Privacy Policy
Last Updated: October 23, 2026 • Effective Immediately Across All Events
1. Information We Collect
DispoRoll operates as a privacy-first communal disposable camera and audio guestbook platform. We deliberately do not require event guests to create passwords, install native applications, or authenticate through Google or social logins to use the camera.
When a guest scans an event QR code, a random alphanumeric string (nanoid) is stored in their browser’s local storage to associate the guest’s shot count and audio voicemail with the event roll without gathering personally identifiable telemetry. To ensure an instantaneous shutter response in low-connectivity venues, captured image blobs are temporarily stored in browser IndexedDB on the guest’s device and are automatically purged immediately once successfully synchronized to secure cloud storage.
Guests may optionally provide a friendly nickname or signature directly on the camera interface. Entering an alias is completely voluntary; it is used exclusively to attribute photo cards on the Live Projector Wall and in the communal event album, and is never linked to external advertising profiles or behavioral tracking services.
If enabled for the event, guests may voluntarily record a 60-second voice note. Microphone access is requested only during active recording and is never streamed, monitored, or accessed in the background.
Guests may optionally submit their email address to receive their developed photos and communal gallery link upon reveal (via the host’s Auto-Email Gallery Link or manual blast). Guest emails are stored securely, used strictly for album access and transactional event delivery, and are never sold, rented, or shared with third-party advertisers.
For private events protected by a host-configured passcode, an authorization token is stored locally in your browser upon entering the correct PIN. This session verifies your authorization to view developed photographs and the 3D film reel without collecting personal profiling telemetry.
Event hosts authenticate via secure magic link or authenticated session. We store host email addresses and transaction metadata to manage event configurations, billing subscriptions, and cloud storage entitlements.
For Pro Organizers configuring custom studio white-labeling, uploaded studio logos, agency identifiers, and custom camera header text are stored securely in encrypted cloud object storage and edge caches solely to render customized guest camera interfaces and projector walls.
Printable collateral generation processes event artwork locally inside your browser via client-side canvas rendering. For digital Apple Wallet and Google Wallet passes, venue GPS coordinates are stored locally within the encrypted pass bundle exclusively to trigger native lockscreen reminders upon physical arrival at the venue, without transmitting continuous location tracking or telemetry to DispoRoll servers.
2. Google API Services & User Data Policy
DispoRoll offers an optional integration with Google Drive enabling event hosts to automatically backup communal event photos and audio voicemails directly to their Google Drive account.
When an organizer connects Google Drive, DispoRoll requests access to basic profile information (email, profile) to verify account ownership, and the non-sensitive Google Drive scope (https://www.googleapis.com/auth/drive.file). DispoRoll only accesses, edits, and creates files and folders created or opened by DispoRoll itself. DispoRoll does not read, view, search, index, modify, or delete any personal files, photos, or documents outside of the dedicated DispoRoll event backup folder.
Google Drive access is used solely to create a dedicated event backup directory (e.g., “DispoRoll — [Event Title]”) and automatically transfer high-resolution event photographs and audio guestbook MP3/WebM recordings into that folder. Google user data is never used for advertising, marketing, profiling, data brokerage, or training artificial intelligence models.
Google OAuth tokens (access tokens and refresh tokens) are transmitted via TLS 1.3 encryption and stored encrypted at rest in our secure database. Tokens are accessible only by authenticated background sync jobs. Synchronized files in your Google Drive are completely decoupled from DispoRoll; deleting an event or reaching retention limits on DispoRoll never deletes or alters media stored in your Google Drive. Hosts may disconnect Google Drive at any time through their event dashboard or via their Google Account Security Settings at myaccount.google.com/permissions, which immediately halts all sync activity and invalidates stored tokens.
DispoRoll’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3. Service Providers & Infrastructure
To deliver secure, reliable real-time photo and audio processing, DispoRoll relies on industry-standard third-party infrastructure providers:
Encrypted object storage with global edge distribution for high-resolution photo, audio assets, and agency white-label graphics with zero egress tracking.
Low-latency publish/subscribe edge messaging for live venue projector wall synchronization.
Transactional email delivery for photo reveal notifications, communal gallery invitations, and download links.
PayMongo (QR Ph in Philippines) and Lemon Squeezy (Merchant of Record for Global Cards/Apple Pay). DispoRoll never sees or stores your payment card numbers.
4. Media Storage, 7-Day Recovery & Automated Erasure Schedules
Photographs, audio guestbook voicemails, and archives are retained strictly according to the event tier and deletion status:
Retained for 30 calendar days post-reveal, after which originals and archives are permanently pruned.
Retained for 365 calendar days (1 full year), preserving photos and audio through your 1st anniversary.
Retained for 365 calendar days per event roll, with automated Google Drive sync for permanent organizer backup.
When an organizer deletes an event, the data is transitioned into an encrypted 7-day recovery state (“Archived Rolls Vault”) to prevent irreversible accidental loss. During this 7-day grace period, the host can restore the roll with all photos and voicemails intact. If not restored, an automated cleanup worker permanently deletes all media binaries and database records. Hosts may also choose immediate permanent deletion to bypass the 7-day grace period.
5. Privacy Contact & Right to Erasure
Under the Philippine Data Privacy Act of 2012 (RA 10173), GDPR, and California CCPA, you have the right to request erasure of any photograph or audio message you captured. Event hosts may also permanently purge event rolls or reset unrevealed exposures directly from their Host Control Deck at any time. For manual assistance or data subject requests: