Privacy policy
Last updated 20 October 2026
Toloma lets event hosts collect the photos and videos their guests take, through a QR code and a web page. This policy explains what personal data we handle when you visit toloma.app, open an event page, upload to it, reply to its invitation or order an event, and what control you have over it.
In short: we collect as little as we can, we use no analytics or advertising trackers and no cookies beyond the one that keeps a draft open, everything is stored in the EU, and files are deleted automatically when an event’s plan ends.
- Who we are
- What we collect
- Why, and on what basis
- How long we keep it
- Who can see event galleries
- Who processes it for us
- Your rights
- Security
Who we are
The controller of the personal data described here is the operator of Toloma:
Toloma is run from Luxembourg. The operator's full legal details (name, address and registration numbers) will be published here before paid plans open. Until then, write to contact@toloma.app.
For anything about your data, write to contact@toloma.app.
Event content is different. For the photos, videos and texts on an event page, the event’s hosts decide why and how they are shared: they are the controller, and we process that content on their behalf, under our data processing terms. This policy still explains how we handle it. For orders, emails, abuse limits and logs, we are the controller.
What we collect
When a guest uploads to an event
- The photos and videos you choose to upload, exactly as you send them. They can show people, and the files can carry details your phone stores in them, such as the date, the phone model and, if your camera saves it, the location. We make small previews of photos for the gallery; the previews leave these details out.
- A random device identifier, created by the event page and kept in your browser’s local storage. It lets us apply upload limits per guest rather than per venue Wi-Fi. It isn’t linked to your name or to any other site.
- Your IP address, used only to limit abuse (for example, too many uploads or wrong PINs from one connection in an hour).
- The event’s PIN, if the event has one and you enter it. It stays in your browser’s local storage on your device so you don’t have to type it again. We store only a protected (hashed) version of each event’s PIN.
When a guest leaves a message
- Your message, if the event has a guestbook: the name you give, what you write, and the voice or video note you record or choose. It shows in the event’s gallery, to everyone who has its link (and PIN), and on its photo wall, and the hosts can delete it. Your browser asks before the page can use your microphone, and only while you record.
When a guest replies to an invitation
- Your reply, if the hosts ask for one: the name you give, whether you’re coming, how many of you, and the note you write. Only the hosts see it, on their dashboard, and they can download the replies as a spreadsheet.
- The random device identifier described above, kept only in protected (hashed) form with your reply, so that your phone changes its reply rather than adding another. Your phone also keeps a copy of your reply in its local storage, to show it to you.
When you host an event
- The event’s details: its name, the hosts’ names, the date, the welcome message, the banner and background photos (uploaded by the hosts; an older banner may be a link), and the chosen template, language, colours and plan.
- Your email address, given when you start a draft and in the order form, to manage your draft, your order and your event: we email you the draft’s link and key and one reminder before it’s deleted, the order confirmation (with your dashboard key and our terms), the confirmation if you cancel, and a link when you ask for a new dashboard key. We don’t send newsletters or advertising. If you cancel your order, we also keep the name you give and the time of the cancellation with the order.
- What you send us by email: your email address, your name if you give it, and the content of your messages.
- Payment information: payments are handled by Stripe. We receive your name, email address, the amount and the payment status, never your full card number.
- Your private dashboard link contains a secret key. We store only a protected (hashed) version of it.
When anyone visits toloma.app
- One cookie, only for hosts with a draft. When you start a free draft, your browser keeps its dashboard key in a cookie for 14 days, sent only to that draft’s dashboard, so you can come back to it. It is needed for the service, isn’t shared and isn’t used for anything else.
- No analytics, no advertising trackers. Our fonts and images are served from toloma.app itself, so your browser doesn’t contact third parties to display our pages. The one exception is an event’s banner photo, which the hosts can link from another site.
- Technical logs: the time of each request, the page or function called, and any errors, to keep the service running and secure.
Why, and on what basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Running an event page and its gallery: storing uploads, showing them to the people who have the link, letting the hosts download and delete them | Uploads, guestbook messages, replies to the invitation, event details | Our contract with the hosts (Art. 6(1)(b)); for guests, the legitimate interest of the hosts and of guests in sharing the event’s memories (Art. 6(1)(f)) |
| Taking orders, payments and answering questions | Email, messages, payment information | Contract, or steps before one (Art. 6(1)(b)) |
| Preventing abuse and keeping the service secure | IP address, device identifier, technical logs | Legitimate interest in a safe, available service (Art. 6(1)(f)) |
| Accounting and tax records | Payment information, event details | Legal obligation (Art. 6(1)(c)) |
We never sell personal data, never use it for advertising, and never use your photos or videos for anything other than running your event.
How long we keep it
| Data | Kept for |
|---|---|
| Photos, videos, their previews, and guestbook messages with their voice and video notes | Until the end of the event’s plan, counted from the event date: 30 days (Basic), 3 months (Standard) or 12 months (Premium), plus any extension the hosts buy. Then 7 more days for the hosts to download, after which they are deleted. Hosts can delete any file earlier. |
| Replies to an event’s invitation | Until the event’s files are deleted (the end of its plan, plus 7 days), or earlier if the hosts delete them or cancel their order |
| ZIP downloads prepared for the hosts | 7 days |
| Deleted files | Recoverable by us for 7 days after deletion (to undo mistakes), then gone |
| IP addresses and device identifiers in abuse limits | Less than a day |
| Technical logs | 30 days |
| Emails | As long as needed to answer you, and at most 3 years after our last exchange, unless they are part of an order |
| Drafts never made live, with their test uploads | 14 days after the draft was started, then deleted |
| Orders, payments, and the event details they relate to | 10 years, as required for accounting records |
When an event’s files are deleted, its link shows a short page saying the event has ended, with the event’s name.
Who can see event galleries
An event’s gallery can be seen by everyone who has its link or QR code, so hosts should share it only with their guests. Premium events can require a PIN. The hosts can see, download and delete every file. Event pages ask search engines not to index them.
We access uploads only when it’s needed to run the service, for example to fix a problem the hosts report or to remove clearly illegal content.
Who processes it for us
These providers process data on our behalf, under contracts that require them to protect it:
| Provider | What for | Where |
|---|---|---|
| Microsoft (Azure) | Hosting the website, event pages, files and logs | France (France Central region) |
| Microsoft (Azure Communication Services) | Sending our emails to hosts | EU |
| OVHcloud | Domain name and forwarding of email sent to contact@toloma.app | EU |
| Google (Gmail) | The mailbox that receives email sent to contact@toloma.app | EU and United States |
| Stripe | Payments | EU and United States |
Where data leaves the European Economic Area, it is protected by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses. We may also disclose data when the law requires it.
Your rights
You can ask us to access, correct or delete your personal data, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on legitimate interest, you can object at any time. Write to contact@toloma.app; we answer within one month.
If you appear in, or uploaded, a photo or video you want removed, ask the event’s hosts, who can delete it straight away from their dashboard, or write to us with the event’s link and a description of the file.
You can also complain to a data protection authority, in particular the Commission nationale pour la protection des données (CNPD) (https://cnpd.public.lu) or the authority where you live.
Security
All traffic is encrypted (HTTPS). Guests receive a short-lived link that can only add one file, never read or delete others. Dashboard keys and PINs are stored only in protected (hashed) form. Files are stored encrypted by Microsoft Azure.
Children
Toloma is meant for adults organising events. Hosts are responsible for the photos shared at their event, including photos of children, and can delete any of them.
Changes
If we change this policy, we’ll update the date at the top of this page. For significant changes that affect existing events, we’ll tell the hosts by email.