Privacy Policy

This policy describes how Kreativ Vantage (“we”) handles personal information in Klik, a service for collecting photos and videos from guests at an event. It is written to describe what the software actually does rather than to reserve rights we do not exercise.

Two kinds of people use Klik

Organizers buy a plan, create an event and receive the gallery. Guests scan a QR code at that event and upload photos. We hold very different information about each, so the rest of this policy separates them.

What we collect from guests

When a guest joins a gallery, we store exactly this:

• A display name, if they enter one. It is optional and it is free text. Nobody checks it and a guest may use any name they like.
• The date and time they agreed to the consent notice, and a version identifier for the exact wording they were shown.
• The photos and videos they upload, along with the file type, size, dimensions, duration for video, and the time the photo was taken.

We do not require a guest to give an email address, a phone number or an account to join a gallery or upload to it. A guest is identified to one gallery by a cookie on their own device.

A guest may choose to sign in with their email address so they can find the galleries they joined again later, from any phone. If they do, we store that email address, and link the galleries they join while signed in, and the ones this device joined before, to it. Signing in is never needed to view, upload or download.

Where the organizer offers it, a guest may choose to leave an email address when they join, with a separate tick, to be sent the gallery's best photos the morning after. We store the address, which words they agreed to and when, their language, and their phone's time zone so the email arrives in their morning. We send one email and then delete the address; we keep only the time it was sent. The photos in it are chosen automatically from how sharp, well lit and loved they are, and the organizer can change the choice. A photo the organizer later hides stops showing in the email. The email has a link to stop all such emails for good: we then keep a one-way fingerprint (a SHA-256 hash) of the address, which lets us refuse to send to it without being able to read it.

If the organizer turns them on, a guest can also heart a photo and comment on it. A heart is recorded against the guest's cookie for that gallery, and other guests see only how many hearts a photo has, never whose they are. A comment needs a signed-in guest, and stores what they wrote and when; everyone who can see the photo sees the comment, with the guest's display name for that gallery beside it.

If the organizer sets photo challenges, a photo taken for one is marked with it, and everyone in the gallery sees how many photos each challenge has. If the organizer also turns on the leaderboard, the five guests who have shared the most are listed in the gallery by their display name, with how many photos they shared. A guest who gave no name is never listed.

An organizer can also set up a kiosk: a tablet at the venue that only takes photos for the gallery. A photo taken on it is stored like any other upload, against the kiosk rather than the person who took it, and the kiosk shows the consent notice below on its start screen to everyone who uses it. Because a kiosk is shared, a photo taken on one is removed by asking the organizer, who can take down anything in the gallery.

What the consent notice says

Before uploading, every guest is shown and must agree to this statement: “I understand that photos and videos I upload may be visible to everyone with access to this event gallery, and I have the right to share them.”

That consent is deliberately narrow. It covers the one gallery the guest is uploading to. It does not permit us or the organizer to use those photos for marketing, on a public page, or anywhere else. When we change that wording we create a new version, and guests who agreed earlier stay recorded against the version they actually saw.

Location and camera data is removed

Phones embed a great deal in a photo file: GPS coordinates, the device serial, sometimes the owner’s name. We re-encode every photo on upload, which discards all of it. Videos are not re-encoded, so instead we remove the location a phone writes into a video as soon as it arrives, and until that is done the video plays only for the person who filmed it. The one thing we deliberately keep is the time a photo or video was taken, because galleries are ordered by it. We never keep the location.

One exception, for professional photographers: a host on Klik Premium or Venue can choose to keep the camera details (camera, lens, settings, copyright) on JPEG photos their own team uploads. Even then the location is removed, and guests’ photos are always re-encoded.

We do not analyse faces

Klik performs no facial recognition, no face grouping and no biometric analysis of any kind. We do not generate face templates, faceprints or any other biometric identifier, and we do not send photos to a third party that does. If that ever changes it will be an opt-in feature announced in advance, not a silent update to this page.

Search, scenes and screening

When search is in use, each photo (or a video’s first frame) is described in one plain sentence and a few scene words such as “cake” or “dancing”, so people in the gallery can find photos by what is in them. The description never names anyone or guesses their age, race or anything else about who they are. It is kept with the photo, deleted with it, and included when you download what you shared. A search only ever finds photos the person searching could already see. The same pass checks for nudity, gore and hate symbols; a photo it flags is hidden until the organizer looks at it, and our team may look too.

What we collect from organizers

• Name, email address and a password, which is stored only as a bcrypt hash.
• A username, generated or chosen, used to invite co-hosts.
• Which plan the account is on and when it was activated.
• If signing in with Google: the name, email and profile image Google returns.
• Designs made in the print studio, and any photos or logos uploaded for them. These are kept with the event and deleted with it.
• Passkeys, if you add one: its public key, which kind of device or password manager made it, its name and when it was last used. Your face, fingerprint and phone PIN never leave your device and we never receive them.
• Proofs and watermarks, if you are a photographer using them: the words and logo of your watermark, and the clean original of each proof, which only you can see until you release it. Everyone else sees the watermarked copy. They are deleted with the event, and your watermark with your account.

We never see card details. Payment happens on a page hosted by Stripe. Card numbers go from the buyer to Stripe and never touch our servers or our database.

Technical information

• IP addresses are used to rate-limit sign-in and signup attempts, which is what stops someone guessing passwords in bulk. They are stored only as part of a counter and are deleted after 24 hours.
• Cookies are used for signing in, for remembering that a guest has joined a gallery, for remembering that someone entered a gallery password, and, for 30 days, for remembering which referral link brought you, so the person who invited you can be credited if you sign up. They are functional, set to expire, and readable only by the server. We run no advertising cookies, no analytics cookies and no third-party trackers.
• Photos waiting to upload are kept in your browser's storage on your own device until they are sent, so a dropped connection or a closed tab does not lose them. They stay on the device: we receive each one only when it uploads. Each is deleted from the device once it is in the gallery, when you remove it from the upload tray, when you remove everything you added, or after 30 days if it never sends. On a kiosk tablet they are kept on the tablet the same way.

How long we keep things

The backup is the one place where deletion is not instant, and we would rather say so than imply otherwise. It exists because a bug in our own deletion code would otherwise destroy the only copy of somebody’s wedding, and it is configured so that we cannot delete from it early even if we wanted to. It empties itself on a fixed rotation.

Who else touches the data

We use a small number of providers, each for one job:

• Cloudflare R2 stores photos and videos, in the United States.
• Neon hosts the database.
• Vercel runs the application.
• Resend sends account email, and the one highlights email a guest asks for.
• Stripe processes payments and holds the card details we never see.

These are used only for a feature that is switched on, and each says whether it is in use today:

• Cloudflare Workers AI describes each photo in one sentence and a few scene words, so it can be searched and grouped, and checks it for nudity, gore or hate symbols. It is not asked who anyone is, and keeps nothing once it has answered. Not in use yet.
• Cloudflare Stream turns videos into streams that play smoothly on a phone. Its copy is deleted when the video is. Not in use yet.
• Replicate sharpens and enlarges a photo when the organizer asks it to. It receives that one photo and deletes it within an hour. Not in use yet.
• Sentry records errors so we can fix them: what failed and where in our code. Never a photo, a name or an email address. In use.

That is the complete list. We do not sell personal information, we do not share it for advertising, and we do not use guest photos to train machine learning models.

Who can see a photo

Access is controlled by the organizer. A gallery can be public to anyone with the link, protected by a password, or private. An organizer can hide an individual photo or a whole folder, and can create a share link for one photo, for a folder, or for a selection of photos, that can later be revoked, expired, or limited to a number of views. A folder link shows what is in that folder when it is opened, including photos added to it later, but never a photo the organizer hid. A guest can hide their own uploads too, after which only they and the event’s organizers see them, and can make a share link to their own photos, which they or the organizer can turn off. Either can send a link to particular people by email: it then opens only for the organizers and for the accounts it was sent to, signed in with that address. We keep each address with the link, to know who may open it, until the person is taken off it or the link’s event is deleted, and send it one email with the link. Every request is checked against those rules at the moment it is made, so revoking access stops a link working immediately; a photo already showing on someone’s screen stays viewable there for a few minutes at most.

A guest can delete anything they uploaded. The organizer can also remove it, which is what the consent notice tells guests before they upload.

A guest can edit their own photos, and the organizer can edit any photo in their gallery. An edit is always saved as a new copy beside the original, which is never changed. When a guest deletes a photo, or removes everything they added, every edited copy made from it goes too, including one the organizer made.

A comment is seen by everyone who can see the photo it is on. Its author can delete it. The organizer can hide it, and so can we after reports; a hidden comment is kept, visible only to its author, the organizer and us, so it can be reviewed and shown again if the report was wrong.

Your choices

Guests: download a copy of everything you added to a gallery, with a file saying what we hold about you there, or remove all of it, your name, hearts and comments included, from the bottom of that gallery at any time. If you signed in, you can do both for any event from “Your galleries”, and deleting your account removes everything you shared everywhere. Otherwise write to us at hello@klik.kreativvantage.com and tell us which event. Unless you signed in, or asked for the highlights and they have not gone yet, we hold no email address for you, so we will usually need the organizer to confirm which guest record is yours.

Organizers: delete your account and everything in it yourself, from the Account page, or write to the same address. The Account page also downloads a copy of everything we hold about your account. We action erasure immediately in the live system; the backup copy expires within 31 days as described above.

Depending on where you live you may have rights to access, correct, delete or port your personal information, and to object to how it is used. We apply the choices above to everybody who asks, rather than checking which state you are in first.

Children

Klik is not directed to children under 13 and we do not knowingly collect personal information from them. We are aware that children are photographed at weddings and parties. A child appearing in a photograph an adult uploaded is not a child using the service, and we perform no analysis that would identify them. If you believe a child under 13 has created uploads themselves, contact us and we will remove them.

Security

Photos are stored in a private bucket and served only through short-lived signed links issued after an access check. Passwords are hashed with bcrypt and never stored in a form we could read. Sign-in and signup are rate-limited. We are a small team and we do not claim perfect security, but we would rather describe the specific measures we take than offer the usual reassurance that we take security seriously.

Changes

If we change this policy in a way that affects what we do with information we already hold, we will say so rather than quietly updating the date at the top.

Contact

hello@klik.kreativvantage.com, or the phone number below. See also our Terms of Service.