Privacy policy

Last updated: 12 Nov. 2026

1. Controller and scope

The controller under the General Data Protection Regulation (GDPR) is iconmoments.com, Hohe Str. 74, 70794 Filderstadt, Germany, phone: +49 711 25259492, e-mail: hello@iconmoments.com.

This privacy policy covers our website and online shop (iconmoments.com), our app (app.iconmoments.com), the gallery pages for guests and our live slideshow page (stream.iconmoments.com).

Unless stated otherwise, you are not legally or contractually required to provide personal data. Some data is necessary to conclude or perform a contract: without an e-mail address we cannot create an account, and without order and payment details we cannot process an order.

2. Website and online shop

2.1 Visiting the website

When you visit our website, your browser transmits technical data such as your IP address, date and time of access, the page visited, the referring page, browser and operating system. We process this data to display the website and to keep it stable and secure (Art. 6 para. 1 lit. f GDPR). The website is hosted by Shopify (see section 4).

2.2 Cookies and consent

We use cookies and similar technologies to provide website functions and save settings. Storing or reading information on your device that is not strictly necessary is based on your consent (Art. 6 para. 1 lit. a GDPR). You can give, refuse or withdraw your consent at any time in our cookie consent tool. The tool saves your choice in a technically necessary cookie; personal data processed for this, such as your IP address, is processed under Art. 6 para. 1 lit. c and f GDPR. The consent tool is provided by iconmoments.com | Hohestraße 74 70794 Filderstadt, Germany

2.3 Contact and live chat

When you contact us by contact form, e-mail or live chat, we process your details to answer your request (Art. 6 para. 1 lit. f GDPR; additionally lit. b if your request concerns a contract). Our live chat is provided by Tidio: loading the chat transmits your IP address and browser information to Tidio, and if you use the chat, Tidio processes your messages and contact details.

2.4 Newsletter

Our newsletter is sent on the basis of your consent (Art. 6 para. 1 lit. a GDPR). Your e-mail address is required; further details are voluntary and used to address you personally. We use the double opt-in procedure and record your IP address and the time of registration to document your consent. You can unsubscribe at any time via the link in each newsletter or by contacting us; we then remove your e-mail address from the mailing list.

2.5 Orders and payment

To process your order, we pass the necessary data to the shipping company, the payment provider you select and, for printed cards, our print service provider (name, delivery address and card design) (Art. 6 para. 1 lit. b GDPR). Where we owe updates for digital products, we use your order contact details to inform you (Art. 6 para. 1 lit. c GDPR).

We offer Shopify Payments, PayPal (including local payment methods offered through PayPal Checkout), Apple Pay, Google Pay and Klarna. The selected provider receives the payment and order data needed to process the payment (Art. 6 para. 1 lit. b GDPR).

If you choose a purchase on account or payment in instalments, the provider may carry out an identity and credit check as an independent controller. Details can be found in the privacy policies of Klarna and PayPal.

2.6 Advertising and analytics (only with consent)

The following services are used on the basis of your consent (Art. 6 para. 1 lit. a GDPR). You can withdraw your consent at any time with effect for the future in the cookie consent tool.

Meta Pixel. Measures conversions and creates custom audiences for advertising. With advanced matching, customer data such as your e-mail address from purchases, logins or registrations is also transmitted; Shopify passes data from completed orders to Meta. Meta also uses the data for its own advertising purposes. For collecting and transmitting the data, we and Meta are joint controllers (Art. 26 GDPR) and have agreed in Meta's Controller Addendum which of us fulfils which obligations. You can exercise your rights against us or against Meta.

Google Analytics. Analyzes how visitors use the website.

Google Ads conversion tracking. Measures whether advertising leads to actions such as page views or started checkouts; Shopify passes data from completed orders to Google.

TikTok Pixel. Measures whether advertising on TikTok leads to actions on our website. Depending on the function, TikTok acts as our processor or as joint controller under TikTok's Business Products (Data) Terms.

Google Web Fonts. When a page loads, your browser downloads fonts from Google, which receives your IP address and browser information. Without consent, a standard font is used.

2.7 Customer reviews

Review content, including photos, is loaded from the servers of Loox, which receives your IP address and browser information (Art. 6 para. 1 lit. f GDPR, based on our legitimate interest in showing customer reviews).

3. The iconmoments app

In the app, a host creates a photo gallery for an event. Guests reach it through a link or QR code from the host and can upload photos and videos, write in the guestbook, comment and like without an account.

3.1 Hosting, delivery and security

The app, its database and uploaded files are hosted by Cloudflare. Photos and videos are delivered through a content delivery service, which processes your IP address. We process connection data (IP address, time of request, browser information) to deliver the app and prevent misuse. On the sign-up, login and live slideshow pages, Cloudflare Turnstile checks whether requests come from humans and processes browser and device information, including your IP address. Legal basis: Art. 6 para. 1 lit. f GDPR, based on our legitimate interest in secure and reliable operation.

3.2 Cookies, browser storage and consent window

The app uses cookies and browser storage to complete sign-ins and keep hosts signed in; to remember entries such as a guest's name and interface settings; to associate likes, comments and guestbook entries with a guest's browser; to compile the usage statistics in 3.7; and to record how you reached us, for example through a search engine, social media or an advertisement. The services in 3.7 and 3.8 may store their own cookies or entries.

Visitors from the member states of the European Union, Iceland, Liechtenstein, Norway, Switzerland and the United Kingdom are shown a consent window (Cloudflare Zaraz) when they open the app, in which they decide about services that require consent.

3.3 Account and sign-in

Hosts register with an e-mail address. We store this address, any name provided, the registration date, the e-mail confirmation status, gallery details (name, description, event date, settings and cover picture), your country, device type and how you reached us. Sign-in is passwordless: we send e-mails for signing in and confirming the address. At registration, an e-mail validation service receives your e-mail address to identify disposable or unusable addresses.

Account and gallery provision is based on Art. 6 para. 1 lit. b GDPR. E-mail validation and recording how you reached us are based on Art. 6 para. 1 lit. f GDPR, based on our legitimate interests in preventing misuse and understanding how our offer is found.

3.4 Sign in with Google

If you select "Continue with Google", you sign in through Google Ireland Limited. We receive your Google account ID, e-mail address, verification status, name and, for organizational accounts, the organization's domain. We do not receive your password or access to your e-mails, files or contacts.

We store your e-mail address, name, Google account ID, the time the account was linked and the time of the last sign-in. We use this information to create your account, sign you in and send the e-mails described in 3.6. Otherwise, your e-mail address is handled like an address entered directly.

You can request deletion at hello@iconmoments.com and remove our access in your Google account settings. Legal basis: Art. 6 para. 1 lit. b GDPR.

3.5 Galleries and guest content

Guests can provide photos and videos, guestbook entries as text or voice message with a name, comments with a name, and likes. We store the content, the name entered and technical details such as the time and the country. Files are stored as uploaded, including information that the device has embedded in them.

The host can see all content and remove it, and decides in the settings what guests can see and delete. Anyone with the gallery link can open the gallery pages.

Legal basis: Art. 6 para. 1 lit. b GDPR and Art. 6 para. 1 lit. f GDPR, based on the legitimate interest in collecting and sharing event pictures.

3.6 Cards, orders and e-mails

If you use the card designer, the details you enter are processed by technical service providers to create the designs; the designs are stored with your gallery. Packages, extensions and printed cards are paid through Shopify checkout (see 2.5): the app passes your e-mail address and order details to Shopify, and for printed cards the necessary printing and delivery data goes to our print service provider. Legal basis: Art. 6 para. 1 lit. b GDPR.

Our e-mail delivery service receives the recipient's e-mail address and the e-mail content. We send service e-mails for signing in, confirming your address and about your gallery and orders (Art. 6 para. 1 lit. b GDPR). We also send reminders and tips (Art. 6 para. 1 lit. f GDPR, based on our legitimate interest in informing hosts about our offer for their event); you can object at any time via the unsubscribe link or at hello@iconmoments.com.

3.7 Usage statistics, error reports, chat and reviews

We analyze pages opened and functions used to improve the app. Visitors from the countries named in 3.2 are asked for their consent in the consent window. In this case, processing is based on Art. 6 para. 1 lit. a GDPR, and you can withdraw your consent at any time with effect for the future. For visitors from other countries, processing is based on Art. 6 para. 1 lit. f GDPR, based on our legitimate interest in improving the app. When an app error occurs, technical error information is sent to an error reporting service (Art. 6 para. 1 lit. f GDPR, based on our legitimate interest in finding and fixing errors).

On host gallery-setup pages we use the Tidio live chat (see 2.3); the app also passes your account e-mail address to Tidio to associate your request with your account. We also display Loox reviews (see 2.7).

3.8 Advertising measurement in the app

We use Cloudflare Zaraz to send app events, such as completed registrations and started checkouts, to Meta for advertising measurement and improvement and to Google for Google Analytics. Some events include a hashed account e-mail address and, where available, a Meta advertisement click ID so that Meta can match the event to an advertisement.

Visitors from the countries named in 3.2 are asked for their consent in the consent window. In this case, processing is based on Art. 6 para. 1 lit. a GDPR, and you can withdraw your consent at any time with effect for the future. For visitors from other countries, processing is based on Art. 6 para. 1 lit. f GDPR, based on our legitimate interest in measuring and improving our advertising; you can object at any time at hello@iconmoments.com.

4. Service providers and transfers outside the EU

We have concluded data processing agreements with providers that act as our processors. Where data is transferred to a country outside the European Union, the transfer is based on the basis stated below.

We also use a content delivery service for photos and videos, an e-mail validation service for registration e-mail addresses and a print service provider for cards. If a provider without a stated transfer basis processes data outside the EU or EEA, the transfer is based on an adequacy decision, the EU-US Data Privacy Framework or standard contractual clauses of the European Commission. You can request a copy of the standard contractual clauses at hello@iconmoments.com.

5. Storage periods

We store personal data as long as it is needed for the purpose for which it was collected, unless statutory retention periods (for example under commercial and tax law) require longer storage. If you withdraw your consent or object to processing based on legitimate interests, we stop that processing, unless we can demonstrate compelling legitimate grounds or the processing serves legal claims. Data already transmitted to independent controllers such as Meta or Google is subject to their storage periods.

The following criteria apply in addition:

• Contact and chat requests: deleted when they are no longer needed after the request has been resolved, unless statutory retention obligations apply.
• Newsletter: your e-mail address is stored until you unsubscribe.
• Expired galleries: deactivated on expiry; photos, videos, guestbook entries, comments and likes are deleted after the gallery has expired.
• Photos and videos deleted by a host or guest: removed from storage; copies in backups are overwritten in the regular backup cycle.
• Unpaid orders: cancelled automatically and deleted once they are no longer needed.
• Usage statistics: deleted or anonymized once they are no longer needed to improve our offer.
• Account and gallery details: stored while the account exists. If you ask us to delete your account, we delete it without undue delay; copies in backups are overwritten in the regular backup cycle.
• Order records: stored for the statutory retention periods and deleted after these periods end.

6. Your rights

Under the applicable conditions, you have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw consent at any time with effect for the future (Art. 7 para. 3 GDPR) and lodge a complaint with a supervisory authority (Art. 77 GDPR). To exercise your rights, contact us at hello@iconmoments.com.

Right to object

Where we process personal data based on legitimate interests (Art. 6 para. 1 lit. f GDPR), you may object at any time on grounds relating to your particular situation. We will then stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

You may object at any time to the processing of your personal data for direct marketing. We will then no longer process your data for that purpose.

7. Children, "Do Not Track" and changes

The app is not intended for children under 13. Where processing is based on consent, children below the age set in their country under Art. 8 GDPR (16 in Germany) need the consent of a parent or guardian.

Our website and app do not respond to "Do Not Track" signals sent by browsers.

We may update this privacy policy. The date at the top shows when it was last updated.