Privacy Policy
1. Data controller
The data controller is Johann Flipo, sole proprietor (SIREN 107 376 071), 6 rue d'Armaillé, 75017 Paris, France. Contact: contact@fotelya.com. No Data Protection Officer (DPO) has been appointed, as such an appointment is not required for the activity carried out; requests relating to personal data are handled directly by the publisher.
2. Our principle
Fotelya is built around data minimisation: Guests share their photos and videos with no account and no sign-up. We only collect what is strictly necessary for the Service to work. We do not sell any data, display no advertising, and do not use any data to train third-party artificial intelligence.
3. Data we process
- Organizer: email address, event settings, and billing data (processed by Paddle).
- Guest: the media they choose to upload, and minimal technical metadata. EXIF geolocation data is removed upon upload.
- Technical data: security logs, and audience measurement via Cloudflare Web Analytics, a tool without cookies or individual identifiers: statistics are aggregated and anonymous and do not allow identification; as such, this tool is exempt from prior consent.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Provision of the Service (album, live wall, download) | Contract execution; guest consent for scanning |
| Security, prevention of abuse and fraud | Legitimate interest |
| Content moderation | Legitimate interest and legal obligation |
| Billing and accounting | Legal obligation |
| Respectful audience measurement | Legitimate interest (aggregated/anonymized data) |
5. Recipients and subcontractors
We work with carefully selected subcontractors, bound by a Data Processing Agreement (DPA), and prioritize processing within the European Union. The recipients of your data fall into the following categories:
- hosting and cloud infrastructure provider (European Union);
- database provider (European Union);
- provider of AI-powered content moderation (European Union): Mistral AI (Paris, France), for automated analysis of photos, videos and messages;
- payment and billing provider: Paddle, acting as the official reseller (Merchant of Record);
- provider of transactional email delivery (organizer link, service notifications), limited to the email address and message content.
The detailed list of our subcontractors is available upon simple request at contact@fotelya.com. No data is sold or transferred for advertising purposes.
Automated AI moderation. When activated by the organizer (three-level setting, disableable), photos, videos and messages sent may be automatically analyzed by our subcontractor Mistral AI (European Union) in order to detect manifestly inappropriate content (explicit nudity, violence, etc.). This analysis does not make any final decisions on its own: the organizer retains control and the final say (manual validation, restoration or removal). No data is used to train AI models.
6. Transfers outside the European Union
Our data is by principle hosted and processed within the European Union. When a subcontractor involves processing outside the EU, this is governed by appropriate safeguards (European Commission standard contractual clauses and additional measures).
7. Retention periods
- Media and event data : automatically deleted at the end of the retention period of the subscribed offer.
- Billing data : retained in compliance with legal obligations (including accounting).
- Security logs : retained for a limited and proportionate period.
- Encrypted backups : for disaster recovery purposes, encrypted backups are kept separately; data deleted from the platform may remain there for up to twelve (12) months at most, before being overwritten by automatic rotation. These backups are never accessed except in the event of an emergency restoration.
8. Security
Media is encrypted in transit and at rest (AES-256). Access is via expiring signed links and a code (PIN), on non-public galleries, with non-enumerable identifiers. EXIF location metadata is removed. Administrative access is protected by two-factor authentication.
9. Your rights
In accordance with the GDPR, you have the rights toaccess, rectification, erasure, objection, restriction, portability, the right to withdraw your consent at any time, and to set directives regarding the fate of your data after your death. Any identifiable person in media has a right to image and may request its removal. To exercise your rights: contact@fotelya.com. We respond within one month.
10. Complaint
You may lodge a complaint with the CNIL (French data protection authority, cnil.fr).
11. Minors
The Service is not intended for persons under 15 years of age without the consent of a parent or legal guardian. We delete any data of a minor brought to our attention in the absence of such consent.
12. Residents outside the European Union
We apply a GDPR-inspired protection standard worldwide. Specific rights may apply depending on your place of residence:
- California (CCPA/CPRA) : rights of access, deletion and objection to the "sale" of personal data. Fotelya does not sell data.
- Brazil (LGPD) : equivalent rights of access, correction and deletion.
- Other jurisdictions: contact us to exercise your local rights.
13. Cookies
The use of cookies is detailed in our Cookie Policy. No advertising trackers are used.
14. Changes and contact
This policy may evolve. The applicable version is the one published on this page. For any questions regarding your data: contact@fotelya.com.