Privacy Policy

1.Who is responsible

[LEGAL COMPANY NAME] ([TRADING NAME]), [REGISTERED ADDRESS], is the controller of the account and order data described here. For the photos and videos of an event we act on behalf of the host, who decides what the event is for and who is invited. [CONTROLLER / PROCESSOR ROLES TO BE CONFIRMED ON LEGAL REVIEW]

Privacy questions and requests: privacy@maziflow.gr.

2.Hosts: what we process

The email address you give at checkout, and a name if you provide one.

Your event's name, date and, if you add them, venue, welcome message and cover photo.

Your order: the package, the amount, the date, and the payment provider's reference for the payment. We never receive or store your card details — the payment provider handles those.

For printed packages only: the delivery name, address, country and phone number, to produce and ship your cards.

Sign-in data: a password (stored only as a one-way hash) if you set one, sign-in sessions, and one-time sign-in or reset links.

The messages you send us when you ask for support.

3.Guests: what we process

Guests never create an account.

We process the photos and videos a guest chooses to upload, the time of each upload, and a name and a short message only if the guest decides to add them.

A random identifier is kept in a cookie on the guest's device so the host can see how many different people contributed. It is not linked to a name or used to follow the guest anywhere else.

As with any website, our servers briefly handle technical information such as the IP address, to deliver the page and to protect the service from abuse.

4.Support chat: what we process

If you write to us through the chat on our website, we keep your name, your email address, your messages and our replies, the page you wrote from and the time of each message.

We use them only to answer you. Writing to Support does not subscribe you to a newsletter, to Early Access or to any list, and we do not use Support messages for advertising.

A cookie (mf_chat) lets the same browser reopen your conversation; the link in our reply email does the same on another device. Nobody else can open it.

Notes our team writes for itself about a conversation are internal and are never sent to you. A resolved conversation is deleted automatically after the retention period we have set (12 months unless stated otherwise); you can ask us to export or delete yours at any time.

5.Reviews: what we process

After your event you may write a review. We keep the rating, your words, the name you choose to show, the event it is about and the date.

A review is published only if you tick the box that allows it, and only after a member of our team has read it. We never change your words or your rating. A separate box decides whether a photo of yours may ever be shown next to it; without it, none is.

You can withdraw your review from your account at any time. It then leaves our website at once and your permission ends with it.

6.Why, and on what basis

To provide the service you bought and to process your order — performance of our contract with you.

To keep the service secure, prevent abuse and handle reports — our legitimate interest.

To keep the accounting records the law requires — legal obligation.

[LEGAL BASES TO BE CONFIRMED ON LEGAL REVIEW]

7.Who can see an event

Only people who have the event's QR code or link, and only what the host allows: the host can make the event upload-only, approve uploads before they appear, and hide or delete anything.

Event pages are not listed anywhere and search engines are told not to index them.

8.Who we share data with

Service providers that process data for us, under contract, and only for the purposes above: OVHcloud (hosting of the application and private storage of event media, France; encrypted database backups, Italy), Postmark (delivery of the emails we send you; its servers are in the United States, under its EU data-transfer commitments), our payment provider once payments are activated (it sees your payment, we see only its reference) and, for printed packages, the printer and the courier (name, delivery address, phone number). If the Cloudflare Turnstile check is switched on for our forms, Cloudflare processes the connection data needed to tell a person from a script. [PROCESSOR LIST, LOCATIONS AND TRANSFER MECHANISMS TO BE CONFIRMED ON LEGAL REVIEW]

We do not sell personal data and we do not share it for advertising.

9.No advertising use of your photos

Uploading to an event gives us no right to use that content in advertising, on our website or on social media. We would only ever do that with the separate, explicit permission of the people entitled to give it.

10.How long we keep things

Photos, videos and download archives: until 30 days after the event date (or the later date reached by a paid extension). They are then permanently deleted from our storage; the deletion is carried out automatically shortly after the expiry, and nobody has access to the files in the meantime.

Account and order records: for as long as tax and accounting law requires. [RETENTION PERIOD FOR ACCOUNTING RECORDS TO BE CONFIRMED ON LEGAL REVIEW]

Emails we sent you and security logs: for a limited period needed to run and protect the service. [PERIODS TO BE CONFIRMED]

11.Your rights

You can ask to access, correct or delete your personal data, to restrict or object to its processing, and to receive it in a portable form. You can also complain to your data protection authority.

Send requests to privacy@maziflow.gr or use the report form. We may need to confirm who you are — or, for event content, that you are entitled to ask — before we act. If your request concerns a photo at someone's event, the host can usually remove it fastest.

12.Analytics

We count a few anonymous steps of the purchase journey (for example, that a checkout was opened) to understand how the website works. These counts contain no identifier, no IP address and no cookie. We use no third-party analytics or advertising trackers.