This Privacy Policy explains how Rosulo LLC (“Rosulo,” “we,” “us,” or “our”), the company behind Allbum, collects, uses, and protects information when you use the Allbum website, mobile application, and related services (the “Service”). We built Allbum around one simple rule: your event memories belong to you. We do not sell your personal information to third parties, and we never will.

Event owners: name, email address, country, and language preference; authentication data (passwordless verification codes, or your Google account identifier if you sign in with Google); event details you create (event name, description, location, dates, and configuration); and billing information processed by our Merchant of Record, Paddle (we do not store your card number).

Guests: a display name and, optionally, an avatar image; a guest session token stored on your device so you can return to the same event; and basic visit information (timestamp and device fingerprint) used to distinguish repeat visits from new guests. Joining an event does not require creating an account or providing an email address or phone number.

Photos and videos: the media you upload, along with metadata such as capture time, dimensions, file type, and which event/session it belongs to. Videos are limited to two minutes in length.

Technical information: IP address, device and browser type, and app usage data, collected automatically to operate, secure, and improve the Service. We use local device storage (such as browser local storage or secure device storage) to keep you signed in — we do not use third-party advertising cookies or cross-site trackers.

We use the information above to: provide and operate the Service (creating events, processing guest joins, storing and delivering media, and enabling reactions); process payments and prevent fraud; send passwordless login codes, event notifications, and service-related communications by email, SMS, or WhatsApp when you request them; enforce event limits (guest count, media count, and availability windows) that you or the event owner configured; respond to support requests; and maintain the security, integrity, and reliability of the Service.

We do not sell, rent, or trade your personal information, your photos, or your videos to advertisers, data brokers, or any other third party, and we do not use your event photos or videos to train third-party models. We only share information with the service providers described below, and only as needed to operate Allbum on your behalf.

We rely on a small number of specialized providers to run the Service, each bound by their own privacy and security obligations to us:

• Amazon Web Services (S3) — private, encrypted storage for your photos and videos. Your media is never made public; access is granted only through short-lived, signed links generated for you or the event's guests.

• Paddle — Merchant of Record for event purchases. Paddle receives your payment details directly and handles billing, taxes, and refunds; we receive only confirmation of payment and billing metadata.

• Google / Apple — optional sign-in providers. If you choose to sign in with Google or Apple, we receive your name, email address, and account identifier from that provider.

• Resend / Amazon SES — delivery of verification codes and transactional emails.

• Twilio / WhatsApp Business — delivery of SMS or WhatsApp invites and notifications, when you or an event owner request them.

Google account data: if you sign in with Google, we receive only your name, email address, and Google account identifier — we never access your contacts, files, photos, or any other data stored in your Google Account. We use this information solely to create and authenticate your Allbum account; we do not use it for advertising and we never sell or share it except as described in this policy. You can revoke Allbum's access to your Google account at any time in your Google Account permissions settings (myaccount.google.com/permissions), and deleting your Allbum account removes the link to your Google account. The same applies to signing in with Apple.

We may also disclose information if required by law, subpoena, or legal process, to protect the rights, property, or safety of Rosulo, our users, or the public, or in connection with a merger, acquisition, or sale of assets (in which case we will notify affected users).

We retain event media and account information for as long as your account or event remains active, and for a reasonable period afterward to comply with legal, tax, and accounting obligations and to resolve disputes. Payment, billing, and refund records are retained for as long as required for tax, accounting, and dispute or chargeback purposes. Uploads that are never confirmed are automatically deleted within 24 hours. You may request deletion of your account and associated data at any time by contacting us — see Section 8 below.

We use industry-standard safeguards to protect your information, including encryption in transit (HTTPS/TLS), encryption at rest for stored media, hashed and salted verification codes and session tokens, and access controls limiting who can view event data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we work continuously to protect your information and to detect and respond to incidents promptly.

Allbum is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, contact us at contact@allbum.me and we will promptly delete it.

Depending on where you live, you may have the right to access, correct, export, or delete the personal information we hold about you, or to object to or restrict certain processing. To exercise any of these rights, email us at the address below with your request; we will verify your identity and respond within the time required by applicable law. Event owners can also update or delete event and guest data directly through the app. contact@allbum.me

To delete your account and the personal information associated with it, email contact@allbum.me from your account's email address; we verify and process deletion requests within 30 days. Deleting an event as an event owner also deletes that event's guest records and media. Guests who joined without an account can erase the guest session stored on their device by clearing the site data for app.allbum.me in their browser settings.

Our infrastructure is hosted with providers operating in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country of residence.

We may update this Privacy Policy from time to time. If we make material changes, we will notify active event owners by email or in-app notice before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

Questions or requests regarding this Privacy Policy or your personal information can be sent to the email below. contact@allbum.me