Privacy Policy

1. Who controls your data

The controller of the personal data described here is Lucas Fonseca Soluções em Tecnologia Ltda., a company incorporated in Brazil under company number (CNPJ) 40.142.373/0001-11.

For anything to do with data protection — exercising your rights, asking a question, or reporting a problem — write to info@capsule.film. That address reaches the people who can actually act on it, and it is the same address our data protection contact (the "Encarregado" required by Brazilian law) monitors.

Because we are established in Brazil, the Brazilian LGPD applies to everything we do. Where we offer the service to people in the European Economic Area or the United Kingdom, the GDPR applies as well, and where we serve residents of US states with their own privacy laws, those apply too. This document covers all three.

2. What we collect

What we hold depends on how you use the service.

If you are a host (you create an account and set up an event):

• Your name and email address, used to create the account and sign you in. Authentication is handled by our provider Clerk.
• The events you create: event name, date, and settings such as the photo limit, the number of guests and the reveal time.
• If you sign in with Google, we receive your name, email address and profile picture from Google in order to create the account. We never receive your password.
• If you buy a paid plan, the order record: which plan, the amount, the date and the payment status. Card details are entered directly with our payment provider and never reach our servers.

If you are a guest (you join an event without creating an account):

• An anonymous device identifier, generated on your device and kept in your browser's local storage. It lets us recognise the same device so we can apply the photo limit and show you the events you have joined. It is not linked to your identity, and it is not a tracking cookie.
• A display name you choose when you join. It can be a nickname.
• The photos you take and upload, with the date and time of upload.
• A technical access cookie, created when you join an event, that authorises your browser to view that event's gallery. It is valid for that event only, is not readable by anyone else, and exists to stop people who were not invited from seeing the photos.
• If you choose to sign in with an account, which is optional, we can then recognise you across your devices so you do not have to enter your name again or take up two guest slots at the same event.

If you are a co-host (a host invited you to help run their event):

• The email address the invitation was sent to. We did not get it from you: the host who invited you typed it, and they choose who to invite. If you do nothing, the invitation expires after seven days and we keep no account for you.
• If you accept: the name and email address on the account you accept with, the date you accepted, and the version of the terms you agreed to.
• A record of what you do in the event, such as reconnecting a guest, removing someone from the list or buying a larger limit. It is tied to your account so the host can see who did what.
• Being a co-host does not give you the photos. Gallery access exists only if you also join the event as a guest, and then the same reveal rule applies to you as to everyone else.
• The host can end your access at any time, and you can object to this processing or ask us to delete your record by writing to the address in section 14.

From everyone, we collect basic technical information needed to serve the site securely. If the application hits an error, we record technical details of the failure so we can fix it, with identifying information such as display names and event access codes stripped out before the report is sent.

3. The photos, and the people in them

Photos can show people, so we treat them as personal data. They are private: only the host of an event and the guests who joined that event can see them. Nobody else has access to your content.

Before the reveal, guests see only a blurred preview, generated on their own device. The original file does not leave our private storage until the reveal time the host set. We do not sell your photos, we do not license them, and we do not use them for advertising or to train artificial intelligence systems.

We do not run facial recognition. We do not group photos by face, we do not build face templates, and we do not offer a "find photos of me" feature. Under the GDPR, doing so would mean processing biometric data, and we have chosen not to hold that category of data at all.

Whoever takes and uploads a photo is responsible for having the agreement of the people in it, including a parent or guardian where a child appears. If you appear in a photo and want it removed, write to info@capsule.film and we will delete it — you do not need an account to ask, and you do not have to explain why.

4. Why we use your data, and our legal basis

We use personal data only for the purposes below. For readers in the EEA or the UK, the GDPR basis is given first; the corresponding Brazilian LGPD basis follows in brackets.

• To run the service: creating events, signing hosts in, receiving and storing photos, and releasing them at the reveal. Basis: performance of a contract, GDPR Art. 6(1)(b) (LGPD Art. 7, V).
• To apply limits and prevent abuse: using the device identifier to enforce photo limits and to stop the service being misused. Basis: our legitimate interest in keeping the service working and affordable, GDPR Art. 6(1)(f) (LGPD Art. 7, IX).
• To communicate with you: answering what you send us and sending essential notices about the service, such as a reveal happening or a problem with your event. Basis: performance of a contract and legitimate interest, GDPR Art. 6(1)(b) and (f) (LGPD Art. 7, V and IX).
• To deliver a co-host invitation: emailing the address a host gives us so that person can help run that one event. It is the only email we send about it, and the link expires after seven days. Basis: the legitimate interest of the host, and ours, in letting an event be run by more than one person, GDPR Art. 6(1)(f) (LGPD Art. 7, IX).
• To tell a host that a co-host they authorised has bought something for their event, including what was bought and whose card was charged. Basis: performance of a contract, GDPR Art. 6(1)(b) (LGPD Art. 7, V).
• To keep the service secure and to fix it when it breaks. Basis: legitimate interest, GDPR Art. 6(1)(f) (LGPD Art. 7, IX).
• To understand how the site is used, and to measure whether our advertising works, if and when we switch those tools on. Basis: your consent, GDPR Art. 6(1)(a) (LGPD Art. 7, I). Nothing in this category runs unless you have agreed — see section 9.
• To meet legal and regulatory obligations, such as keeping tax records of payments. Basis: legal obligation, GDPR Art. 6(1)(c) (LGPD Art. 7, II).

Where we rely on legitimate interest, we have weighed that interest against your rights and freedoms, and you can object at any time — see section 8.

One of those purposes uses data we did not get from you: a co-host invitation reaches you because a host typed your address. This policy is how we tell you that, where it came from and what we do with it, and the invitation links here for that reason. It carries no unsubscribe link because an opt-out here would be global and would silently stop the mail about your own events; write to us instead, or simply let the invitation expire.

5. Who we share data with

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share it only with the service providers who help us run the platform, each of them bound by contract to protect it and to process it only on our instructions:

• Clerk — authentication for host accounts.
• Supabase — the database holding events and account records.
• Amazon Web Services (AWS) — photo storage in a private bucket, and delivery through a content delivery network.
• Vercel — application hosting.
• Sentry — technical error reports, so we can diagnose and fix faults. Processed in the European Union (Frankfurt), with personal information automatically stripped before the report is sent.
• Upstash — rate limiting, which protects the service against abuse.
• A payment provider, for paid plans. Card details are entered directly with them and never reach our servers; we keep only the order record.
• Google Analytics — measurement of how the site is used, so we can improve it. It loads only after you accept analytics cookies, and never before. It is not used for advertising, and it does not follow you to other websites.

We use no advertising providers on this site. If that changes, they will be named here before they are switched on, and they will run only with your consent as described in section 9.

We may also disclose data where we are legally required to, such as under a court order, or where it is necessary to protect rights, safety and the integrity of the service.

6. Where your data goes

We are based in Brazil, and some of the providers above store and process data outside your country, mainly in the United States and, for error reports, in the European Union.

If you are in the EEA, transfers of your personal data to us in Brazil are covered by the European Commission's adequacy decision for Brazil, adopted on 26 January 2026 under Art. 45 of the GDPR. That means your data can be transferred to us without any additional safeguard such as standard contractual clauses, because Brazilian law has been found to offer an essentially equivalent level of protection. Where a provider processes data in a country not covered by an adequacy decision, we rely on standard contractual clauses instead.

Wherever your data goes, the protections in this policy follow it.

7. How long we keep things

An event's photos stay available for 6 months after the reveal on the free plan, and for 12 months on paid plans. After that we may delete them permanently. If you want to keep an album for good, download it soon after the reveal.

Host account data is kept for as long as the account exists. You can ask us to delete your photos, a whole event, or your account at any time by writing to info@capsule.film, and we will. Some records are kept longer where the law requires it, such as tax records of payments.

8. Your rights

Wherever you are, you can ask us to give you a copy of your data, correct it, delete it, or stop using it in a particular way. You can also object to any use we base on our legitimate interest.

If you are in the EEA or the UK, the GDPR gives you the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), and the right to withdraw consent at any time without affecting what was done before you withdrew it.

If you are in Brazil, the LGPD gives you the rights in Art. 18: confirmation that we process your data and access to it, correction, anonymisation, blocking or deletion of unnecessary or non-compliant data, portability, information about who we share it with, and deletion of data processed on the basis of consent.

If you are a resident of California or another US state with a comprehensive privacy law, you have the right to know what we collect and why, to get a copy, to have it deleted, to correct it, and not to be discriminated against for exercising any of those rights. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing for you to opt out of on that front — but you are entitled to ask us to confirm it, and we will.

To exercise any of these, write to info@capsule.film. We answer within the time the applicable law allows, and we do not charge for it. We may ask you for enough information to be sure it is really your data you are asking about — that check exists to protect you, not to delay you.

If you think we have got it wrong, you can complain to your data protection authority: in Brazil, the ANPD (gov.br/anpd); in the EEA, the supervisory authority where you live or work; in the UK, the Information Commissioner's Office. We would rather you told us first, so we can fix it.

9. Cookies and similar technologies

We use your browser's local storage to hold a guest's device identifier and to remember which events you have joined. We use two technical cookies: the signed-in host's session cookie, and the gallery access cookie described in section 2. These are strictly necessary — without them the service cannot do what you asked it to do — so they do not require your consent. None of them is used for advertising, and none of them follows you to other websites.

Anything that is not strictly necessary requires your consent before it is stored or read, and on this site silence is a refusal. Nothing in that category loads until you accept: not a script, not a request, not a pixel. This is stricter than the law of the country we are based in, and we apply it to every visitor rather than only to European ones.

In that category we load one thing, and only if you accept it: Google Analytics, which sets its own cookies to recognise a returning browser and to count which pages get used. If you refuse, or simply never answer, it is never requested and nothing of its is stored. Advertising technology we do not load on this site at all.

We ask on your first visit, with "Reject" shown as plainly as "Accept". Your answer is kept in a cookie of its own (capsule_consent), valid for this site and the app so you are not asked twice, and you can change it whenever you like under "Cookie preferences" in the footer. Refusing costs you nothing: same price, same access, same features.

10. Security

Photos are held in private storage with no public access. Access links are temporary and signed, and are generated only for the host and the guests of that event. Before the reveal, only blurred previews are shown. We take technical and organisational measures to protect your data, though no system is ever completely immune to incidents. If one occurs and it is likely to put your rights at risk, we will notify you and the relevant authority as the law requires.

11. Children

Host accounts are for adults, and the service is not directed at children. Where photos include children, it is for the person uploading them to have a parent or guardian's agreement. If we learn that we hold a child's data without proper authorisation, we will delete it.

12. Automated decisions

We do not make decisions about you by automated means that produce legal effects or similarly significant effects, and we do not profile you. The photo limit is a counter, not a judgement about you.

13. Changes to this policy

We may update this policy. The date at the top is the date of the current version, and we will tell you through the service if a change actually matters to you rather than only to our lawyers.

14. Contact

Questions about this policy, or about what we hold on you? Write to info@capsule.film and a person will answer.