Global Privacy & Data Protection Policy

1Roles: Event Host (Data Controller / Data User) vs. 3Snap (Data Processor)

To comply with the Malaysian Personal Data Protection Act 2010 & 2024 Amendment Act (PDPA), the EU/UK General Data Protection Regulation (GDPR), and global privacy frameworks:

• Event Host as Data Controller / Data User: The individual, couple, or organization creating an event on 3Snap ("Event Host") determines the purpose and visibility (Public Stream vs. Blind Drop) of media collected at their celebration.
• 3Snap as Data Processor / Service Provider: 3Snap acts strictly as a technical cloud conduit and storage processor on behalf of the Event Host, processing uploaded photos, short video clips, audio guestbook voice notes, and written wishes solely to deliver the event gallery, live projector wall, and ZIP archive.

2Information We Collect & Data Minimization

We collect only the minimum information strictly necessary to operate the service:

• Guest Event Media (Photos, Videos, Voice Notes & Wishes): Media files voluntarily submitted by event attendees. Guest image uploads are compressed client-side in your browser before direct transfer to Cloudflare R2 edge storage, stripping unnecessary raw camera EXIF/GPS location metadata by default.
• Optional Guest Attribution: Guests are never required to create an account, log in, or provide an email address. Any display name or table number entered on a wish card or voice note is 100% optional.
• Host Account & Event Data: Event title, custom URL slug, optional event date, host email address, and a cryptographically salted one-way hash (bcrypt/HMAC) of the host password. We never store plain-text passwords.
• Security & Abuse-Prevention Logs: Standard HTTP request headers (IP address and user-agent) processed ephemerally for DDoS mitigation, rate-limiting, and security auditing.

3Strict Zero-Biometric & Zero-AI-Training Guarantee (US BIPA & EU AI Act Shield)

In strict compliance with the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), and the EU AI Act: 3Snap does NOT extract, scan, collect, store, or process facial geometry, voiceprints, biometric identifiers, or biometric templates from any uploaded photo, video, or audio voice note. Furthermore, uploaded event media is never used to train, fine-tune, or feed any artificial intelligence or machine learning models.

4. Cookie & Local Storage Policy (EU ePrivacy Directive Compliance)

3Snap uses strictly necessary technical cookies and local storage exempt from prior tracking consent under Article 5(3) of the EU ePrivacy Directive, alongside a transparent consent record:

• 3snap_session_[slug] & 3snap_host_token: Encrypted, HTTP-only authentication cookies set exclusively when an Event Host logs into their administrative dashboard. Expires automatically after 7 days.
• 3snap_cam_broadcaster_[slug]: Local browser identifier used solely by an authorized Live Cam operator's phone to maintain seamless WebRTC camera reconnection if the mobile browser is backgrounded.
• 3snap_privacy_consent_v1: Stores your dismissal of the cookie notice banner so you are not prompted repeatedly.

We do NOT use third-party advertising cookies, Google AdSense, Meta/TikTok tracking pixels, or cross-context behavioral profiling.

5. Regional Data Protection Rights (Malaysia, EU/UK & United States)

Regardless of your country of residence, we extend comprehensive data subject rights to all hosts and attendees:

• 🇲🇾 Malaysia (PDPA 2010 & 2024 Amendment Act): In accordance with the General, Notice & Choice, Disclosure, Security, Retention, Data Integrity, and Access Principles, you have the right to access, correct, or withdraw consent for personal data or likenesses uploaded to an event gallery, and Data Portability where applicable.
• 🇪🇺🇬🇧 European Union, EEA, UK & Switzerland (GDPR): Under Articles 15–21 of the GDPR, you have the Right of Access, Right to Rectification, Right to Erasure ("Right to be Forgotten"), Right to Restrict Processing, Right to Data Portability (fulfilled via 1-Click Master ZIP download), and Right to Object. International transfers are safeguarded by Standard Contractual Clauses (SCCs) through our SOC-2 certified cloud sub-processors.
• 🇺🇸 United States (California CCPA/CPRA, VCDPA, CPA, CTDPA): We affirm that we do not "sell" or "share" personal information (as defined under Cal. Civ. Code § 1798.140) for monetary or cross-context behavioral advertising purposes. You have the right to know, the right to delete, and the right to non-discrimination.
• Instant Takedown & Erasure Mechanism: Any attendee or third party can request immediate removal of a photo, video, or voice note via our Content Report & Takedown Portal, by tapping the flag icon on any gallery item, or by emailing 3snap.official@gmail.com. Event Hosts can also permanently purge any file or entire event vault with one tap, which immediately deletes both the Cloudflare R2 object and the Supabase database record.

6. Data Retention, Sub-Processors & Cross-Border Security

In compliance with the Retention Principle (Malaysia PDPA Section 10 & GDPR Article 5(1)(e)), event galleries are retained only for the duration of the active event pass (up to 90 days for Full Event Passes so hosts and guests can download their keepsakes), unless deleted earlier by the Event Host. We partner exclusively with enterprise-grade, SOC-2 compliant infrastructure providers:

• Cloudflare R2: AES-256 encrypted object storage at rest and TLS 1.3 encryption in transit via direct browser-to-edge presigned URLs.
• Supabase (PostgreSQL): Managed database with Row Level Security (RLS) and cryptographic access controls.
• Resend: Transactional email dispatch strictly for host archive links and takedown/compliance alerts.

7Children's Privacy (US COPPA, GDPR-K & Malaysia PDPA)

3Snap event creation is restricted to individuals aged 18 and older. While family celebrations (such as weddings or birthdays) may include photos of minors uploaded by parents or relatives, any parent or legal guardian may request immediate permanent removal of any image depicting their child via our Takedown Portal or by emailing 3snap.official@gmail.com.