Privacy Policy
Last updated: 1 September 2026
This Privacy Policy explains how GuestDrops ("we", "us") collects, uses and protects personal data when event hosts and their guests use our platform. We aim to follow UK GDPR and the Data Protection Act 2018.
Who we are
GuestDrops provides an event memory platform that lets hosts collect photos, videos, audio messages and guestbook entries from guests via a QR code, and manage them in a private dashboard. The host of an event is the data controller for the guest content on their event; GuestDrops acts as a data processor for that content, and as a controller for host account data.
Data we collect
Account data: name, email, password (stored only as a secure hash), plan and billing status. Event data: event details, settings and privacy configuration you create. Guest-contributed content: photos, videos, audio recordings, guestbook messages, optional guest names and captions. Technical data: IP address (used for security/rate-limiting), device and browser information, and, with your consent, analytics events. Payment data is processed by our payment provider (Stripe) — we do not store full card details.
How we use data
To provide the service (host events, store and display content), to secure the platform (authentication, rate-limiting, abuse prevention), to process payments, to send transactional emails (e.g. receipts, notifications, expiry reminders), and — only with your consent — to measure product usage via analytics.
Lawful bases
Performance of a contract (providing the service you sign up for); legitimate interests (security, service improvement); consent (optional analytics cookies and marketing sign-ups); and legal obligation (retaining accounting records).
Guest consent
Guests are informed at the point of upload that their content is shared with the event host. Hosts are responsible for ensuring they have an appropriate basis to collect guest content and for honouring guest requests relating to their own contributions.
Sharing & processors
We use trusted processors including a cloud database and object storage provider (media hosting), Stripe (payments), Resend (transactional email) and, with consent, Google Analytics 4. Error diagnostics may be sent to an error-monitoring provider with personal data scrubbed. We do not sell personal data.
Retention
Host account data is kept while your account is active. Event content is retained according to your plan's access window and your settings. When you delete an event or your account, we permanently delete the associated records and irreversibly make all content inaccessible; the underlying media files are then removed from our storage provider in line with its deletion/retention lifecycle. Financial records are anonymised and retained only as long as legally required.
Your rights
You have the right to access, correct, delete, restrict and port your data, and to withdraw consent. You can download a full copy of your data at any time from Account → Your data → "Download my data". Deleting your account permanently removes your events, photos, videos, audio, guestbook messages and stored files; payment records are anonymised. To exercise other rights, contact us at privacy@guestdrops.com.
Security
Passwords are hashed, sessions use secure, HTTP-only cookies, private galleries are protected by server-side access checks and short-lived signed media links, and access is rate-limited. No system is perfectly secure, but we take reasonable measures to protect your data.
International transfers
Where data is processed outside the UK/EEA, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.
Children
GuestDrops is not intended for children under 16. Hosts must not knowingly collect content from children without appropriate consent.
Contact & complaints
For any privacy question or request, contact privacy@guestdrops.com. You also have the right to complain to the UK Information Commissioner's Office (ICO).