Legal
Privacy Policy
Last updated: 23 May 2026
Key summary: Your selfie is processed to generate your video and then permanently deleted — typically within 60 minutes. We never sell your data. We never use your face for anything other than your video.
1. Data controller
EventFlix (“we”, “us”, “our”) is a trading name of POLICYANDPLAY LTD, the data controller for personal data processed through event-flix.com.
Contact: privacy@event-flix.com
2. What data we collect and why
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Selfie photograph | Starting frame for AI video generation | Explicit consent | Deleted within 60 min of generation completing |
| Email address (optional) | Sending you your video link | Consent | Until you request deletion or 12 months |
| Generated video | Storing your personalised video for download | Contract performance | 30 days after generation |
| Payment data | Processing the £5 HD download fee | Contract performance | Handled by Stripe — we store only a session reference |
| Couple details (names, wedding date) | Personalising the guest experience | Contract performance | Until couple requests deletion or 24 months |
| Usage logs | Debugging and preventing abuse | Legitimate interest | 30 days |
3. Facial / biometric data — important
Your selfie photograph is used only to provide the starting frame for your AI-generated video. We do not use it for facial recognition, identity verification, or any other purpose.
Under UK GDPR, facial images processed for identification purposes are special category data. We process your photo under explicit consent, which you provide by tapping “I consent” before the camera opens.
You may withdraw consent at any time by contacting privacy@event-flix.com. We will delete your photo immediately (it is likely already deleted by the time you read this).
4. Third parties we share data with
We use the following sub-processors to deliver the service:
- fal.ai (USA) — AI video generation. Your selfie is transmitted to fal.ai's servers to generate the video. fal.ai deletes inputs after processing per their data retention policy. fal.ai Privacy Policy
- Supabase (AWS eu-west-1) — database and file storage. Stores your generated video (temporarily) and event metadata. Supabase Privacy Policy
- Stripe (USA) — payment processing. We never see or store your card details. Stripe Privacy Policy
- Netlify (USA) — website hosting and CDN. Netlify Privacy Policy
- Resend — transactional email (sending your video link). Resend Privacy Policy
We do not sell, rent, or share your personal data with any third party for marketing purposes.
5. International transfers
Some of our sub-processors are based in the USA. Data transfers are protected by Standard Contractual Clauses (SCCs) or the UK–US Data Bridge where applicable.
6. Your rights (UK GDPR)
You have the right to:
- Access — request a copy of the personal data we hold about you
- Erasure — request deletion of your data at any time
- Rectification — correct inaccurate data
- Restriction — limit how we process your data
- Portability — receive your data in a machine-readable format
- Object — object to processing based on legitimate interest
- Withdraw consent — at any time, without affecting lawfulness of prior processing
To exercise any right, email privacy@event-flix.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
7. Cookies
We use essential cookies only — specifically a session cookie required for Stripe checkout to function. We do not use advertising, tracking, or analytics cookies.
No cookie consent banner is required for essential cookies under UK PECR.
8. Security
We use industry-standard security measures including HTTPS encryption in transit, Supabase Row Level Security (RLS) to restrict data access, and private storage buckets for selfie photos. Access to production systems is restricted to authorised personnel.
9. Children
Our service is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has submitted data, contact us and we will delete it immediately.
10. Changes to this policy
We may update this policy from time to time. We will note the revision date at the top of the page. Significant changes will be communicated via the service.
11. Contact
For any privacy questions or to exercise your rights: