1. Who we are
Rewind is a photo event platform that allows companies to create events where participants can take photos. This privacy policy explains how we collect, use, and protect your personal data in accordance with the Algemene Verordening Gegevensbescherming (AVG/GDPR).
The company organizing the event you participate in acts as the data controller (verwerkingsverantwoordelijke). Rewind acts as the data processor (verwerker) on behalf of the organizing company.
2. What data we collect
When you use Rewind, we collect and process the following personal data:
Account data:
• Email address (required for account creation)
• Full name (from your Google account or manual entry)
• Language preference (Dutch or English)
• Password (stored securely hashed — email sign-up only)
Event participation data:
• Which events you joined and when
• Photos you took during events (stored as JPEG images)
• Photo timestamps
Technical data:
• Authentication session cookies (required for the app to function)
• Language preference cookie (stored for 1 year)
3. Why we collect your data and legal basis
We collect your data for the following purposes:
To provide the photo event experience (legal basis: contract performance)
• Creating and managing your account
• Allowing you to join events and take photos
• Delivering your photo album after the event
To provide event organizers with audience insights and marketing capabilities (legal basis: consent)
• Your name and email address are shared with the company organizing the event
• Companies may use this data for audience insights and email marketing campaigns
• You are informed of this before joining each event and can choose not to participate
To send you album notification emails (legal basis: consent)
• We send you an email when your event photos are ready to view
• You can opt out of these emails at any time via your profile settings
To ensure security and prevent abuse (legal basis: legitimate interest)
• Admin audit logging
• Session management
4. Who we share your data with
Event organizing companies:
When you join an event, your name and email address are shared with the organizing company. They may use this data for audience insights and marketing campaigns. You are informed of this before joining each event.
Company administrators can also:
• View the list of participants (name, email, join date, photo count)
• Export participant data as CSV
• View photos taken at their events
Sub-processors:
We use the following third-party services to process your data:
• Supabase (Supabase Inc.) — Authentication, database storage, and file storage for photos. Data is stored on Supabase-managed infrastructure.
• Resend (Resend Inc.) — Email delivery for album notification emails. Resend receives your email address and name to deliver emails.
• Google (Google LLC) — If you sign in with Google, authentication data is exchanged with Google's OAuth service.
We do not sell your personal data to third parties.
5. Data retention
We retain your data for the following periods:
• Account data: Kept as long as your account exists. You can delete your account at any time.
• Event data and photos: Automatically deleted 12 months after the event ends.
• Audit logs: Retained for 24 months for security purposes.
When you delete your account:
• Your profile and personal data are permanently removed
• Your photos remain in event albums but are anonymized (no longer linked to your name)
• Your event participation records are deleted
6. Your rights
Under the AVG/GDPR, you have the following rights:
Right of access (recht op inzage): You can download all your personal data from your profile page using the "Download My Data" button.
Right to rectification (recht op rectificatie): You can edit your name and language preference on your profile page.
Right to erasure (recht op vergetelheid): You can delete your account at any time from your profile page. Your photos will be anonymized but kept in event albums.
Right to data portability (recht op dataportabiliteit): You can export your data in JSON format from your profile page.
Right to object (recht op bezwaar): You can opt out of album notification emails in your profile settings. You can also choose not to join events where your data would be shared.
Right to lodge a complaint: If you believe your privacy rights have been violated, you can file a complaint with the Autoriteit Persoonsgegevens (AP) at autoriteitpersoonsgegevens.nl.
7. Cookies
We use the following cookies:
• Authentication cookies (required): Managed by Supabase to maintain your login session. These are essential for the app to function.
• Language preference (functional): Stores your language choice (Dutch/English) for 1 year. Set when you create an account or change your language.
We do not use tracking cookies, analytics cookies, or advertising cookies.
8. Security
We take the following measures to protect your data:
• All data is transmitted over HTTPS
• Passwords are hashed using bcrypt (never stored in plain text)
• Row Level Security (RLS) policies on all database tables
• Photos stored in private storage buckets with access control
• Admin actions are logged in an audit trail
• Minimum password length of 12 characters
9. Changes to this policy
We may update this privacy policy from time to time. When we make significant changes, we will notify you via email or a prominent notice in the app. The version number and date at the top of this page indicate when the policy was last updated.
Continued use of Rewind after changes to the privacy policy constitutes acceptance of the updated terms.
10. Contact
If you have questions about this privacy policy or want to exercise your rights, please contact us at:
Email: privacy@rewind.app
For complaints about data protection, you can also contact the Dutch Data Protection Authority:
Autoriteit Persoonsgegevens
https://autoriteitpersoonsgegevens.nl