Privacy & Cookie Policy

GuestRoll is committed to protecting your personal data. This policy explains what information we collect, why we collect it, how we use it, and your rights under UK GDPR. It also covers how we use cookies on this website.

1. Who We Are

GuestRoll is operated by MJF Digital Ltd, a company registered in England and Wales. References to "GuestRoll", "we", "us" or "our" in this policy refer to MJF Digital Ltd.

We are the data controller for personal data collected through this website and the GuestRoll platform. If you have any questions about this policy or how we handle your data, please contact us at support@guestroll.app.

2. Data We Collect

We collect the following categories of personal data:

• Account information - your name and email address when you register for GuestRoll. If you sign in with Google, we receive your name, email address, and profile picture from Google as part of the authentication process.
• Event details - information you provide when creating an event, such as the event name and date.
• Photos and videos - images and short video clips uploaded to your event by you or your guests (videos on Premium events only). Guest uploads are anonymous unless a guest chooses to provide their name. Videos may include people's faces and voices. We do not analyse them to identify anyone.
• Payment information - when you purchase a GuestRoll event, your payment is processed securely by Stripe. We do not store your card number, expiry date, or CVV - only a record of the transaction (amount, date, and Stripe transaction ID).
• Usage data - anonymised analytics data about how visitors use our website, collected via Google Analytics (see Section 6).

We do not collect any special category data (such as health information, ethnicity, or biometric data).

3. How We Use Your Data

We use your personal data for the following purposes:

• To create and manage your GuestRoll account.
• To provide the GuestRoll service - hosting your event and making your photo and video gallery available.
• To process videos you upload, for example converting them into a smaller copy that plays on any phone or computer.
• To process your payment and send you a receipt.
• To send you important service-related communications, such as account confirmations and support responses.
• To improve our website and service using anonymised analytics data.

We do not sell your personal data to third parties. We do not use your data for automated decision-making or profiling.

4. Legal Basis for Processing

Under UK GDPR, we rely on the following legal bases:

• Contract - processing your account and payment data is necessary to provide the service you have purchased.
• Legitimate interests - we use anonymised analytics data to understand how our website is used and to improve it. This does not override your rights and freedoms.
• Consent - we only set analytics cookies with your consent. You may withdraw consent at any time via the Cookie Preferences link in our website footer.

5. Data Storage and Security

Your photos, videos and event data are stored on servers in the United Kingdom (London). To load galleries and downloads quickly, files are delivered through a content delivery network (CDN) run by our cloud hosting provider, which may briefly keep copies of files at locations outside the UK. Where this involves personal data, it is protected by appropriate safeguards as required by UK GDPR.

We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. These include encrypted connections (HTTPS), access controls, and secure credential storage.

6. Cookies

This website uses cookies. A cookie is a small text file stored on your device when you visit a website. We use the following cookies:

Apart from strictly necessary cookies, we only set cookies with your consent. When you first visit you can accept all, reject all, or choose by category, and you can change your choice at any time using the Cookie Preferences link in the footer.

To be able to show that consent was given, we keep a record of each cookie choice: a random consent ID, the date and time, the categories you chose and the version of our banner. This record contains no IP address, name or email address, and cannot be used to identify you. We keep it for as long as needed to demonstrate that consent was given.

• Strictly necessary - cc_cookie stores your cookie choice (and a consent record with a timestamp) for up to 6 months so we do not ask again on every visit. This does not track you.
• Strictly necessary (GuestRoll app, app.guestroll.app) - the same cc_cookie choice cookie is shared between this website and the app, so you are only asked once. The app also sets cookies it needs to work, which do not need consent: Clerk (__session, __client_uat) keeps organisers signed in; Stripe (__stripe_mid, __stripe_sid) provides secure payments and fraud prevention; and gr_pin_* remembers that a guest has entered an event PIN (up to 90 days).
• Analytics - Google Analytics (GA4) - cookies _ga and _ga_* (up to 2 years) collect anonymised information about how visitors use our website (pages visited, time on site, general location). This helps us improve GuestRoll. Only set if you accept analytics.
• Marketing - Meta Pixel and Google Ads - cookies such as _fbp and _gcl_* (up to 3 months) help us measure the effect of our adverts and show relevant ones. Google may also set its own advertising cookies, IDE (up to 13 months) and NID (6 months), on its own domains for the same purpose. Only set if you accept marketing.

You can also control cookies through your browser settings. Note that disabling all cookies may affect the functionality of some websites.

For more information on how Google uses data collected via Analytics, see Google's Privacy Policy.

7. Third-Party Services

We use the following third-party services to operate GuestRoll:

• Stripe - payment processing. Stripe is PCI-DSS compliant and handles all card data on your behalf. See Stripe's Privacy Policy.
• Cloud hosting provider - cloud hosting, file storage and video processing for photos, videos and event data, in the UK (London) region. Images, videos and downloads are delivered through a content delivery network operated by the same provider, which may briefly keep copies of files outside the UK in order to deliver them quickly.
• Google Analytics - website analytics, with your consent. Data is anonymised and does not personally identify you.
• Google Sign-In - if you choose to sign in with Google, your authentication is handled by Google. We receive your name, email address, and profile picture from Google solely to create and identify your account. See Google's Privacy Policy.

Each of these providers acts as a data processor on our behalf and is contractually obligated to handle your data securely and in accordance with UK GDPR.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. Specifically:

• Account data (name, email) - retained while your account is active. Deleted within 30 days of account closure.
• Event photos - available for the duration specified for your event's plan (30 days on Free, 90 days on Premium), after which they are no longer accessible. You may delete your event and all associated photos at any time from your dashboard.
• Event videos (Premium) - video files are permanently deleted 14 days after your event's upload and download period ends, or 7 days after you remove a video from your gallery, whichever applies. You can delete your event and its videos at any time from your dashboard.
• Payment records - retained for 7 years in accordance with UK financial record-keeping requirements.
• Analytics data - anonymised and retained by Google Analytics per their standard data retention settings.

9. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access - you can request a copy of the personal data we hold about you.
• Right to rectification - you can ask us to correct inaccurate or incomplete data.
• Right to erasure - you can ask us to delete your personal data, subject to legal obligations.
• Right to restrict processing - you can ask us to limit how we use your data in certain circumstances.
• Right to data portability - you can request your data in a structured, machine-readable format.
• Right to object - you can object to processing based on legitimate interests.
• Right to withdraw consent - where processing is based on consent (e.g. analytics cookies), you can withdraw it at any time without affecting the lawfulness of prior processing.

If you appear in a photo or video at someone else's event and would like it removed, email support@guestroll.app. To exercise any of these rights, please contact us at support@guestroll.app. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

10. Changes to This Policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If changes are significant, we will notify you by email or via a notice on our website. Your continued use of GuestRoll after changes are posted constitutes acceptance of the updated policy.

11. Contact

If you have any questions, concerns, or requests regarding this policy or your personal data, please contact us:

MJF Digital Ltd (GuestRoll)
Email: support@guestroll.app