Privacy notice

Who is responsible

pozare is operated by Spyros Gavriil and Panagiotis Tsembekis, individuals based in the Republic of Cyprus. pozare is not currently operated by a registered company. For a privacy question or request, contact hello@pozare.com.

Our role depends on the data. We are the controller of waitlist data, organiser account data and the limited technical data described below. For photos uploaded to an event, the event organiser decides why and how the photos are collected and is the controller; pozare acts as the organiser's processor, storing and displaying the photos on the organiser's behalf and under the pozare terms of use.

Early-access waitlist

When you join the waitlist, we store your normalized email address, the date and time you gave consent, the date and time you confirmed that you are 18 or older, the date and time of your submission, and the source of the signup. We use this only to run the adult-only waitlist and send you occasional updates about the pozare launch.

The legal basis is your consent. You can withdraw consent at any time by unsubscribing from any update email or by contacting hello@pozare.com; withdrawing consent does not affect anything done before withdrawal.

We keep waitlist data until you withdraw consent or six months after pozare's public launch, whichever happens first. If pozare has not launched within 18 months of your signup, we delete your data unless you renew your consent. Deletion is performed manually by the operators.

The waitlist is available only to people who are 18 or older. This is a self-declaration, not age verification. We do not ask for or store your date of birth or identity documents, and we delete the data of anyone we learn is under 18.

Event organisers

When an event is created, we collect the organiser's email address, the event name and date, and any logo or welcome image the organiser uploads. We also create short-lived sign-in links and sessions so the organiser can access the event dashboard, and we keep a record of administrative actions on the event (for example closing or deleting it) for security and accountability.

We use this data to provide the service (legal basis: performing our agreement with the organiser) and to keep it secure (legitimate interest). The organiser email is used for sign-in links and service messages about the event, not for marketing without separate consent.

Event guests and photos

Guests do not need an account. A guest opens an event link or QR code and can upload photos. For each photo we store the image, its original filename and file type, when it was uploaded, and an anonymous session token that links the guest's uploads together so photo limits and moderation work. Photos can show identifiable people, and we treat them as personal data.

The organiser can review, approve, reject, download and delete photos. Depending on the gallery setting the organiser chooses, other guests, or anyone who has the event link, can see published photos, and photos may appear on a live display at the venue. Previews and thumbnails we generate have their original camera metadata removed; the private original file is kept as uploaded until the event data is deleted.

As processor, we only handle photos on the organiser's instructions and do not use them for our own purposes such as advertising or training models. Guests who appear in a photo should contact the organiser first; you can also contact us and we will pass your request on or remove the photo.

The camera permission used by the in-app QR scanner is processed on your device only to read the code; no images from the scanner are stored or sent to us.

Measuring use and preventing abuse

To keep the service working and free from abuse we limit repeated requests. The application combines your IP address with the current date and converts it into a one-way cryptographic hash, which it stores with a counter and a time window. It does not keep the raw IP address in that database. Our hosting providers (Cloudflare and Railway) may keep standard infrastructure logs that include IP addresses, which they control as part of operating and securing their networks.

We count basic actions per event, such as a gallery being viewed or a photo uploaded, so organisers and we can see whether the service works. These counts are not linked to a persistent identifier stored on your device and are not used for advertising. The legal basis is our legitimate interest in running and improving the service.

Cookies and device storage

The marketing website sets no cookies. The event app uses only storage that is strictly necessary for it to work, such as keeping an organiser signed in or remembering a guest's session for an event. It does not use advertising or behavioural-tracking technologies. Details are in the cookie policy.

How long we keep data

• Waitlist data: as described above.
• Event photos and event data: deleted automatically 90 days after the event is closed or, if it was never closed, 90 days after the event date. The organiser may delete them earlier, and can ask us to delete them sooner at any time.
• Unfinished uploads: expire after about 17 minutes and are removed.
• Photos that could not be processed: deleted after 14 days.
• Sign-in links: expire after 15 minutes. Organiser sessions expire after 30 days, renewed while in use.
• Administrative action records (which event was changed or deleted, when and by whom): kept for 12 months for security and accountability, then deleted.
• Backups and provider logs: may persist for a short additional period under our providers' own schedules.

Service providers and where data goes

We use the following providers to run pozare. They process data on our behalf, or on the organiser's behalf for photos, under their data processing terms:

• Cloudflare for website hosting, the waitlist database (D1), content delivery and secure storage of event photos.
• Railway for hosting the pozare app, its database and photo processing.
• Resend (which may use Amazon SES) for sending sign-in and service emails to organisers.
• Google (Gmail) for the manual launch-update emails sent to the waitlist.

Some of these providers may process data outside the European Economic Area, including in the United States. Where that happens we rely on safeguards recognised under EU law, such as an adequacy decision (including the EU-US Data Privacy Framework) or standard contractual clauses. Instagram, TikTok and email links leave our website and are governed by those services' own terms and notices.

We do not sell personal data.

Photos of children

pozare is aimed at adults: organisers and waitlist members must be 18 or older. Event photos may nevertheless show children. Organisers are responsible for having the permission they need to collect photos at their event, including from parents or guardians for children. If you believe a photo of a child should not be on pozare, contact us and we will act on it promptly.

Security

We protect data with measures including encrypted connections, private photo storage with short-lived access links, hashed tokens, and restricted access for the operators. No online service is completely secure. If a personal-data breach occurs that puts people at risk, we will notify the Cyprus data protection authority and affected people as the law requires.

Your rights and photo removal requests

You may have rights to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent at any time. To make a request, or to ask for a photo that shows you to be removed, contact hello@pozare.com. For a photo, tell us the event name or link and describe the photo so we can find it; we may ask for additional information to confirm it is you. We respond within one month.

You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus or another competent data protection authority.

Changes to this notice

We will update this notice, and its date, when our processing changes. We will tell organisers about material changes.