Privacy Policy

1. Who we are

Qroissant is a photo delivery service that allows photographers to share photos with their clients via QR codes. The service is operated from Sweden and is subject to the General Data Protection Regulation (GDPR).

When this policy refers to "we", "us", or "Qroissant", it means the operator of qroissant.app.

2. What data we collect

We collect the minimum data needed to provide the service.

For photographers (account holders):

• Email address — used to log in, receive account notifications, reminders, and for sharing session links with clients
• Password — stored as a one-way hash, never readable
• Billing information — handled entirely by Stripe; we never see or store card numbers
• Usage data — number of photos uploaded, sessions created, and storage used, for plan enforcement
• IP address — logged at login and at the time of each photo upload, retained for up to 12 months from the date of the event, and for up to 12 months after account closure. IP addresses are stored to detect abuse, investigate potential illegal content, and comply with legal obligations.

Optional contact information:

If you voluntarily provide a phone number or other contact details — for example when setting up a session or contacting support — we may store this information to provide the service. See section 3 for details on how this data may be used.

For gallery visitors (photo recipients):

• Your consent — we store a record in your browser (localStorage) that you accepted this privacy policy
• The unique token in your link — used only to retrieve your photos
• No account is created for you, and we do not collect your name or email address unless you choose to provide it

3. How we use your data

We use the data we collect for the following purposes:

• To authenticate photographers and manage their accounts
• To deliver photos to the correct recipient via their unique link
• To enforce plan limits (photo count, storage)
• To process payments via Stripe
• To send transactional emails (account verification, billing receipts, session reminders, and link sharing)
• To communicate information about Qroissant's own services and updates — for example new features or plan changes

We do not build profiles, sell data, or use your information for any purpose unrelated to operating and communicating about our service.

4. Photo storage and deletion

Photos are stored on our servers for a limited period. After the retention period expires, photos are permanently deleted and cannot be recovered.

The default retention period is 90 days from the date of the session. The exact expiry date is shown on your gallery page.

Photographers can delete individual sessions and their photos at any time from the app. When a photographer account is deleted, all associated photos and sessions are permanently removed.

5. Who we share data with

We do not sell or share your personal data with third parties for commercial purposes. We use a small number of service providers to operate the platform:

• Stripe — payment processing. Stripe is the data controller for all payment data. See stripe.com/privacy.
• Server infrastructure — our hosting provider stores data on servers within the EU.

We may disclose data if required by Swedish or EU law, or to protect the rights and safety of our users.

6. Cookies and tracking

We do not use cookies for tracking or advertising.

We use localStorage (browser storage) for two purposes only:

• To keep you logged in to your photographer account (authentication tokens)
• To remember that you accepted this privacy policy on the gallery page

No data from localStorage is shared with any third party. You can clear it at any time through your browser settings.

7. Analytics

We use Google Analytics on our marketing website (qroissant.app) to understand how visitors find and use the site. Google Analytics collects anonymised data including pages visited, time spent, and general geographic region. We have enabled IP anonymisation, meaning full IP addresses are never stored by Google Analytics.

Google Analytics uses cookies and similar technologies. For more information, see Google's privacy policy. You can opt out of Google Analytics tracking using the Google Analytics opt-out browser add-on.

Google Analytics is used on the marketing website only — not inside the photographer app or the photo gallery.

8. Your rights

Under GDPR, you have the following rights regarding your personal data:

• Access — you can request a copy of the data we hold about you
• Rectification — you can correct inaccurate data
• Erasure — you can request deletion of your data ("right to be forgotten")
• Portability — you can request your data in a machine-readable format
• Objection — you can object to certain uses of your data
• Withdraw consent — where processing is based on consent, you can withdraw it at any time

Photographers can delete their account directly from the dashboard, which removes all associated data. To exercise any other right, contact us at the address below.

You also have the right to lodge a complaint with the Swedish supervisory authority: Integritetsskyddsmyndigheten (IMY).

9. Security

We take reasonable technical and organisational measures to protect your data:

• All connections are encrypted via HTTPS
• Passwords are stored encrypted and never in plain text
• Access to photographer accounts requires authentication

No system is perfectly secure. If you discover a security vulnerability, please contact us immediately.

10. Contact

For any questions about this policy or to exercise your rights, contact us:

We aim to respond to all privacy requests within 30 days.