Legal
Privacy Policy
What we collect when you run an event, what your guests’ photos carry with them, and what you can ask us to do about any of it.
Last updated August 7, 2026
What actually matters here
We collect the minimum needed to run your event, we never sell your data, and we never use your photos to train machine-learning models. The one thing worth knowing: because we never alter your photos, they keep the metadata your camera wrote into them — which on most phones includes GPS coordinates.
Who we are
eRoll is a sole proprietorship based in Quebec, Canada. In this document, “eRoll”, “we” and “us” mean that business, and “you” means the person using the service.
The person in charge of the protection of personal information is the proprietor of eRoll. You can reach them at support@eroll.app for anything in this document. We answer in English or French.
What we collect from organizers
When you create an organizer account we collect what we need to identify you, run your events, and bill you once.
We do not build advertising profiles, and we do not track you across other websites.
- Your email address, your first and last name, and your preferred language. If you sign in with Google we receive your email, name and profile picture from Google — never your Google password, and no access to anything else in your account.
- If you sign up with a password, only a cryptographic hash of it is stored. We cannot read your password, and neither could anyone who obtained the database.
- The details you enter about your events: name, type, dates, time zone, location and description.
- Your IP address, briefly, when you sign in, register, reset a password or use the contact form. This is what stops someone from guessing passwords or flooding our inbox. These records are deleted automatically once the time window passes, usually within the hour.
- A record of which automated emails we have sent you about each event, so that a retry can never send you the same email twice.
What we collect from guests
Guests do not create an account and we never ask them to sign in. We do not build a profile of a guest, and we cannot connect a guest to any other event.
We do not run facial recognition on photos and we do not extract biometric information of any kind. We never try to identify who is in a photo.
- The photos themselves, and the time they were uploaded.
- The name a guest types, if the organizer turned on the name prompt. It is optional, and it is whatever the guest chooses to write.
- A small preview image, which the guest’s own browser creates from the photo before uploading it.
The metadata inside your photos
eRoll never alters a photo. That is the point of the product: you get the original file, at full resolution, exactly as the camera wrote it.
It also means the file keeps everything the camera embedded in it — the date and time, the camera or phone model, the exposure settings, and on many phones the GPS coordinates of the place the photo was taken.
We do not read, index or search that metadata, and we do not use it for anything. But it is inside every original in the gallery, and anyone who can open that gallery can download the original and read it.
The small preview images in the gallery grid are re-created by the browser and do not carry this metadata. The full-size originals do.
If this matters for your event, turn off location tagging in your phone’s camera settings before the event starts. Once a photo has been uploaded, that metadata is part of the file we stored.
Payments
Card numbers never reach our servers. The payment form is provided by Stripe, and your card details go straight from your browser to Stripe. We could not see them if we wanted to.
What we store is the record of the transaction: the amount, the currency, the plan, the Stripe payment identifier, whether it succeeded, and any promo code you used.
Stripe processes these payments and handles your card data under its own privacy policy.
Who else handles your data
We share your information only with the service providers that make eRoll work. They act on our instructions and cannot use it for their own purposes. We do not sell your personal information, and we do not share it with anyone for advertising.
These providers store and process data on servers located outside Quebec, principally in the United States, which means it may be subject to the laws of those countries. We chose established providers that commit contractually to protecting it, but you should know that it leaves the province.
The providers we rely on:
- Vercel — hosting the website, and page-view analytics.
- Neon — the database holding accounts, events and payment records.
- Amazon Web Services (S3) — storage for photos and QR code images.
- Stripe — payment processing.
- Resend — sending the automated emails.
- Google — only if you choose to sign in with Google.
How long we keep things
We keep different things for different lengths of time. Nothing is deleted automatically before these periods are up, and you can always ask us to remove your data sooner.
- Photos: at least one year after the event ends, matching the commitment in our Terms of Service. In practice we keep them longer.
- Your account and your event records: for as long as your account exists.
- Payment records: for as long as tax and accounting law requires us to keep them, which is longer than the rest.
- Rate-limiting records containing IP addresses: deleted automatically, usually within the hour.
Your rights
Quebec law gives you rights over the personal information we hold, and we honour them whether or not you live in Quebec. Email support@eroll.app from the address on your account and we will answer within 30 days.
If a photo of you was uploaded to someone’s event and you want it taken down, write to us as well — you do not need an account, and you do not need the organizer’s permission. If you are not satisfied with how we handled a request, you can file a complaint with the Commission d’accès à l’information du Québec.
- Access — ask us for a copy of the personal information we hold about you.
- Correction — fix your name and email from your account, or ask us to correct anything else that is wrong.
- Deletion — ask us to delete your account, your events and your photos.
- Withdrawing consent — stop using the service and ask us to remove everything, at any time.
- Portability — ask for your information in a structured, commonly used electronic format. Your photos are downloadable at full resolution from your gallery whenever you want them.
How we protect it
The site is served over HTTPS everywhere. Photos are uploaded straight to our storage provider over an encrypted connection, using links that are single-use and expire within a minute.
Galleries are private by default. A gallery becomes visible to guests only if the organizer deliberately turns it on.
Passwords are stored only as hashes. Email verification and password-reset links are stored hashed as well, can be used once, and expire.
No system is perfect and we will not claim ours is. If something goes wrong, we will tell you — see the next section.
Photos of children
eRoll is not intended for use by children. You must be old enough to enter into a contract to create an organizer account.
Photos of children may well be uploaded at events like birthdays and family gatherings. As the organizer, it is your responsibility to be sure that is acceptable to the parents who are there.
If you are a parent and a photo of your child is in an event gallery, email us and we will remove it.
If something goes wrong
If a confidentiality incident occurs that presents a risk of serious injury, we will notify the Commission d’accès à l’information du Québec and the people affected, as Quebec law requires, and we will keep a register of those incidents.
Changes to this policy
If we change how we handle your information in a way that matters, we will update the date at the top of this page and email account holders before the change takes effect.
Contact
Any question about this policy, any request about your data, and any photo you want removed all go to support@eroll.app.
If any part of this is unclear, email us and we will explain it.