Privacy Policy

01Who's who

Dropola lets hosts create an event and share a link or QR code so guests can upload photos and videos. Guests can upload without creating an account.

Your privacy rights depend on the role someone plays, so we keep them distinct:

• Hosts — registered users who create events and manage galleries.
• Guests / uploaders — people who add photos and videos to an event, usually without an account.
• People in the media — anyone (including children) photographed or filmed at an event.
• Website visitors — anyone browsing dropola.com.

02What we collect

We keep this to what we need to run the service:

• Event media — the photos and videos guests upload.
• Optional guest display names.
• Guestbook and RSVP entries — a guest's name, an RSVP answer (coming, not coming, or maybe) with a headcount and optional note, or a short guestbook message.
• Voice messages — short audio recordings a guest chooses to leave for the host on Pro and Premium events. Only the host can play them, and they never appear in a public gallery.
• Host planning boards — the private checklists and task notes a host writes in Dropola's planning tools. These belong to the host's account rather than to any single event, and no guest can see them.
• Host account details — email and login credentials (passwords are stored only as a secure hash).
• Billing records — which plan you bought and when (card details are handled by our payment provider, not stored by us).
• Basic technical data — such as IP address and device/browser type — needed to deliver and secure the service.

03How we use it

We use your data only to provide Dropola: creating and securing accounts, storing and displaying event galleries, processing payments, sending you service emails, and preventing abuse.

We do not sell your personal data, and we do not use it for advertising. We only send service and transactional email (like verification and payment receipts) — never marketing email.

04Who we share it with

We share data only with the providers that help us run Dropola, under appropriate data-protection terms:

• Stripe — to process payments securely.
• Hetzner — EU-based cloud object storage that stores the photos and videos you upload.
• An email provider — to send verification and service emails.
• Hosting and infrastructure — to run the website and platform.
• Tawk.to — the live-chat window in the account area for hosts on a paid plan. It loads only on those pages, and only for signed-in hosts: guests visiting an event page never load it. When it runs it receives your IP address, browser details and whatever you type into the chat, and it sets its own cookies to keep a conversation going across visits.

We may also disclose data where the law requires it.

05Cookies & tracking

Dropola uses only the cookies and local storage needed to run the service — for example, to keep you logged in, hold your event password for the tab you're in, and remember your language. We do not use advertising or third-party analytics trackers, and we do not profile you across other websites.

The one third party that sets its own cookies is the Tawk.to live-chat window described above. It appears only in the account area for hosts on a paid plan, so it never loads for event guests.

06Children & people in your media

You must be 18 or older to create a host account or to upload as a guest, even without an account.

Events often include children and other guests who are not themselves uploading anything. If you upload or record media of identifiable people, you're responsible for having their permission (or a guardian's permission for children) before sharing it.

07How long we keep it

Each event has two windows tied to the host's plan: how long guests can keep uploading, and how long the gallery stays accessible afterwards.

• Free — 1 month to upload, 30 days of access.
• Dropola Pro — 3 months to upload, 6 months of access.
• Dropola Premium — 6 months to upload, 1 year of access.

Guest contributions such as guestbook notes, RSVP answers and voice messages follow the same windows as the rest of an event's media. A host's private planning boards are tied to the account rather than to an event, and stay until the host deletes them or closes the account.

Hosts can delete events and media at any time, and can ask us to close their account.

When you delete content or close your account, we remove it, except where we must keep certain records (such as billing) for a limited legal period, or in short-lived backups before they cycle out.

08Your rights

You can ask to access, correct, export, restrict, or delete your data, object to certain uses, or withdraw consent. You can also complain to a data-protection authority.

09Security

We protect your data with measures such as encrypted connections (HTTPS), hashed passwords, access controls, and time-limited upload links. No service can promise perfect security, but we take it seriously and act promptly if something goes wrong.

10Contact & changes

This policy is governed by German law. We may update it; the date above always shows the current version. Full company registration and DPO/privacy-contact details will be added here once finalised.