Privacy Policy

01In short

• Guests do not create accounts. We only keep the display name you type once (or none, if you choose to stay anonymous), plus the photos, message and voice recording you send.
• Couples sign in with Google. We receive your name, email address and profile picture from Google, never a password.
• Photos are processed on your own device before upload. All files are stored privately and can only be opened through temporary links that expire within minutes.
• Thumbnails of the photos you send can appear in the event's Live Feed for other guests. Full-size photos, messages and recordings are visible only to you and the couple, except photos shown on the venue slideshow screen if the couple turns it on.
• Guest access, including the Live Feed and your own gallery, ends when the event ends on the free package, or 30 days after the event on a paid package. After that only the couple can open the album, for the storage period of the event package (7 days on the free package, 1 year on a paid package), and then it is deleted automatically.
• We do not sell data, run ads or ad trackers, or use your photos, messages or voice for advertising or to train artificial intelligence.
• You can ask to access, correct or delete your data at [email protected].

02Who we are and our role

Relivi is a virtual disposable camera and photo booth for weddings and other events. In the terms of the PDP Law, our role is as follows:

• We are the Personal Data Controller for couples' accounts, guest sessions, and the service's technical and security data.
• For the content of an event album (the photos, messages and voice recordings guests send), the couple decides how the event runs: who receives the event link or QR code, whether the Live Feed and venue slideshow are shown, which photos are hidden, and what happens to the archive they download. We process that content to provide the service to the couple and their guests, and for no other purpose.

If you are a guest with a question about how the couple uses your photos after downloading them, please ask the couple. For data held in our systems, we will still help with your request.

03Data we collect

From couples (account holders):

• From your Google account when you sign in: email address, name and profile picture address. Your name and picture are refreshed each time you sign in. We never receive your Google password.
• When your account was created and when you last signed in.
• If you choose "Save to Google Drive" when downloading your memories: a limited permission (drive.file) that only reaches the folders and files Relivi creates in your Drive, not the rest of your Drive. Files go from your browser straight to Google Drive. The access token exists only in your browser while the upload runs; it is never sent to our servers or stored. Relivi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Event details you enter: event type, couple names, title, quote, date, start and end time, time zone, cover photo, and your settings for the camera, quota, guest limit, Live Feed, reveal and venue slideshow.
• If you buy a package: order data, namely the event, package, amount, payment status, time and Midtrans transaction number. You enter your payment details directly on Midtrans's page. We never receive your card number, PIN, password, or bank or e-wallet credentials.
• If you ask for a refund of a virtual account payment: the bank name, account number and account holder name you send us, used only to transfer the refund.

From guests (no account):

• The display name you type once when you join, up to 40 characters. If you choose to stay anonymous, no name is stored and you appear as "Tamu" (Guest).
• The photos you send: the original as compressed on your device, the edited version if there is one, and a thumbnail. Also the edit recipe (filter, frame, text, stickers), when the photo was taken, whether it came from the camera or your device gallery, and when it was sent.
• Your text message and voice recording for the couple, with the recording's length. Recordings are limited by the event's settings, 60 seconds by default.
• Session usage: how many photos and submissions you sent, when your message was sent, when the session was created and last active, and its status.
• If you report a photo: which photo you reported and the reason you wrote.

Technical and security data:

• When a guest session is created, we store a keyed hash (HMAC) of the IP address and the browser identifier (user agent), computed separately for each event. Raw IP addresses are not stored in our database. These hashes are used to limit abuse and spot suspicious patterns, not to track you.
• Like any web service, our infrastructure provider (Cloudflare) processes IP addresses, device and browser type and other request data to deliver pages and protect the service from attacks. Technical error logs are kept for a short time to fix problems.
• We may use Cloudflare Web Analytics for aggregate visit statistics. It sets no cookies and builds no visitor profiles.

What we do not collect from guests: email address, phone number, contacts or location. Photos are redrawn on your device before upload, so metadata from the original file, such as GPS location, is not stored. Voice cleanup on recordings also happens on your device.

04How we use data

• To run the service: creating and managing events, creating guest sessions, receiving uploads, showing galleries, the Live Feed and the venue slideshow, and providing downloads and archives to the couple.
• To enforce event rules: the per-guest photo quota, the guest limit, the reveal time and one message per guest.
• To process package payments and refunds, and keep transaction records.
• To keep the service secure: rate limiting, preventing abuse, checking uploaded files and handling content reports.
• To provide support and tell couples about the service, for example changes to these terms or to storage periods.
• To meet legal obligations and respond to lawful requests from competent authorities.
• To understand aggregate use of the website and improve the service.

We do not use your data for advertising, build marketing profiles, sell or rent data, or use your photos, messages or voice to train artificial intelligence models. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

05Legal basis

We process personal data on the bases recognised by Article 20 of the PDP Law:

• Performance of a contract: couple accounts, event details, package payments, and the processing needed for guests to join, send and see what they sent, as described in the Terms of Service.
• Consent: guests choose to join, type a name, take photos, record their voice and press send. The camera and microphone can only be used after you allow them in your browser. You can withdraw consent by no longer sending, deleting your photos or asking us to delete your data.
• Legitimate interest: service security, abuse prevention (including the IP address and user agent hashes), technical error logs and aggregate statistics, with due regard for your rights and interests.
• Legal obligation: where the law requires us to keep or disclose data.

06Who can see what

• Anyone with the event link or QR code can see the event page: couple names, title, quote, date and cover photo. Event links are random and cannot be guessed, and there is no public list of events. Anyone with the link can join as a guest while the event is running and the guest limit has not been reached.
• All guests of the same event can see thumbnails of sent photos in the Live Feed, with the sender's display name (or "Tamu" if anonymous) and the time sent. This applies only if the couple has the Live Feed on and the reveal time has passed; before that, guests only see how many photos and contributors there are. Photos the couple hides are not shown. The Live Feed never opens full-size photos, messages or recordings, and offers no downloads.
• People watching the venue slideshow: if the couple turns it on, full-size photos with the sender's display name can appear on that screen, regardless of the guests' reveal setting. Messages and recordings never appear on the slideshow.
• You, as a guest, can see all your own photos in full size, plus your message and recording, while guest access lasts. You can download and delete your own photos.
• The couple can see every photo of their event, including the original before editing and photos hidden from the Live Feed, as well as every guest's message, recording and display name. The couple can download all of it as an archive.
• The Relivi team: only authorised staff, and only as needed to run the service, handle support or reports, keep the service secure or meet legal obligations.

Guests cannot download other guests' photos through Relivi. We cannot, however, stop someone from taking a screenshot of what is on their screen.

07Other parties that process data

We do not sell personal data. We share data only with the following, and only as far as needed:

• Cloudflare: hosting of the website and apps, the API, file storage (R2), content delivery, security protection and visit statistics.
• Neon: the Postgres database that holds account, event, session and submission data, in the Singapore region.
• Google: Google sign-in for couples, and Google Drive when you choose to save your memories there. Your profile picture is loaded directly from Google.
• Midtrans: our payment processor. Midtrans receives the order data needed for the transaction, such as the order number, the amount, and your account name and email, together with the payment details you enter directly on its payment page, and processes them under its own terms and privacy policy. We never see your card details, PIN, or bank or e-wallet credentials.
• Competent authorities, where required by law or a lawful order.
• A party that takes over the service in a merger, acquisition or transfer of business. That party must protect the data in line with this policy, and we will tell you before the transfer happens.

These providers process data on our behalf and are bound by their own data protection terms.

08Transfers outside Indonesia

Our infrastructure is outside Indonesia. The database is in Singapore. Cloudflare runs a global network, so files and requests may be processed in data centres in many countries, usually the one closest to the user. Google sign-in is processed by Google outside Indonesia.

In line with Article 56 of the PDP Law, we choose providers that apply an adequate and binding level of data protection through their data processing terms, and we send them only the data needed to run the service.

09How long we keep data

• Guest access ends when the event ends on the free package, or 30 days after the event ends on a paid package. Events under a separate agreement follow the agreed period. The guest session cookie expires at the same moment, and guests can no longer open the Live Feed or their gallery.
• The event album (photos, messages, recordings, guest display names and session data) stays available to the couple after guest access ends, until the event package's storage period ends or the event is deleted. The storage period ends 7 days after the event ends on the free package, and 1 year after the event ends on a paid package. When an event's storage period ends, all of its files and data are deleted automatically by our daily cleanup.
• A photo you delete from your own gallery is removed, with its files, from our storage straight away. Copies the couple downloaded earlier are outside our control.
• To keep sending fast on weak Wi-Fi, photos may start uploading in the background before you press send. Uploads that are never sent are not visible to anyone, including the couple, and are deleted automatically after 24 hours at the next daily cleanup.
• Couple accounts are kept while you use the service. Deleting an event does not delete the account. You can ask for your account to be deleted at [email protected].
• Technical and security logs at our infrastructure providers are kept for a short time, according to the provider's settings.
• Technical database backups may persist for a limited time after deletion before they are overwritten automatically.

We may keep data longer where the law requires it, or where needed to handle an ongoing dispute or abuse report.

10Cookies and on-device storage

We use no advertising cookies and no third-party trackers. The cookies we use are:

• wp_gs: the guest session. It marks your browser as a guest of a particular event. It is HttpOnly (scripts on the page cannot read it) and lasts until guest access ends.
• wp_host: the couple's dashboard session. It is HttpOnly and lasts 30 days.
• wp_oauth: used briefly while you sign in with Google, valid for 10 minutes.
• lang: on this website, only remembers the language you chose.

The guest app also uses browser storage on your device. Photos not yet sent are kept there so they are not lost on a bad signal or a closed tab, and are removed from the device once the server confirms the submission or you delete them. A few small preferences (such as tips already seen and your frame choice) and a copy of the event page for offline use are stored on the device too.

You can clear these cookies and this storage in your browser settings. Photos not yet sent will be lost, and since guests have no account, a cleared guest session cannot be recovered.

11Security

• Every connection is encrypted with HTTPS.
• File storage is never public. Photos and recordings open only through signed links that are issued after an access check and expire in 15 minutes.
• Before the reveal time, the server sends guests no photo links at all.
• Sessions live in signed HttpOnly cookies that scripts on the page cannot read.
• Couples sign in through Google, with no password stored at Relivi.
• All input is validated on the server, uploaded files are checked for size and type, and the service sits behind a web application firewall.

No system is completely secure. Protect access to your Google account and your device, and share the event link only with the people you invite.

12If a data breach happens

If a personal data protection failure occurs, we will notify the affected data subjects and the personal data protection authority in writing within 3 x 24 hours of becoming aware of it, as required by Article 46 of the PDP Law. The notice will state what data was exposed, when and how it happened, and what we are doing to handle and recover from it.

Since guests give us no contact details, notices to guests may be delivered through the couple, this website or the guest app.

13Your rights

Under the PDP Law, you have the right to:

• be informed of who we are, and the legal basis, purpose and manner of processing your data;
• access your personal data and get a copy of it;
• complete or correct inaccurate data;
• end the processing of your data, or have it deleted or destroyed;
• withdraw consent you have given;
• delay or restrict processing;
• receive your data in a commonly used, machine-readable format, or have it sent to another controller where technically feasible;
• object to decisions based solely on automated processing;
• sue for and receive compensation for violations in the processing of your data, as provided by law.

To make a request, email [email protected]. Since guests have no account, please include the event name, the event date, your display name and, if useful, a screenshot of your gallery, so we can find the data and confirm it is yours. Couples only need to write from the email address of the Google account they sign in with.

Some rights you can exercise yourself: guests can view, download and delete their own photos from their gallery while guest access lasts, and couples can download the whole album from the dashboard.

Guest display names are deliberately locked once written, so nobody can pose as another guest. If your name is wrong or you no longer want to appear under it, contact us and we will act on it, for example by removing the name.

We will act on your request within 3 x 24 hours of verifying your identity, or within the period set by law. These rights may be limited where the law provides, for example for law enforcement proceedings. If you are not satisfied with our response, you can complain to the competent personal data protection authority.

14Children

Children often attend weddings. Anyone under 18 may use Relivi only with a parent's or guardian's permission. If you are a parent or guardian and learn that your child sent data without permission, contact us and we will delete it.

Photos of children must be appropriate. Content that exploits or endangers children is prohibited; we will remove it and may report it to the authorities.

15Changes to this policy

We may update this policy from time to time. The effective date of the current version is shown on this page. We will announce material changes on this website and/or by email to couples at least 14 days before they take effect.