Privacy Policy

ERDECKER LLC ("Convivo," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our event media collection platform.

This policy applies to all users of our service, including:

• Guests — people who upload photos and videos to an event
• Hosts — people who create and manage events
• Visitors — people who browse our website without uploading or creating events

2.1 From Guests (Event Attendees)

2.2 From Hosts (Event Organizers)

2.3 Automatically Collected

• Device Information — browser type, operating system, screen resolution
• Usage Data — pages visited, features used, time spent
• Performance Data — load times, errors, crash reports
• Referral Information — how you arrived at our site

With the Event Host

When you upload media to an event, the event host can view your uploads, display name, and upload timestamps. If you chose "Stay Connected," your email is also shared with the host.

With Service Providers

Legal Requirements

We may disclose your information if required by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

Business Transfers

If Convivo is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control.

SMS / Text Messaging

Convivo offers an optional SMS text-messaging program for event guests and hosts. If you provide your mobile number on an event's upload page and choose to be contacted by text, you may receive: a one-time reminder to upload your photos; if you additionally opt in, event updates such as photo-album milestones and a post-event recap; and time-sensitive prompts sent by the event's host or host-designated co-hosts during the event. All messages relate to the specific event you engaged with.

• Consent is optional. Opting in to text messages is never required to use Convivo or as a condition of any purchase. You provide consent per event through the opt-in form on that event's page.
• Message frequency varies depending on the event and your selections.
• Message and data rates may apply.
• Reply STOP to any message to unsubscribe, or HELP for help. You can also email [email protected].
• We do not sell or share your mobile number or text-messaging opt-in with third parties or affiliates for their own marketing purposes. Phone numbers are used only to deliver the messages described above, through our messaging provider (Twilio) acting on our behalf.

Where Your Data Is Stored

Your data is stored in the United States. Media files are stored using Cloudflare R2, and account/event data is stored using Neon.tech PostgreSQL databases.

Security Measures

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• bcrypt password hashing with salting
• OAuth token rotation and secure storage
• Role-based access controls
• File type validation and size limits
• Scoped API access with JWT tokens

Pass-Through Model (Free Events)

Permanent Storage Model (Paid Events)

Account Data

Host account data is retained as long as the account is active. You may request deletion of your account and all associated data at any time by contacting us.

7.1 GDPR Rights (EU/EEA Residents)

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7.2 CCPA Rights (California Residents)

Convivo does not sell personal information. California residents have the right to know what personal information is collected, request its deletion, and not be discriminated against for exercising their rights.

7.3 Deletion Process

• Hosts: Delete your account through the settings page, or contact us at [email protected]. This will delete all your events, media, and account data.
• Guests (Stay Connected): Contact us with the email address you provided. We will remove your email and associated data from all events.
• Guests (Share Freely via Claim Token): Use your claim token to manage or delete your uploads. If you have lost your claim token, contact us and we will assist on a best-effort basis.

Convivo is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information promptly.

Users between the ages of 13 and 18 may use Convivo with the consent and supervision of a parent or legal guardian.

Convivo integrates with third-party services to provide its features. Each service has its own privacy policy:

• Google Privacy Policy — Sign-in and Google Photos export
• Microsoft Privacy Statement — Sign-in and OneDrive export
• Stripe Privacy Policy — Payment processing

We request only the minimum scopes necessary for each integration. You can review and revoke access to connected services at any time through your account settings.

Convivo is offered only in the United States. Our servers, processors, and operations are located in the United States, and all data is processed and stored in the United States.

We do not direct, market, or offer the Service to individuals located outside the United States, and we do not monitor the behavior of users outside the United States. Host accounts require a U.S. billing address and are gated to U.S. IP addresses at signup.

If you are located outside the United States and you nonetheless choose to access the Service or upload content — for example, by scanning a QR code at an event hosted by a U.S. Host — you do so on your own initiative. By doing so, you acknowledge that your information will be transferred to, stored, and processed in the United States under U.S. law, and that the Service is not designed to comply with the data protection laws of your jurisdiction.

Because we do not target users outside the United States, we do not rely on Standard Contractual Clauses, the EU–U.S. Data Privacy Framework, the UK International Data Transfer Addendum, or other cross-border transfer mechanisms typically used by globally-offered services. If your jurisdiction’s data protection regime requires such mechanisms in order for your data to be processed in the United States, please do not use the Service.

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice before the changes take effect, via email notification and/or a prominent notice on our website.

Your continued use of Convivo after the effective date of a revised policy constitutes your acceptance of the changes. We encourage you to review this page periodically.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: