Privacy Policy

OncePix (contact@oncepix.com) is the controller responsible for the personal data described in this policy. If you have any question about how we handle your data, that inbox is the fastest way to reach us.

Account data: your email address and, if you sign in with Google, the identity your provider shares with us.

Event data: the event title, date, guest limit, and reveal-timing settings an organizer chooses when creating an event.

Event content: the photos guests upload during an event, which may show identifiable people.

Technical data: IP address, browser/device information, and the session identifiers we use to keep you signed in, see "Cookies" below.

Payment data: handled entirely by Stripe. We never see or store your card number.

To run the service you asked for: creating your event, generating your album, sending the emails a host or guest needs (login codes, event-ready notices, the revealed album link).

To keep the service secure and prevent abuse (fraud checks, rate limiting).

To meet our legal obligations, such as keeping invoice records for as long as Portuguese tax law requires.

Supabase, our database, authentication, and file-storage provider.

Stripe, payment processing for paid events. Stripe handles your card details directly; we only receive confirmation that a payment succeeded.

Vercel, the hosting platform that serves this site.

Amen, our transactional email provider, used to deliver login codes and event notifications.

Google, which provides Google Analytics, used to understand site traffic. This only runs if you accept analytics cookies, see "Cookies" below.

We do not sell personal data, and we do not share it with advertisers.

Some of the providers above may process data outside the European Economic Area. Where that happens, we rely on their standard contractual safeguards for international transfers.

Event photos are kept for as long as the event exists in OncePix. An organizer can delete an event, which removes its photos.

Account data is kept while your account is active, and afterwards for as long as Portuguese law requires us to retain billing records (up to 10 years for invoices).

Under the GDPR, you can request access to, correction of, or deletion of your personal data, ask us to restrict or object to processing, or request a copy of your data in a portable format. Email contact@oncepix.com and we will respond within 30 days.

If you are in Brazil, the same rights described above are available to you under the LGPD (Lei 13.709/2018), through the same contact channel.

The organizer who creates an event is responsible for making sure their guests are comfortable being photographed. OncePix processes uploaded photos only to run the album feature the organizer requested, never to train AI models. (The sample photos on our landing page are AI-generated illustrations, not real guest photos, and no real user-uploaded photo is ever used to generate them.)

OncePix always uses essential cookies, the ones that keep you signed in, remember your language and currency, and remember your cookie choice.

If you accept cookies, we also use Google Analytics to see how many people visit the site and where they come from. This never runs before you accept, and you can withdraw your consent at any time by clearing your browser’s cookies for oncepix.com. We do not use advertising cookies.

OncePix is not directed at children under 16, and we do not knowingly collect their data.

We use encrypted connections (HTTPS) throughout the product and rely on our providers’ access controls to protect stored data. No system is perfectly secure, but we take reasonable steps to protect yours.

If we make a material change to this policy, we will post the update here with a new "last updated" date.

Questions about this policy: contact@oncepix.com.