Privacy Policy

Effective date: 2 October 2026

This Privacy Policy explains how slideshow.is collects and uses personal data when you visit our website, create a slideshow, post to one as a guest, use the photobooth, or watch a slideshow on a screen (together, the "Service").

1. Controller

The controller for the processing described in this Policy is:

Slidesome ehf
Icelandic company registration number (kennitala): 410618-0790
Iceland
Email: hello@slideshow.is

In this Policy, "slideshow.is", "we", "us", and "our" refer to that entity.

2. Who This Covers

• Organizers: people who create a slideshow for an event, and the people they add to its team. Organizers sign in with their email.
• Guests: people who post photos, videos, or messages to a slideshow, or take photos with its photobooth. Guests don't create an account.
• Viewers: anyone who opens a slideshow's guest page or watches its screen.

The organizer decides what their slideshow collects (for example, whether guests are asked for their name), approves or removes posts, and decides who gets the link. We run the Service and process the data to provide it.

3. Personal Data We Collect

Organizers

• email address and whether it has been confirmed;
• a password hash, only if you choose to set a password (we never store the password itself);
• sign-in codes and session records, stored as hashes;
• your slideshows, their settings, designs, and uploaded images (such as a logo or a background);
• the email addresses of people you add to your team; and
• your purchases: plan, purchase date, and Paddle's identifiers for them. Paddle processes your payment details, and we never receive your full card details.

Guests

• the photos, videos, and messages you post, with any caption;
• the name you enter, if you enter one (it is optional unless the organizer asks for it);
• the effect you pick for your post and the reactions you give; and
• a random device identifier created in your browser. It lets the Service recognise posts from the same phone, apply limits, and let the organizer block a device that misbehaves. It is not linked to your identity.

Before a photo is uploaded, your browser re-encodes it, which removes location (GPS) and other camera metadata from the file. Videos are uploaded as recorded and may still contain metadata from your phone.

Everyone

• IP address, browser and device information, and request details, which our hosting provider handles to deliver the Service, protect it, and limit abuse; and
• messages you send us and our replies.

4. Posts Are Shown to Others

A slideshow is made to be shared. Posts that are shown (approved by the organizer, or shown automatically if the organizer allows it) appear on the slideshow's screen, on its guest page, and to anyone who has its link. The files are stored at addresses that are hard to guess, but anyone who has such an address can open the file. Please only post what you are happy for the event to see, and only post other people with their permission.

5. Purposes and Legal Bases

Where we rely on legitimate interests, we weigh them against your rights. You may object as described in Section 10.

6. Cookies and Browser Storage

When an organizer signs in, we set one essential cookie that keeps the session. The Service also keeps a few things in your browser's local storage: the guest device identifier, the name you entered, a locked photobooth's PIN (as a hash), and display preferences. These are needed for the Service to work and are not used for tracking.

We don't use advertising cookies, third-party analytics, or tracking pixels.

7. Recipients and Subprocessors

We share personal data only as needed with:

• Cloudflare, which hosts the Service and stores its data (Workers, Durable Objects, D1, and R2), resizes images and videos for screens, and sends our emails;
• Paddle, our merchant of record, which sells paid plans and handles payments, tax, and refunds as an independent controller under its own privacy notice;
• professional advisers, such as lawyers, accountants, and auditors, under confidentiality duties; and
• authorities, where required by law or necessary to protect rights and safety.

The organizer of a slideshow, and the people on its team, can see the posts, names, and device information of guests who post to it.

We do not sell personal data.

8. International Processing

Slidesome ehf is established in Iceland, in the European Economic Area. Cloudflare runs a global network, so data may be processed in countries outside the EEA. Where that happens, we rely on an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism.

9. How Long We Keep Data

• A slideshow's posts (photos, videos, messages, names, and reactions) are deleted automatically when its plan's keeping period ends: 30 days after the first guest post on Free, 2 months on Basic, and 6 months on Pro. If no guest ever posts, the period counts from when the slideshow was created (90 days on Free).
• An organizer can delete a slideshow at any time, which deletes its posts and files right away.
• Accounts are kept until you delete yours in your account settings. Deleting your account deletes the slideshows you own and signs you out everywhere.
• Sign-in codes expire after 10 minutes, and sessions after 30 days without use or when you log out.
• Purchase and accounting records are kept for as long as Icelandic bookkeeping law requires, currently 7 years.
• Short-lived request logs kept by our hosting provider are deleted on its regular cycle.

Copies in access-restricted backups or provider recovery systems may take a short time longer to be removed and are not used for anything else.

10. Your Rights

Subject to the GDPR and its exceptions, you may have the right to:

• get information about our processing and a copy of your personal data;
• correct inaccurate data;
• have your data erased;
• restrict processing;
• receive data you provided in a commonly used, machine-readable format;
• object to processing based on legitimate interests; and
• withdraw consent where processing is based on consent.

Guests: to have a post removed, ask the organizer of the event, who can remove it right away, or email us. We may ask for details that show the post is yours or shows you, such as when it was posted.

To exercise a right, email hello@slideshow.is. We will answer without undue delay, normally within one month.

11. Children

Organizers must be 18 or older. The Service is not directed at children. Guests under 16 should only post with the permission of a parent or guardian. Organizers are responsible for making sure their event's guests may post photos of the people in them.

12. Security

We use measures appropriate to the risks, including hashed sign-in codes, sessions, and passwords, encrypted connections, access controls that limit each slideshow to its own team, and rate limits. No system is completely secure. If you think an account has been misused, email us right away.

13. Complaints

Please contact us first so we can try to resolve your concern. You also have the right to complain to the supervisory authority in Iceland:

Persónuvernd (Icelandic Data Protection Authority)
https://www.personuvernd.is/

You may instead contact the supervisory authority in the EEA country where you live, work, or believe an infringement occurred.

14. Changes to This Policy

We may update this Policy to reflect changes to the Service, the law, or our processing. The updated version will state its effective date. We will give reasonable notice of material changes, for example by email or in the Service.

15. Contact

Slidesome ehf
Kennitala: 410618-0790
Iceland
hello@slideshow.is