Privacy Policy

Last updated: 1 July 2026

Hosting or joining a party with Party mode? Party photos follow their own rules: they go to the party's host and are kept for a limited time. See section 10.

1. Who We Are

21Pix is operated by:

We are the data controller for the personal data described below, under Regulation (EU) 2016/679 (GDPR).

2. What We Collect and Why

2.1 Your photos

• What: The 21 photos in each roll you order.
• Why: To print them on photo paper and ship them to you.
• Legal basis: Performance of a contract (GDPR Art. 6(1)(b)).
• Retained: Until 48 hours after your order has shipped, then permanently deleted from our systems.

2.2 Shipping & contact details

• What: Name, postal address, email address, optional phone number.
• Why: To deliver your prints and email you order/shipping confirmations.
• Legal basis: Performance of a contract.
• Retained: 7 years, as required by Dutch tax law (art. 52 AWR).

2.3 Payment data

• What: Order amount, transaction ID and payment status returned by Mollie. We never see or store your card number, IBAN, or PayPal credentials.
• Why: To take payment and reconcile orders.
• Legal basis: Performance of a contract; legitimate interest in fraud prevention (Art. 6(1)(f)).
• Retained: 7 years (tax law).

2.4 Device data

• Device-generated user ID: A random identifier created on your device the first time you launch the app. It lets us associate your rolls and orders without requiring an account. Not linked to your real identity.
• Push notification token: If you allow notifications, we store an Apple (APNs) or Google (FCM) push token so we can tell you when your film is "developed" and when your order ships. You can revoke this anytime in your device settings.
• Server logs: Like any web service, our server records request lines including IP address, briefly, for security and abuse prevention. Logs are rotated after 30 days. We don't use them to build a profile of you.

2.5 Anonymous usage analytics & ad measurement

• Usage analytics: Aggregate, anonymous usage events — for example app opens, that a photo was taken (and its number within the roll), that a roll was completed, steps of the checkout (order started, payment started, completed or failed), and that an order was placed and its total value, plus standard website page views and which app-store button was tapped. We use Google Analytics 4 for this, via Firebase Analytics inside the apps. This carries no advertising identifier.
• Website heatmaps & session replays: On our website only (never in the apps), we use Microsoft Clarity to see how pages are used — anonymized heatmaps and session replays of clicks, scrolls and mouse movement, with all text and form inputs automatically masked. It loads only after you accept the cookie banner and never sees your photos.
• Ad performance measurement: So we can run ads that bring new people to 21Pix, we measure how our own campaigns on Meta (Facebook / Instagram) and Google perform — for example whether an ad led to an app install or an order. On iOS this uses Apple's SKAdNetwork, plus your device advertising identifier (IDFA) only if you allow it in Apple's App Tracking Transparency prompt. On Android, in the EEA we ask for your consent with an in-app prompt before using your advertising identifier (GAID); you can grant or withdraw it any time under About → Privacy. On the website, a Meta Pixel and Google tag load only after you accept the cookie banner. Your photos are never part of this.
• What it is not: We do not build a profile of you from your photos, and your photos are never used for advertising. Order events carry only the order total and country — never your name, address, email or card details. We never sell your personal data.
• Why: To understand, in aggregate, how 21Pix is used so we can improve it, and to measure and improve the ads that bring people to the app.
• Legal basis: For usage analytics — on the website, your consent (GDPR Art. 6(1)(a)); in the apps, our legitimate interest in improving the product (Art. 6(1)(f)), on by default and switchable off under About → Privacy. For ad measurement that uses an advertising identifier — your consent (Art. 6(1)(a)), given through Apple's App Tracking Transparency prompt on iOS, an in-app consent prompt on Android in the EEA, or the website cookie banner; decline and we fall back to privacy-preserving aggregate measurement only.
• Retained: 14 months, after which event-level analytics data is automatically deleted by Google. Ad-measurement data is retained per Meta's and Google's advertising data policies.

3. What We Don't Do

4. Who Else Touches Your Data

We print and pack your photos ourselves, in our own facility, so your images are not handed off to any external printing partner. The only third parties involved are:

Service	Role	What they see	Location
Mollie B.V.	Payment processor	Order amount and your payment details (which we never receive)	Netherlands (EU)
Amazon Web Services	Server hosting & storage	Encrypted application data, in EU regions	EU
Apple (APNs)	iOS push notifications	Push token and notification payload (order status)	EU / US
Google (Firebase Cloud Messaging)	Android push notifications	Push token and notification payload (order status)	EU / US
Google (Analytics 4 / Firebase Analytics)	Anonymous usage analytics	Aggregate app & website usage events — no advertising ID, no photos	EU / US
Microsoft Clarity	Website usage analytics (heatmaps & session replays)	Anonymized on-site interactions — clicks, scrolls and mouse movement on our web pages, with text and form inputs masked; no photos, no cross-site tracking	EU / US
Google Ads	Ad conversion measurement	That an order completed and its value, plus a one-way hashed (SHA-256) form of your email to match the ad click — never your raw email or card details	EU / US
Meta Platforms Ireland	App-install & ad measurement (Facebook / Instagram ads)	Aggregate app & ad events (installs, key steps, purchases and value) and, only with your consent, your device advertising identifier — never your photos, raw email or card details	EU / US
PostNL and partner carriers	Shipping	Name and shipping address	EU

Apple and Google process push tokens under their own terms; transfers outside the EU rely on the European Commission's Standard Contractual Clauses. No other personal data is transferred outside the EU.

5. Data Retention Summary

Data	Kept until	Why
Photos	48 hours after shipment	Reprints in case of carrier loss/damage
Order, shipping & payment records	7 years	Dutch tax law (art. 52 AWR)
Push token	Until you disable notifications or uninstall	Sending order updates
Anonymous usage analytics	14 months	Product improvement (auto-deleted by Google)
Website heatmaps & session replays (Microsoft Clarity)	Rolling window set by Microsoft	Understanding website usability
Ad-measurement data (Meta, Google)	Per Meta / Google advertising data policies	Measuring & improving our ads
Server access logs	30 days	Security & abuse prevention

6. Your Rights Under GDPR

You have the right to: access your data, correct it, delete it (subject to our legal retention obligations), restrict or object to processing, and receive it in a portable format. To exercise any of these rights, email info@21pixapp.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your country of residence.

7. Children

21Pix is not intended for users under 16. We do not knowingly collect data from children under 16. If you believe we hold data about a child under 16, contact us and we'll delete it.

8. Security & Breach Notification

Data in transit is protected with TLS. Data at rest in AWS is encrypted. Access is limited to personnel who need it to operate the service. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and, where required, notify affected users directly by email.

9. Changes & Contact

If we make material changes to this policy we will update the date at the top and, where appropriate, notify recent customers by email. Continued use of 21Pix after a change constitutes acceptance.

10. Party mode

With Party mode, a host creates a party on our website and guests take photos with a party camera in the 21Pix app. Every party photo goes to the host and can appear on a big screen at the party. This section explains what that means for your data, as a host and as a guest.

10.1 Who is responsible for what

• Party photos and guest first names: the host decides what happens with them (who sees the big screen, whether a gallery is opened, what happens with downloads) and is the controller where data protection law applies to them. 21Pix stores and processes this data on the host's behalf, as processor, under the Party mode terms (terms, section 10). For questions about a party's photos, contact the host first; we will help the host and pass on requests we receive.
• Host accounts, payments, and the technical data we need to run Party mode safely (device ID, consent records, security logs): 21Pix is the controller, as described in sections 1 to 9.

10.2 Host account data

• What: your name, email address and language; your password, stored only as a salted Argon2id hash; when you verified your email and accepted the host terms (and which version); your parties and their settings (name, date and times, time zone, camera colour, big-screen scene, film look, optional logo); and the payment records of party upgrades (amount, Mollie transaction ID and status, never your card or bank details).
• Login metadata: for every login session we store the IP address, the browser or device (user agent), and when the session was created and last used, to keep your account secure and spot unusual logins. Sessions end after 30 days without use and after 180 days at the latest; you can log out everywhere from your account settings.
• Emails: we send account emails (activation, password reset, email change) and party emails (party created, receipt, party full, party ended, deletion reminders). These are service emails, not newsletters.
• Legal basis: performance of a contract (GDPR Art. 6(1)(b)); for login metadata and abuse prevention our legitimate interest in security (Art. 6(1)(f)); for payment records, legal obligation (Art. 6(1)(c)).
• Retained: until you delete your account, which also deletes your parties and their photos. Accounts that were never activated and have no parties are deleted after 30 days. Expired sessions and used or expired email links are removed automatically. Payment records are kept for 7 years (tax law).

10.3 Guest data

• What: the photos you take with the party camera; the first name you choose to enter (optional); your device-generated user ID (see 2.4) and a random key for your membership of this party; when you gave consent and to which version of the consent text; your app platform, version and language; and technical data about each photo (when it was taken, roll and shot number, moderation result).
• Why: to send your party photos to the host, show them on the big screen and in the gallery the host may share, keep unsuitable photos off the screen, prevent abuse, and let you order prints of your own party roll.
• Consent: before you join, the app shows who hosts the party and asks you to agree that your party photos are shared with the host (Art. 6(1)(a)). You can withdraw at any time: leave the party so nothing more is sent, and ask the host or us (info@21pixapp.com) to delete the photos you already sent — we will.
• Automatic moderation: every party photo is analysed automatically by Amazon Rekognition, which detects likely inappropriate content and text in images. It does not identify people and we don't use face recognition. Photos it flags are held back and shown blurred to the host, who decides whether to release them; no decision with legal or similarly significant effect is made about you. We have opted out of Amazon using content processed by its AI services to develop or improve those services, and we never use party photos to train AI.
• Your controls: in the app you can leave the party at any time; after that nothing more is sent. Photos you already sent can't be deleted from the app: they stay with the host, who can remove them. To have them deleted, ask the host, or email us at info@21pixapp.com and we'll erase them from our systems. We keep a record that your phone joined (a random app ID and how many shots it took) until the party itself is deleted, so if you rejoin on the same phone you continue with the same party roll. We can't delete copies the host already downloaded; ask the host to do so.
• Prints: if you order prints of your party roll, those photos are handled as a normal order (sections 2.1 to 2.3).

10.4 Storage period

Party photos and the guest data that belongs to them are deleted automatically 30 days after a free party ends, or one year after a paid party ends. The host gets a reminder email 7 days and 1 day before. A host can delete their account earlier, which deletes their parties and photos straight away. When a guest leaves, nothing more is sent; the photos they already sent stay until the party is deleted, unless the host (or we, on the guest's request) deletes them sooner. We keep a minimal record of each party (name, dates, tier and payments) for our accounting.

10.5 Where party data is stored and who processes it

Service	Role	What they see	Location
Amazon Web Services EMEA SARL (S3, Lambda)	Storage and processing of party photos	Party photos and the versions made for the big screen, encrypted at rest	EU (Ireland, eu-west-1)
Amazon CloudFront	Delivering photos to the big screen, dashboard and gallery	Party photos, via time-limited signed links; edge servers near the viewer may briefly cache them	Global edge network, origin in the EU
Amazon Rekognition	Automatic moderation	Each party photo, to detect likely inappropriate content and text; not stored by Amazon for its own purposes	EU (Ireland, eu-west-1)
Amazon Simple Email Service (SES)	Sending account and party emails	Your name, email address and the content of the email	EU (Ireland, eu-west-1)
Mollie B.V.	Payments for party upgrades	Amount and your payment details (which we never receive)	Netherlands (EU)

10.6 Analytics on party pages

Party mode doesn't change how we measure usage: the app collects anonymous usage data as described in 2.5, and you can switch it off. The party invitation page that guests open from the QR code, the big screen, moderator and gallery links, and the pages behind links in account emails carry no analytics or advertising tags. Our other web pages, including the host pages, use analytics only as described in 2.5, through the cookie banner.

11. Gift cards (Gift a roll!)

• When you buy gift cards we keep your name and e-mail address, the amounts, the payment method and status (for our bookkeeping, 7 years), your IP address (fraud prevention), and per card the country, the card language and the To, From and message texts you entered.
• We use this to make and send your cards, to handle refunds and to prevent fraud (for example limits on the number of purchases per hour). Payments are processed by Mollie B.V.
• The To, From and message texts are deleted 90 days after all codes of your order have been used, refunded or have expired. We do not store the PDF: it is made again when you or we need it.
• When someone uses a code, their order is handled like any other 21Pix order (see the sections above). The recipient does not see your e-mail address, and you do not see their order.