Privacy Policy

Draft: legal review required before publication. This template describes how Shanzhu processes personal data. Placeholders marked [[to complete: …]] must be filled with your company's actual details and validated by legal counsel before going live.

This policy explains what personal data we collect, why, how long we keep it, and the rights you and your guests can exercise. Retention is time-limited, deletion can be requested at any time, and data is not sold to third parties.

Data controller and contact

The controller responsible for processing the personal data described here is:

• Company: [[to complete: legal/registered name]]
• Registration: [[to complete: SIREN / company registration number]]
• Registered office: [[to complete: postal address]]
• Data protection contact / DPO: [[to complete: dpo@yourdomain]]

For any question about this policy or your rights, write to the contact above. If your account operates under a white-label brand, the agency that runs the event may act as controller for guest data, with Shanzhu acting as processor on their behalf.

Data we collect and why

We collect only what is needed to run the service:

• Account data (name, email, organization, role): to create and secure your workspace.
• Billing data (plan, invoices, payment status): to manage your subscription and credits. Card details are handled directly by our payment provider (see below); we never store full card numbers.
• Event and fleet data (event configuration, kit assignments, team assignments): to operate the platform.
• Guest media (photos and videos captured at the booth, plus share recipients by email or phone when a gallery is sent): to deliver galleries and shared links.
• Technical logs (IP address, device and usage metadata): for security, fraud prevention, and service reliability.

Legal bases: performance of our contract with you, your and your guests' consent where required (e.g. sharing media), our legitimate interest in securing and improving the service, and compliance with our legal obligations.

How long we keep it

• Account and billing data: kept for the life of the account and for the legal retention periods that apply to invoices and accounting records.
• Guest galleries and media: retained according to the retention window configured per event, after which they are automatically purged by our system. [[to complete: default retention period]]
• Technical logs: [[to complete: log retention period]].

You can trigger earlier deletion at any time from the platform, and expired galleries are released automatically to minimize the data footprint.

Processors and hosting

We rely on a limited set of vetted providers, each bound by contractual data-protection commitments:

• Payment processing: Stripe, for subscriptions and one-off packs.
• Hosting / infrastructure: [[to complete: hosting provider and region]].
• Email / SMS delivery: [[to complete: email and SMS providers]].

Where data is transferred outside your region, we rely on appropriate safeguards such as standard contractual clauses. A full, current list of subprocessors is available on request.

Your rights

Under applicable data protection law (including the GDPR), you and your guests may request:

• Access to the personal data we hold.
• Rectification of inaccurate data.
• Erasure ("right to be forgotten").
• Portability of data you provided, in a structured format.
• Restriction or objection to certain processing.

To exercise any of these, contact us at [[to complete: dpo@yourdomain]]. We respond within the legal deadline. You also have the right to lodge a complaint with your supervisory authority (in France, the CNIL).

---

You can see how retention and deletion work on a real event.

Try it · 1 free event