FotoDrop Privacy Notice — Global
Website: fotodrop.online
Prepared: 16 October 2026
Version: english-launch-2026-10-16-v7-withdrawal-review-source-prepared
This Notice explains personal-data processing for visitors, hosts, guests, purchasers, people appearing in uploaded media, and people contacting FotoDrop. It covers Free albums, Mini, Full, eligible add-ons and Event Kit. Free does not accept videos. School products are not offered under this Notice. Albums and accounts on fotodrop.eu and fotodrop.online are separate.
Your media is not used for advertising or AI training. An album link can nevertheless be forwarded, and authorised recipients can save copies. Read section 4 before sharing sensitive or family content.
1. Who is responsible and how to contact us
Martin Žídek, trading as FotoDrop
Business identification number (IČO): 73767018
Registered address: Počernická 514/54, 108 00 Praha 10 – Malešice, Czech Republic
Privacy, rights requests and general enquiries: [email protected]
Product, order and refund support: [email protected]\
FotoDrop is established in the Czech Republic. The EU General Data Protection Regulation (GDPR) applies to personal data processed in the context of that establishment, including when users are outside the EU. The domain, checkout currency and storage region do not switch off that protection. Additional local laws may give you further rights.
Our role and the host's role
We are a controller for the purposes we determine ourselves, including administering the service relationship, managing accounts and orders, security and abuse prevention, legal compliance, support and our optional marketing.
The host decides why event content is collected, whom to invite, which access settings to use, and what to publish or remove. We process hosted content on the host's instructions to provide those functions. Where the host is an organisation or professional acting as a controller, FotoDrop is its processor, or an authorised subprocessor where the host acts for another controller. The Event Data Processing Addendum governs that processing. A payment provider is not the controller of album content merely because it handles a purchase.
A person's purely private or household use may fall outside some GDPR obligations for that person; this does not exempt FotoDrop from its own obligations. A professional host must give attendees its own appropriate privacy information. You may contact either the host or FotoDrop about content concerning you. Where we act on a host's behalf, we assist and forward the request as appropriate, while handling our own controller obligations directly.
2. What we collect, where it comes from and why
We receive information from you, from hosts and other uploaders, from your browser when it connects to the service, and from payment or email providers for the functions described below. Someone may upload a photograph or video showing you even if you have never visited FotoDrop.
| Data and source | Purpose | GDPR basis or role |
|---|---|---|
| Host email, account identifier and album details supplied by the host | Create and administer albums, authenticate the host, send sign-in links and important service notices | Contract and steps requested before a contract, Article 6(1)(b); legitimate interests under Article 6(1)(f) for an organisation's representatives |
| Photos, eligible videos, captions, guestbook contributions and other content deliberately submitted by users, plus technical records such as upload time, media type, size and retained capture timestamp | Store, organise, display, share and retrieve content according to the host's requested service and access choices | Processing on the host's behalf; the host is responsible for its applicable lawful basis. For our own necessary security or legal handling, the bases stated below apply. |
| Payer email, site, purchased items, amount and currency, provider references, payment/refund status and order communications, received from the purchaser and Stripe/Link | Supply and verify purchases, reconcile payments, administer refunds and resolve disputes | Contract with an individual purchaser, Article 6(1)(b); legitimate interests for organisational contacts and dispute handling, Article 6(1)(f); specific accounting/tax duties, Article 6(1)(c) |
| Checkout acceptance and immediate-start records: exact text, versions, time and order reference | Demonstrate the contract and the choice actually made, and administer legal rights | Contract, legal obligations where relevant, and legitimate interests in evidencing lawful transactions; this is not marketing consent |
| Event Kit setup: event name, date, venue, organiser note, privacy choice and removal-contact email | Create and administer the requested workspace | Contract/host instructions; organisational-contact legitimate interests where applicable |
| Email correspondence, content reports, withdrawal statements, privacy requests and reasonable verification details | Answer the request, protect the affected people, handle moderation and comply with law | Contract where relevant; legal obligations, Article 6(1)(c); legitimate interests in support, safety and legal claims, Article 6(1)(f) |
| Limited network-derived identifiers, request results and technical diagnostics | Rate limits, abuse prevention, like deduplication and service security | Legitimate interests in secure and reliable operation, Article 6(1)(f), with minimisation and safeguards |
| Deletion/restoration evidence: internal host ID, keyed hashes of email and IP address, coarse browser/device type, session fingerprint and result | Protect accounts, investigate disputed deletion/restoration and document the operation | Legitimate interests in security and dispute resolution, Article 6(1)(f) |
| Optional marketing subscription and evidence of the choice | Send the tips, news and offers you choose to receive | Consent, Article 6(1)(a); limited evidence and suppression records also support accountability and respect for opt-outs |
| Optional visit measurement | Disabled on this site; no optional measurement events are recorded | Not currently carried out |
Our legitimate interests do not override your rights automatically. We consider necessity, your reasonable expectations and the effects on you, especially where children or sensitive situations are involved. You can object as described in section 8.
Providing an email address is necessary to administer a host account and send secure sign-in links. Necessary order information is needed for a purchase. Guests do not need a FotoDrop account to upload. Marketing, optional captions and optional event notes are not a condition of the core service. Optional visit measurement is disabled. Declining or withdrawing optional consent does not remove your paid service.
FotoDrop's application does not store full payment-card details or duplicate the buyer's billing address as part of its ordinary order records. Stripe/Link collects the billing and payment information it requires. Authorised access to a provider dashboard may expose transaction information held by that provider; that is different from duplicating it into FotoDrop's database.
The application's rate-limit and like-deduplication records do not store raw IP addresses for those purposes. Deletion/restoration records exclude raw IP addresses, full User-Agent strings and full referrer URLs. A hash can still be personal data; we do not treat it as anonymous merely because it is hashed. Network and infrastructure providers necessarily receive connection information, including an IP address, to deliver and secure requests.
We do not run facial recognition or create biometric identification profiles. Images may still reveal sensitive facts about a person. Do not use ordinary event fields to collect health records, identity documents or other sensitive records unrelated to the album; an ordinary upload checkbox is not permission to process every category of personal data.
3. Storage, recipients and international transfers
Album storage for this website
For fotodrop.online, album database records and media use dedicated Cloudflare D1 and R2 stores, separate from fotodrop.eu and the existing regional sites. Initial placement is fixed by the deployment, not chosen by each user. This service does not offer an EU-only or country-specific data-residency commitment, and there is no residency selector. Processing can occur outside your country, including outside the EEA. Separate storage does not mean separate legal responsibility or an exemption from GDPR.
Who receives data
| Recipient | Function and scope |
|---|---|
| The host and people with the album access permitted by the host | Receive the content and related visible information selected for sharing. Private collection and publication settings can narrow this audience. A live wall exposes selected content to its physical audience. |
| Cloudflare | Application hosting, delivery, database and media storage, and infrastructure/security services. It receives the data needed for those functions. See Cloudflare's customer DPA and privacy policy. |
| Resend, operated by Plus Five Five, Inc. | Delivery of service email and opted-in marketing where used; recipient email, message content and necessary delivery records. See Resend's DPA and privacy policy. |
| Zoho Mail and the relevant Zoho group service entity | Email correspondence and support, including information you choose to send. See Zoho's privacy policy. |
| Stripe/Link and their payment partners | Payment, billing, fraud prevention, tax, receipts, refunds and transaction support. They have their own controller responsibilities for relevant payment and compliance activities and may have processor roles for other activities. See Stripe's privacy policy and Link's privacy notice. |
| Professional advisers and public authorities, when necessary | Limited information required for accounting, legal advice, lawful requests, safety, enforcement or legal claims. This is not routine access to every album. |
We use service providers under appropriate data-protection terms for processing on our behalf. They do not receive a general licence from FotoDrop to use your event media for their own advertising or AI training. Provider notices may separately apply where providers determine purposes such as their own fraud prevention or legal compliance.
FotoDrop service emails use the sending identity of the site on which the album was created. Link transaction messages are separate. Album photographs are not routinely sent to Stripe/Link for payment processing. If you send media to support, the email provider also processes that correspondence; avoid sending unnecessary private media.
Transfers outside the EEA
Service providers, their support operations and their subprocessors may process information outside the European Economic Area, including in the United States and other countries identified in their processing disclosures. This can concern network delivery, support, email, payment, security, logs and recovery services even for an EU-stored album. Authorised album recipients may also be outside the EEA.
Where FotoDrop or a provider transfers personal data subject to GDPR to a country without an applicable adequacy decision, the transfer must be covered by appropriate safeguards, normally the European Commission's Standard Contractual Clauses and any necessary supplementary measures and transfer assessment. We rely on an adequacy framework only where the recipient, data and transfer are actually covered. Where UK or Swiss transfer rules apply, corresponding additional safeguards are used where required. Choosing the global website or accepting the Terms is not blanket consent to otherwise unlawful transfers.
Contact [email protected] for information about the safeguards applicable to your data or a copy of the relevant safeguards, with appropriate protection of confidential information and others' rights.
We do not sell personal information, rent marketing lists, or share personal information for cross-context behavioural advertising. We do not combine album activity with advertising profiles.
4. Album access and security
By default, a shared album is visible to people holding its link or QR code. A recipient can forward the link or save content. Customer albums and their media are excluded from public sitemaps and use search-indexing protections. This reduces discovery but is not an access-control guarantee and cannot undo copies made elsewhere.
Where an eligible private-collection mode is enabled, unpublished content is kept from other guests. The host controls publication and deletion. An uploader may access their own supported upload history. This feature changes visibility, not the lawful basis for every possible use or the normal retention schedule.
Connections to FotoDrop use HTTPS/TLS. The host session cookie uses HttpOnly, Secure and SameSite protections. We apply access restrictions, validation and abuse controls appropriate to the service. No internet service or shared link can guarantee absolute security.
Optional browser-side photo encryption
For an album with the photo-encryption feature enabled, prepared photos are encrypted in the browser before upload and stored as ciphertext. The complete shared link carries the decryption key. A person holding that link can decrypt content which their album permissions allow.
If the complete link is lost, the host can sign in to manage an active album and use the email/recovery workflow to recover the saved key in the browser while the saved recovery information remains available. Because FotoDrop stores recovery information and the account information used by that process, this is not a promise that FotoDrop is technically incapable of accessing the photo content. We do not describe this arrangement as zero-knowledge storage.
Photo encryption does not hide account, album, order or operational metadata. Do not assume it covers videos, captions, guestbook text, event details or every derived item. It does not erase downloaded copies. Keep the complete link and management access secure, and do not send them in an ordinary support message.
5. Retention, deletion and recovery
We keep personal data only for the relevant service, documented legal requirement or other justified purpose. The schedules below distinguish media from accounts, finance and security evidence. A financial retention requirement does not justify retaining an album's media or keys.
Albums and accounts
| Data | Retention and deletion rule |
|---|---|
| Active Free album | 14 days of hosting from first successful upload; an album never used for a successful upload expires after 365 days from creation |
| Active paid album or workspace | The hosting period and expiry applicable to its purchases; extra storage alone does not extend hosting |
| Expired album | Normal access closes at expiry; a 30-day recovery grace period precedes permanent-deletion eligibility |
| Album the host asks to delete | Guest access stops immediately; recoverable trash lasts seven days; restoration preserves the original expiry |
| Content after the relevant recovery period | Ordinary lifecycle cleanup completes within 30 further days, unless particular content must be preserved for a specific legal reason |
| Residual backups or recovery copies under our control | Not used for ordinary service after deletion; expire or are erased through the recovery cycle within 90 days after deletion from the active system, unless a specific lawful hold applies. Deletion is reapplied after any restoration. |
| Album-level host email | Removed when the album is permanently erased, subject to separate justified records below |
| Account email and account details | Kept while the account exists; account erasure is handled separately from deleting one album |
| Deletion-notice recipient record | Up to 30 days from the deletion request |
We send an expiry reminder seven days before hosting ends. Delivery is not guaranteed. Grace and trash periods do not promise continued ordinary access. Permanently erased content cannot be recovered by buying an extension.
For account erasure, contact [email protected]. We confirm the scope where necessary, including remaining albums, close the account and erase or de-identify data without undue delay, subject to lawful exceptions and the response timetable in section 8. A legally required prompt erasure is not delayed merely to use the full ordinary recovery window. Your deletion request does not erase copies saved by other users.
Orders and financial evidence
Our ordinary application payment archive, which we keep after an album is erased, has a five-year retention deadline measured from payment completion, or creation for an incomplete payment. Stripe order records for purchases on this site have a seven-year retention deadline measured from the order's creation date (five years for orders created before 15 October 2026).
Contract evidence for a paid order — the accepted document versions and their hashes, your checkout choices with their timestamps, and the contract confirmations we sent with their hashes and sending records — is kept for seven years from the creation of the order (five years for orders created before 15 October 2026). Records of Free album agreements are not currently deleted automatically. We keep it to prove the content of the contract and to establish, exercise or defend legal claims (legitimate interests, Article 6(1)(f) GDPR). Seven years covers the longest general consumer limitation period that applies to our customers, including periods that end only at the end of a calendar year. It contains no photos or videos. At that deadline we erase or irreversibly anonymise the ordinary record unless a specific retention duty or necessary, documented unresolved claim applies.
Separate accounting, tax or legally required transaction evidence may have a different, longer statutory retention period. We retain only the fields needed for that duty until the applicable period and any legally required extension end. This is not a claim that every FotoDrop record must legally be kept for seven years, or that seven years is enough for every tax document.
Limited retained evidence may include purchased items, amounts and currencies, site and order identifiers, policy/consent wording and versions, timestamps, provider references, and refund or reconciliation facts. It excludes album media, album keys, full card details and raw webhook payloads.
When an order is resolved, its paid benefits have been applied, and no pending refund, unresolved refund request, reconciliation problem or active processing operation remains, permanent album erasure also removes the payer contact and Event Kit setup snapshot from retained order details and resolved archived purchase details. An unapplied or unresolved order may retain the contact and setup information needed to finish or reconcile it, including event name, date, venue, organiser note, privacy choice and removal-contact email. Removing an email from one archive field is not treated as erasure from every snapshot.
We review an exceptional unresolved-order or legal hold at least every 90 days. Each hold must have a specific reason and scope. Once it ends, we remove unnecessary identifiers and apply the normal deadline; resolving a hold does not automatically restart a fresh retention period.
Other records
| Data | Retention and safeguards |
|---|---|
| Support, content-report and rights-request correspondence | Normally up to three years after resolution, for follow-up, accountability and legal claims; unnecessary attachments and excess personal data are removed earlier |
| Deletion/restoration security records | 180 days from the event, except a documented specific legal or security hold |
| Other application diagnostic and abuse logs | Normally no longer than 30 days, unless a specific incident or operational need justifies a documented, reviewed extension; persistent media-related records follow their album's lifecycle |
| Marketing recipient address | While subscribed; sending stops after withdrawal without undue delay, and the address is removed from active marketing lists within 30 days unless separately needed for another lawful purpose |
| Marketing-consent evidence | The relevant choice and text, version, language and timestamps while relied on, then for up to three years after withdrawal or expiry; normally a keyed/hashed email and a limited account reference, not a duplicate clear-text mailing list |
| Minimal unsubscribe/suppression record | Only as long as necessary to prevent unwanted re-enrolment or contact from a retained mailing source; purpose reviewed annually. It is not used for marketing or held indefinitely after the relevant source is removed. |
| Optional analytics | Disabled; no new optional analytics records are created on this site |
An actual legal obligation, investigation or dispute may require longer retention of particular information. We restrict access and use during that period and remove it when the reason ends. Provider records held for a provider's independent legal purposes, especially payment records, follow that provider's applicable notice and law; we assist with directing requests rather than promising to erase records we do not control.
6. Photo processing and metadata
FotoDrop uses an explicit allowlist for metadata in processed photo uploads. After optimisation, we create a minimal metadata block instead of restoring the original metadata wholesale.
Original metadata retained: the capture date and time (EXIF DateTimeOriginal), a usable fallback file timestamp where needed, the original UTC offset (EXIF OffsetTimeOriginal) where present, and fractions of a second (EXIF SubSecTimeOriginal) where present. These support ordering and exports and can still reveal when a photograph was taken.
Original metadata removed: GPS/location fields such as coordinates, altitude and direction; camera, phone and lens make/model; serial numbers and unique device or image identifiers; author, owner, copyright and contact metadata; comments, descriptions and vendor MakerNotes; XMP/IPTC data about people, faces, contacts and places; embedded metadata previews; and other original metadata outside the timestamp allowlist.
A sorting/export timestamp may also be stored in the photo's technical record. A JPEG may contain a FotoDrop processing-version marker without personal data. Preparation, including a maximum 4,000-pixel long edge, happens in the browser before the prepared photo is uploaded. Where photo encryption is enabled, that prepared photo is then encrypted before upload.
These rules concern processed photos, not a guarantee of identical stripping for every video or other file type. Metadata minimisation does not remove identifying information visible in the image, spoken in a video, or entered in a caption or guestbook. Removing a copyright metadata field does not extinguish copyright. Keep original files separately if you need their original resolution or metadata.
7. Necessary storage, optional measurement and email choices
Necessary cookies and browser storage
We use storage necessary for functions you request, such as host authentication, access controls and security. The host cookie fotodrop_session lasts up to 30 days. Clearing cookies or browser storage may sign you out or remove access to browser-specific upload history or a recovery function.
We do not use advertising cookies, third-party analytics or social-network sign-in on these FotoDrop sites. We do not display advertising. A separately hosted Stripe/Link checkout has its own necessary payment/fraud technologies and applicable privacy information; our statement about FotoDrop's own cookies is not a claim that the provider uses no cookies.
Optional first-party visit measurement
No optional visit measurement runs on this site. Necessary security and payment records continue because they serve different purposes.
Optional marketing
We send tips, news and offers only when you separately opt in. Purchasing, uploading, accepting the Terms or requesting immediate service does not subscribe you. Every marketing email provides an unsubscribe route; you can also use account preferences where offered or email [email protected]. We do not require sign-in to honour an unsubscribe request. Withdrawing marketing consent does not stop requested sign-in emails or essential album/order notices.
We do not use artificial intelligence to process photos or videos uploaded to FotoDrop and do not use them to train AI models. This statement concerns customer media. It is not a claim that Stripe or another provider never uses automated fraud or security tools on transaction or technical data.
8. Your rights
Depending on the processing and applicable law, you can request access and a copy, correction, erasure, restriction, and portability of data processed by automated means on the basis of consent or contract. You can object to processing based on legitimate interests and withdraw consent at any time without affecting the lawfulness of earlier processing. Objection to direct marketing ends that marketing; you do not need to explain why.
Contact [email protected]. We respond without undue delay and ordinarily within one month after receiving a GDPR request. Depending on the complexity and number of requests, GDPR may allow an extension of up to two further months; we explain the reason within the first month. A shorter mandatory local deadline is respected. Requests are normally free. We may ask only for information reasonably necessary to identify the data or confirm your entitlement to act; an identity-document copy is not a routine requirement.
We do not routinely obtain extra identification just to identify every person in a photograph. Give us a non-secret album or content reference and enough context to locate your data safely. We may have to protect other people's rights, comply with a legal retention obligation, or ask the host to act on content they control. If we cannot fulfil all or part of a request, we explain why and how to challenge the outcome.
We do not make decisions with legal or similarly significant effects about you solely through automated processing within FotoDrop. Automatic upload validation, rate limits and verified-payment checks are used to operate the service; you may ask for human review of an account or access decision. Stripe/Link's independent fraud decisions are described in their notices.
You may complain to a competent supervisory authority, including the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, uoou.gov.cz. Where applicable, you may instead contact the authority for your habitual residence, place of work or the alleged infringement. You need not contact us first to exercise that right.
Additional international rights
Where local law applies, you may also have rights to know categories or specific pieces of information, obtain a copy, correct or delete information, use an authorised agent, or appeal our response. Send an appeal to the same privacy address and identify the response you want reviewed. We do not discriminate against you for exercising an applicable privacy right.
We do not sell personal information or share it for cross-context behavioural advertising. Optional visit measurement is disabled as described above; we do not require you to enable Global Privacy Control to obtain GDPR rights. US state-law rights depend on the relevant law’s scope and conditions, but our GDPR obligations are not made conditional on reaching a US revenue or user threshold.
Where applicable, UK users can complain to the Information Commissioner’s Office, Australian users to the Office of the Australian Information Commissioner, and New Zealand users to the Office of the Privacy Commissioner. Other competent local supervisory or enforcement bodies remain available. These references do not imply that every law in every country applies to every FotoDrop activity.
9. Children and people appearing in media
Hosts and purchasers must be adults with legal capacity; direct guest use is intended for people aged at least 16 and subject to applicable local requirements. These English services are not school products or services directed to young children. An adult may upload lawful family photographs that show children, but must consider the child's interests and any required permission. A child's appearance in a photograph is different from the child directly using the upload service.
We do not knowingly permit children below the direct-use age to operate their own upload session. If you believe a child has supplied information directly contrary to these rules, contact us. We take appropriate steps to stop the unauthorised processing and erase or otherwise lawfully protect the information. A parental notice, erasure request or report does not have to be made through the uploader's 60-minute deletion interface.
10. Changes to this Notice
We update this Notice when our processing changes. Material changes are brought to affected users' attention through the service or an appropriate email notice. We seek a new choice where a new purpose requires consent; continuing to use FotoDrop is not that consent. Earlier contractual or data-protection rights are not removed retrospectively.
For service and purchase details, see the Terms of Service and Refunds and Withdrawal Policy.