Privacy policy.

If you host an event: your name, email address and password (stored hashed), or your Google account details if you sign in that way; the events you create, including the name, dates, type, cover photo, welcome message and, for branded events, your business name and logo; and your payment history. Card details never reach us; Stripe handles them.

If you join an event as a guest: your first name and email address, the photos and video clips you choose to add, the consent wording you agreed to and when, and a cookie so you don't have to log in again for 90 days.

Voice notes (weddings only): the morning after a wedding we email its guests an invitation to record a voice message for the couple, up to three minutes. If you record one, we keep the recording and two copies of it (MP3 and WAV) privately for the couple. Only the couple can hear or download it, from the day after the invitation; it is never part of the Album and no other guest can hear it.

Photos. When a photo arrives we remove the hidden data cameras add to it, such as where it was taken and on which device, from every copy we keep. A full-size copy is stored privately so the host can download it; a smaller copy is what appears in the Album.

If you use a partner's code: which partner referred you and when, so we can pay them a share of what you pay in the six months after. The partner sees totals only, never your name, email or events.

If you apply to be a partner: your name, email address, business name, website and what you tell us about how you'd share hazel. Once approved, your code, the payments that earn you a share (amounts and dates only), and the bank details on the invoices you send us so we can pay you, used for nothing else.

Automatically: the pages you visit and the rough performance of the site, measured without cookies (see the Cookie Policy). We do not record your IP address against your account.

What we do not do: we do not use facial recognition, we do not analyse who is in a photo, we do not build profiles, and we do not sell or rent any of this to anyone. We do not use your photos in hazel's own marketing unless we have asked you first and you have said yes.

• To run the service you asked for (contract): creating events, letting guests join and add photos, building and sharing the Album, taking payment, sending the emails that are part of it, such as the invite, the Album link, the log-back-in code and the reminders before photos are deleted.
• Because you agreed (consent): when you join an event you tick a box saying your photos can go into that event's Album and be shared with the other guests. For a branded event the wording also says the business may use your photos in its own marketing. We keep a record of the exact wording you agreed to. You can withdraw consent at any time by asking us to remove your photos.
• To keep the service safe and working (legitimate interests): bot protection on forms, security logs, rate limits, the counter that tracks how many photos you have added, and checking uploads against lists of known illegal images (see section 6).
• Because the law says so (legal obligation): keeping payment records for tax, and reporting illegal content to the authorities.

We do not send marketing email. Every email we send is part of running an event you host or joined.

Photos you add go to the host first. Nobody else sees them until the host chooses what makes the Album and shares it. Your first name appears on each of your photos in the Album, so people know who took what. Your email address is never shown to other guests.

When an Album is shared, anyone with the link can open it. That is how a host passes it on to people who could not be there. For a branded event marked private, no Album is shared: the photos go to the business only.

A host can see the first names and email addresses of the guests who joined their event, and can download the photos. At a branded event, the business may ask if it can email you about its future events and news. Your email address only goes on its list if you tick the box.

A voice note goes to the couple only. No other guest, and nobody with the Album link, can hear it.

Photos and Albums: one year from the day uploads closed. We email the host 30, 7 and 1 days before, and guests once, 7 days before, so everyone can save what they want. The host can keep an event for another year with a one-off payment. Otherwise the Album goes offline on the date, the files are kept for 14 more days in case the host changes their mind, and then they are permanently deleted. A record that the event existed, with its name and dates, stays on the host's account; guest email addresses are removed from it at the same time as the photos.

Voice notes: kept with the event's photos and deleted with them, as above. Once sent, a voice note is the couple's: deleting your own hazel account doesn't take it back. If you want one removed, write to us.

Guest records: deleted with the event, as above.

Host accounts: until you delete the account from your settings, or ask us to. Payment records are kept for six years because tax law requires it.

Support messages: two years, so we can follow up on a reference.

Partners: bank details are deleted when you stop being a partner. The record of what we paid you is kept for six years because tax law requires it.

We keep data in the UK and the EU. These companies process it for us under written data processing agreements, and none of them may use it for their own purposes:

• Cloudflare: photo and video storage, bot protection on forms, and the illegal-image check in section 6.
• Supabase: the database and host sign-in, hosted in London.
• Vercel: runs the website.
• Resend: sends our emails.
• Stripe: takes payments and issues invoices. Stripe is a controller in its own right for the payment itself.
• Google: only if you choose to sign in with Google.

Resend and Stripe move some data to the United States. They do so under the UK and EU standard contractual clauses in their agreements with us.

Every upload is checked against lists of digital fingerprints of known child sexual abuse images held by the National Center for Missing and Exploited Children and the Internet Watch Foundation. This check cannot see or interpret a photo; it only recognises files already known to the authorities. A match is blocked, preserved as the law requires, and reported. We do no other automated analysis of photos.

Every photo in a shared Album has a Report button. A reported photo is hidden immediately, a person at hazel reviews it, usually the same day, and the host is told what was decided.

You must be 16 or over to create a host account. Guests joining an event give only a first name and an email. Hosts are responsible for the events they run and the people they invite. If you are a parent or guardian and want photos of your child removed from an event, tell us through the contact form and we will remove them.

You can ask us to show you the personal data we hold about you, correct it, delete it, give you a copy, or stop using it, and you can withdraw consent you gave. Guests can remove their own photos from an event while uploads are open. After that, and for anything else, write to us through the contact form with your reference; we answer within a month, usually much faster. Hosts can delete their account from their settings.

If you think we have got something wrong you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first.

Connections are encrypted. Passwords are stored hashed. Guests are identified by a signed cookie, and every request checks the photos and event belong to that guest. Originals sit in a private store that only the host's download can reach. If a breach ever affects your data we will tell the ICO within 72 hours and you without undue delay.

If we change anything that matters we will say so on this page, with the date at the top, and email hosts if the change affects them. Older versions are available on request.