Privacy policy for FotoboxSuite

Last updated: 27 September 2026 · Website, customer portal and Windows app

1. Controller and contact details

Patrick Loewe, Völkerhausen 16, 31860 Emmerthal, Germany. Email: info@fotoboxsuite.de. No data protection officer is currently appointed.

2. Responsibilities and legal bases

FotoboxSuite is the controller for the website, customer accounts, contract administration, billing and the security of its own service. Depending on the purpose, the legal basis is Article 6(1)(b) GDPR (contract), (c) (legal obligations), (f) (legitimate interests in secure, reliable operation and support) or (a) (consent).

We process event photos and related event data under the customer's instructions where we act as a processor. This is governed by the Data Processing Agreement, including the list of service providers. The respective organiser or photo booth operator is responsible, according to their role, for taking and publishing photos, informing guests, establishing the legal basis and setting retention periods. This policy does not replace their privacy notices.

3. Website, cookies and access logs

To deliver and secure the website, we process information including IP addresses, timestamps, requested URLs, HTTP status codes, and browser and connection information. Technical logs support troubleshooting and abuse prevention. Their retention depends on the necessary operational and security purposes. Essential cookies and local storage support sign-in, session management, CSRF protection and gallery access. Tracking, session replay, advertising pixels and external analytics services are not enabled. Website fonts are hosted locally. Further details are available in the cookie information.

4. Hosting and email

Servers and email services are operated through STRATO GmbH, Germany. According to the operator, the server is located in Europe. The technical server infrastructure uses an IONOS cloud network. As part of these services, STRATO processes information including technical access data, stored application data, email addresses and message content. Further information: STRATO privacy information.

5. Enquiries, customer accounts and sign-in

For enquiries, we process the contact and business information provided and the content of the message. Customer accounts involve information including names, companies, email addresses, password hashes, account identifiers, access permissions, contract status and sign-in information. Passwords are not stored in plain text. Account verification, password resets and email changes use tokens with limited validity. Delivery and error information is recorded in an internal email queue. Contact details are not sold to third parties for advertising purposes.

6. Optional Google sign-in

Signing in with Google redirects you to Google. We then receive the account information necessary for sign-in, including your email address, name and Google identifier. Google sign-in is separate from authorising a Google Drive account and does not grant access to photos or Drive files. Google's own processing is governed by Google's privacy policy.

7. Devices, updates and technical error reports

When connecting the Windows app and retrieving updates, we process the device identifier, device name, machine name where applicable, application version, operating system, timestamp, IP address, and licence and synchronisation status.

The app may also report a limited camera setup status to your own customer portal: whether the camera is connected and image adjustments are saved, the type of lighting, and the time of the last verified test photo. Test photos, local camera profiles and technical exposure values are not transmitted.

As part of its device configuration, the app may also report whether local administrator access uses a PIN. The device PIN is stored encrypted and displayed only in the signed-in customer portal for the associated account. It is not included in technical error reports. Deleting the device also removes this stored PIN information.

When a problem occurs, Studio, the installer and the updater collect limited technical error reports. These include timestamps, versions, error categories, technical error codes and nested causes, the affected application workflow, technical call information and, where applicable, the camera model or operating system version. They may also include limited camera, printer and connection states, purely technical server workflow identifiers and a limited sequence of technical steps preceding a problem. After sign-in and device assignment, Studio transmits these reports to FotoboxSuite over an encrypted connection.

These reports do not include photos or business and event content. Recognised credentials, email addresses, URLs and local file paths are removed before transmission. The association with an account and device is retained, so the reports are not anonymous. They are accessible only to administrators and used for troubleshooting and operational security. Offline, a maximum of 250 reports are queued for up to 30 days. Centrally stored reports are deleted after no more than 90 days.

For the internal overview of product onboarding, we record successful account creation and sign-ins, technical download responses and installation, update and startup states confirmed by the application. Technical client reports contain fixed event types, timestamps, versions and randomly generated event and installation identifiers. On the server, the installation identifier is stored only as a hash. Without sign-in, these reports produce unassigned technical totals. Only valid device sign-in can associate these states with the relevant customer account and device. This overview does not include additional tracking cookies, IP addresses, browser fingerprints, URLs, photos or free-form content. The information is removed after no more than 90 days, and associated information is also removed when an account is fully deleted. The unchanged general installer contains no personal download identifier. Separate download and installation reports therefore do not produce an individual conversion rate.

Regardless of online gallery availability, the signed-in app reports minimal usage counters for its own device and, where assigned, its own event: account and device assignment, a random counter run identifier, the number of captured photos accepted by the app and print copies confirmed as completed by the device, the beginning of usage recording and the receipt time. Event reports also include the event assignment. These reports contain no images, filenames, file paths or guest data and do not publish a gallery. Analysis is available only in internal administration. Device totals survive individual event deletions and are removed on the server when the device or account is deleted. Event counters are removed when the event or account is deleted. Earlier usage that was not recorded is not estimated.

8. Event photos, local storage and galleries

The app initially stores photos on the photo booth. Depending on the enabled features, it creates image files, thumbnails, print layouts, event and session identifiers, filenames, timestamps, sharing information and print counters. A local gallery provides photos within the photo booth network. If the online gallery is enabled, images and associated metadata are transmitted to FotoboxSuite and displayed through the respective gallery access. Depending on sharing settings, other event guests may view and download photos. Gallery links, PINs and access credentials must therefore be treated as confidential.

The notice displayed in the app provides information about the event. A single acknowledgement does not constitute consent from all subsequent guests. The responsible operator must separately ensure the legal basis, any necessary consent and guest information for their use.

9. Additional backups: USB, Google Drive, Dropbox and OneDrive

Additional copies are created only in accordance with the selected event and device settings. Cloud destinations require separate authorisation of the relevant account in the portal. Several destinations may be selected at the same time. Availability depends on FotoboxSuite's configuration of the provider.

USB copies are written locally to the selected storage device. Cloud copies are first transmitted over an encrypted connection to a private staging area on the FotoboxSuite server and then transferred to the connected Google Drive, Dropbox or Microsoft OneDrive account. The transferred data comprises the image file and information necessary for storage, such as the filename, event and session identifiers, file size and checksum. Creating an additional backup does not make a guest gallery public.

For the connection, we store protected access authorisations, the provider identifier and transfer status. The permissions used are limited to the file or app-folder functions required by FotoboxSuite. Google API data is used solely for the requested sign-in and backup functions, not for advertising or training general-purpose AI models. Disconnecting removes the persistent access authorisation stored by us. It does not delete files already created in the external account.

The providers' own services are governed by their terms and privacy policies: Google, Dropbox and Microsoft. An operator's authorisation of a cloud account does not replace any necessary legal basis for processing the data of the people photographed.

10. Automations, webhooks and customer API

When automations are configured, selected technical events are sent to recipients specified by the customer. They may contain account, device, event, session and print-job identifiers, timestamps, copy counts, statuses and technical messages. The default webhook contains no image files. The customer selects the recipients and triggers and is responsible for their lawful integration. Delivery attempts are logged with status and error information.

Within the permissions granted, the customer API provides access to the customer's own events, devices and print information. API keys can be revoked. Locally authorised scripts run with the Windows user's permissions. The operator determines what further data these scripts read or transmit to their own services.

11. Billing and Stripe

For contracts and invoices, we process information including names, addresses, email addresses, service periods, plans, invoice numbers, amounts, and payment and subscription status. When a payment or payment management is handled through Stripe, the necessary billing and contract information is transmitted to Stripe. Payment details are entered on Stripe's payment pages. Depending on the service, Stripe acts as a processor or as an independent controller, for example for legal obligations and fraud prevention. Further information: Stripe privacy policy and Stripe Data Processing Agreement.

12. Support, recipients and international transfers

Support access is provided when required and limited to the necessary scope. Technical service providers, payment providers, tax advisers and authorities may receive data where necessary for the relevant purpose or required by law. Cloud and webhook destinations configured by the customer may process data outside the European Economic Area. Such processing may also occur in Google and Stripe services. Lawfulness is determined under Articles 44 et seq. GDPR, for example through an applicable adequacy decision or appropriate safeguards such as Standard Contractual Clauses. On request, we provide information about the recipients and safeguards applicable to a specific service. A connection alone does not guarantee that data is stored exclusively in the EU.

13. Retention, deletion and separate copies

Deleting an event removes its data from the active server storage. Related cloud jobs, automation data and server staging copies are also cleaned up. Active transfers are stopped or awaited before deletion is completed. Failed file deletions are retried. Minimal deletion markers containing identifiers and a hash of the local event identifier prevent a photo booth connected later from recreating deleted events. They contain no photos or event names and are retained until the customer account is deleted.

Online galleries become inaccessible at their configured expiry time. Their photos and thumbnail files are removed during the subsequent maintenance run. Event settings may remain for administration. Successfully transferred cloud staging copies are deleted during the next maintenance run, no earlier than five minutes after transfer. Copies not yet confirmed are scheduled for deletion after no more than 30 days or earlier event expiry. In that case, the additional backup is considered incomplete. Local originals are not deleted as a result.

Transfer records and print journals generally remain associated with the event and are deleted with it. Completed or permanently failed webhook delivery histories are removed during maintenance after no more than 90 days. Fully deleting an account also removes stored cloud access, API access and account-related error reports. Invoice and contract documents subject to statutory retention are kept to the extent required. This may require separate account clean-up.

Local originals on the photo booth, USB exports, images already downloaded, webhook data received by the customer and copies in their own cloud accounts are separate data holdings. Deleting an event or account on the FotoboxSuite server does not automatically delete these holdings. Their deletion is the responsibility of the relevant operator. Offline devices receive the changed state only after synchronising again.

Technical recovery backups are separate from the active service and accessible only to administrators. The current rotation retains backups from the last 14 days and at least the seven most recent backup states. During extended backup outages, these may be older. They are not used for normal operation. When restoring a backup, previous deletions must be taken into account before access is re-enabled. Other contact and support data is deleted or anonymised once its purpose ends and no statutory retention or legitimate evidentiary obligations prevent this.

14. Safeguards and rights

Safeguards include transport encryption, password hashing, customer-specific access controls, protected cloud credentials, limited permissions, technical logging and backups. Subject to the GDPR, data subjects have rights of access, rectification, erasure, restriction, portability and objection. Consent may be withdrawn with effect for the future. Processing based on legitimate interests may be objected to under Article 21 GDPR.

For rights relating to event photos, the responsible organiser or photo booth operator is generally your contact. We support them as a service provider. For our own processing, you can contact us at info@fotoboxsuite.de. You may lodge a complaint with a data protection supervisory authority, in particular the State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hannover, lfd.niedersachsen.de.