyCandid platform. For event data that hosts choose to collect and manage through the service, we generally act as a service provider or processor and the host remains responsible for event configuration decisions, link sharing, moderation choices, and their own obligations to event attendees, guests, and viewers.

• We control information needed to run our business and platform, such as billing, account administration, security, diagnostics, and service improvement data.
• Hosts control many event-specific decisions, including who gets event links, who gets gallery access, whether uploader names are shown, and when an event or its content is deleted through available product controls.
• If your request relates to event-specific content or settings, contacting the host may be the fastest path because the host may control the relevant event data and timing.

Information we collect

• Account and profile data, such as host name, email address, business profile details, membership records, and login or account recovery details handled through our authentication provider.
• Event data, such as event name, event slug, event date, time zone, branding settings, moderation preferences, slideshow settings, QR code settings, gallery access settings, and related host-entered labels or notes.
• User-submitted content, such as uploaded photos, branding logos, support attachments, optional uploader names, and related file metadata including timestamps, file type, size, storage path, and scan results.
• Gallery, slideshow, and access records, such as gallery-session data, preview-access cookies, magic-link issuance and expiry data, viewer activity, and whether access attempts succeeded or were denied.
• Billing and transaction data, such as Stripe customer IDs, subscription status, invoices, payment method metadata, purchase history, and limited tax or business information needed to complete a transaction.
• Device, browser, and usage data, such as IP address, browser type, device metadata, referrer, pages or screens viewed, timestamps, analytics events, and diagnostics.
• Communications and support data, such as messages you send to support, screenshots, feedback, and records of privacy requests or complaints.

You are responsible for ensuring that information you provide is accurate and up to date.

Sources of information

• Directly from you when you create an account, upload media, complete a purchase, submit a form, or contact us.
• From hosts and other authorized users who create events, invite members, configure access, or share event links.
• Automatically from your browser, device, cookies, logs, and similar technologies when you use the service.
• From payment processors, authentication providers, analytics providers, and other service providers that help us operate SimplyCandid.

Upload visibility and event sharing

SimplyCandid is designed so guest uploads can be shared within the event experience selected by the host. When you upload a photo to an event, that upload is event content and may be visible to the host and others with event access.

• Uploaded photos may appear in the live slideshow while the event is active.
• Uploaded photos may appear in the event gallery for the host and for viewers who have a gallery link, gallery session, preview access, or other host-authorized access method.
• Hosts and authorized host team members may review, moderate, download, export, or delete event media and related analytics.
• If enabled by the host, optional uploader names may appear in the gallery, host analytics, or live slideshow.
• Event media visibility may end after retention windows expire or sooner if a host deletes the event or removes the media.

How we use information

• To provide account access, event setup, guest upload flows, live slideshows, galleries, moderation, downloads, analytics, and related event tools.
• To authenticate users, prevent abuse, validate uploads, run file security scans, enforce rate limits, and protect the safety and integrity of the service.
• To process subscriptions, purchases, invoices, taxes, refunds, and account administration.
• To communicate with users about accounts, events, support, operational notices, legal updates, and other service messages.
• To measure usage, troubleshoot incidents, monitor performance, and improve product design and reliability.
• To comply with law, enforce our terms, resolve disputes, and respond to lawful requests.
• To send marketing communications only where we have an appropriate legal basis and to honor unsubscribe or opt-out requests.

Legal bases for processing

• Contract: to provide the services requested by hosts and to operate event experiences requested by users.
• Legitimate interests: to secure the platform, prevent fraud, understand service usage, improve features, and maintain reliable operations.
• Consent: where required for certain cookies, analytics, marketing communications, or other optional processing.
• Legal obligations: to retain records, respond to lawful process, address complaints, and meet compliance duties.

How we disclose information

• With hosts, host team members, and authorized viewers as part of the event features described above.
• With service providers that help us deliver hosting, storage, authentication, security scanning, analytics, payment processing, email delivery, and operational support.
• With professional advisors, auditors, insurers, or counterparties where reasonably necessary for legal, security, or business operations.
• When required to comply with law, regulation, subpoena, court order, or other legal process, or to protect rights, safety, and platform integrity.
• As part of a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising as those terms are defined under certain U.S. state privacy laws.

We do not sell your personal information.

Cookies and similar technologies

• Authentication and session cookies keep hosts signed in and help protect authenticated routes.
• Access-control cookies support preview access and gallery-session access where applicable.
• A preference cookie stores your selected theme setting.
• We use PostHog for product analytics and feature flags. PostHog only uses cookies or similar identifiers after you accept analytics cookies. If you decline, PostHog stays off. Our current PostHog host is https://us.i.posthog.com.

At this time, SimplyCandid does not respond to browser "Do Not Track" signals.

Service providers and third-party services

• Supabase for authentication and application database services.
• Stripe for subscriptions, invoices, and payment processing.
• Cloudflare R2 or equivalent object storage for uploaded media.
• PostHog for product analytics.
• Vercel for feature flag delivery and rollout controls.
• Sentry for error monitoring and operational diagnostics.
• Email delivery providers used for invite, reset, gallery, support, and transactional service emails.
• Security scanning providers used to validate uploaded files and attachments.

Third-party services and websites have their own privacy notices and practices. If you follow a third-party link or use an integrated third-party service, your information may also be governed by that third party's terms and policies.

Retention

• Event media and gallery visibility are generally retained according to the host's event lifecycle and platform settings. Unless otherwise configured, our default event retention target is 90 days.
• Access logs, security events, scan records, and operational diagnostics may be retained for shorter or longer periods when reasonably necessary for fraud prevention, abuse handling, incident response, and system integrity.
• Billing, tax, invoicing, and transaction records may be kept as long as required for accounting, dispute handling, and legal compliance.
• Account records, team memberships, and support records may be retained while accounts remain active and for a reasonable period afterward.
• Backups and archived copies may persist for a limited additional period before they are overwritten or deleted.

Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information, including access controls, signed access patterns, validation checks, malware or content scanning controls, monitoring, and provider security features. No internet or storage system is completely secure, and we cannot guarantee absolute security.

If we become aware of a security incident involving personal information, we will investigate, take reasonable response steps, and provide notice where required by applicable law.

International processing and transfers

SimplyCandid is operated from United States, and we or our service providers may process or store information in the United States and other countries where we or they operate. Those countries may have data protection laws that differ from the laws where you live.

Your rights and choices

Depending on your location and the nature of our relationship with you, you may have rights to request access, correction, deletion, restriction, objection, portability, or a copy of certain personal information, and you may withdraw consent where our processing relies on consent.

• To submit a privacy request, email support@simplycandid.app.
• We may ask you to verify your identity or authority before completing a request, including by confirming account access, host relationship, contact details, or event details.
• We aim to respond within the timing required by applicable law. If more time is permitted and needed, we will let you know.
• Some requests may be limited or denied where exceptions apply, including to protect other users, maintain security, complete transactions, comply with law, or preserve necessary business records.
• If your request relates to content or settings controlled by a host, we may direct you to that host or coordinate with the host as appropriate.

U.S. state privacy disclosures

Residents of certain U.S. states may have additional rights, which can include the right to know, access, delete, correct, or obtain a copy of personal information, and the right to appeal a denied request where required by law. We do not sell personal information or process sensitive personal information to infer characteristics about consumers.

To exercise applicable state-law rights or appeal a decision, contact support@simplycandid.app.

Marketing communications

We may send transactional or service-related communications that are necessary to operate accounts, billing, invitations, password resets, support, and event workflows. If we send optional marketing emails, you can opt out using the unsubscribe mechanism in the message or by contacting us.

Children's privacy

SimplyCandid is not directed to children under 13. Uploaders must be 13 or older. If you believe personal information from a child under 13 has been submitted, contact us and we will review and delete it where required.

Business transfers

If we are involved in a merger, acquisition, financing, due diligence process, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider, personal information may be disclosed, transferred, or assigned as part of that transaction subject to applicable law.

Complaints

If you have a privacy concern, complaint, or unresolved question, contact us first at support@simplycandid.app. If applicable law gives you the right to complain to a data protection or consumer protection authority, you may also do so.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the effective date.

Contact

For privacy questions, requests, or complaints, contact your event host where appropriate or email support@simplycandid.app. If you use the support address for a privacy request, we will route it internally as needed.