Privacy Policy

Guest Can Film ("we", "us") is an online service based in the Philippines. We handle personal information in line with the Data Privacy Act of 2012 (Republic Act No. 10173) and other laws that apply. You can reach us about anything in this policy at support@guestcanfilm.com.

This policy covers two kinds of people:

• Hosts: photographers, studios and organizers who create an account, set up events for their clients and, if they choose, buy event packs or photo add-ons.
• Guests: people who scan an event's QR code to share photos. Guests do not create an account and are not asked for their name or email.

Guest Can Film does not keep its own copy of guest photos. When a guest uploads, the file goes from their browser directly into the host's own Google Drive, in a folder for that event. The host owns and controls those files under their agreement with Google.

For photos uploaded to an event, the host decides why and how they are used (for example, delivering them to their client). In privacy-law terms the host is the personal information controller for event photos, and we process them on the host's behalf. Questions about a specific event's photos are best sent to the photographer or organizer who ran it.

From hosts

• Account details such as your name, email address, profile picture and sign-in method. Sign-in is handled by our authentication provider, Clerk. If you sign in with or link a Google account, Clerk receives your basic Google profile.
• Event details you enter: title, client name, description, event type, dates and times, upload and slideshow settings, and an optional banner image (stored in your Google Drive).
• Google Drive connection: which linked Google account is used for storage and the IDs of the "Guest Can Film" folders we create in it. The access tokens themselves are stored and refreshed by Clerk, not in our database.
• Orders and credits: the pack or add-on you buy, its price, the order code, the payment method, the GCash reference number, payer name and receipt picture you submit (it can show your GCash name, number and the transaction details), the order status, and a record of the event and photo credits added to or used from your account. We never receive your GCash PIN, card details or bank login.
• In-app notifications we send you, such as payment updates or an event running low on guest photos, and whether you have read them.

From guests

• The photos you choose to share. They are saved to the host's storage, not ours. Photos can contain personal information (faces, places, and embedded details such as the time and location the photo was taken). We check that each file really is an image and refuse anything else.
• Upload records: file name, file type, size, upload time, whether the host approved it for the slideshow, whether you removed it, and the file's ID in the host's storage.
• A random device ID kept in a cookie on your phone. It lets you see and remove your own uploads and applies the host's per-guest limit. We store only a one-way hash of it per event.

From everyone

• Technical data such as IP address, browser type and request logs, recorded by our hosting provider for security and to keep the service running. To stop abuse, we keep a short-lived count of requests per hashed IP address; we do not store the IP address itself in our database.

• To provide the service: create events, generate QR codes, receive uploads, show the host's gallery, let guests manage their own uploads and play the approved-photo slideshow.
• To sign hosts in and keep accounts secure.
• To apply plan limits: the number of events on an account, the guest photo credits of each event, the upload window and the number of photos per guest.
• To process orders: verify GCash payments, add credits, and handle rejections and refunds.
• To send in-app notifications about payments and events.
• To prevent abuse and fraud, fix problems and keep the service secure.
• To contact hosts about their account, orders or important changes to the service.
• To keep records and comply with legal, tax and accounting obligations.

When a host connects Google Drive, they sign in to Google and grant access through Clerk. We use that access only to create a "Guest Can Film" folder and a folder for each event, upload guests' photos and the event banner into those folders, show thumbnails in the host's gallery and on the guest's "Your photos" list, serve approved photos on the event slideshow, and move files to the Drive trash when the host or the guest who uploaded them deletes them. We also read the account's email address and storage quota to show them in settings. We only work with folders and files the app created.

Guest Can Film's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we:

• use Google user data only to provide and improve the features described above;
• do not sell it, or use or transfer it for advertising;
• do not use it to train AI or machine-learning models;
• do not let people read it, except with the host's permission, for security purposes, to comply with the law, or when it is aggregated and anonymized.

Hosts can stop Drive access at any time by removing the Google account under Account settings, or by revoking access from their Google account permissions. Files already in the host's Drive stay there.

We do not sell personal information. It is seen or shared only as needed to run the service:

• The event's host sees every photo uploaded to their event. Guests see only their own uploads, but anyone with the event's slideshow link can see photos the host approved.
• Our administrators can view accounts, events, photos and orders to review payments, give support, and investigate abuse or problems. Access is limited to people who run the service.
• Service providers who process data for us: Clerk (sign-in and Google connection), Google (file storage in the host's Drive), Prisma (database hosting) and Vercel (website hosting). GCash payments are made in the GCash app and are covered by GCash's own privacy policy.
• Authorities or others when the law requires it, or to protect the rights, safety and property of our users, the public or us.
• A buyer or successor if the service is sold or merged, under this policy.

Some of these providers store data outside the Philippines, including in the United States. We use providers that protect data with security measures comparable to those required by Philippine law.

We use only cookies needed for the service to work. We do not use advertising or tracking cookies.

• Sign-in cookies set by Clerk to keep hosts logged in.
• A guest device cookie (kept for about one year, not readable by scripts on the page) that ties uploads to your phone, so you can see and remove your own photos and the per-guest limit works.
• Your light or dark theme choice, stored in your browser.

• Account and event data: while the account exists. Archiving an event only hides it in the dashboard. To have an event or your account erased, email us.
• Photos: they live in the host's own Drive until the host deletes them. When a host deletes a photo in the gallery, it is moved to the host's Drive trash (Google keeps it there for 30 days) and its upload record is deleted.
• Photos a guest removes: the file is moved to the host's Drive trash. We keep a small record that it was uploaded and removed, because it still counts toward the guest's limit and the event's photo credits.
• Orders and credit records: as long as tax, accounting and other laws require, even after an account is closed.
• Rate-limit counters: minutes to hours. Notifications: while the account exists.
• Logs and backups: for a limited period, then deleted or overwritten.

Under the Data Privacy Act you have the right to be informed, to access, to correct, to object, to have your data erased or blocked, to data portability, and to claim damages. People in other countries may have similar rights under their local laws.

• Hosts can edit or archive events, delete photos and manage their Google connection from the dashboard, and update or delete their account from Account settings.
• Guests can remove photos they uploaded from the event page, on the same phone, while the event is live. After that, ask the event's photographer or organizer, who controls the photos. If you cannot reach them, contact us and we will help where we can.

To make a request, email support@guestcanfilm.com. We may need to confirm your identity first, and we aim to reply within 15 days. If you are not satisfied, you can file a complaint with the National Privacy Commission.

We use HTTPS everywhere, keep Google tokens with Clerk instead of in our own database, hash device IDs and IP addresses, check every upload is a real image, rate-limit public pages, limit admin access, and give public event and slideshow pages hard-to-guess links. No system is perfectly secure, so please keep your links and account safe and tell us if you notice a problem. If a breach affects your personal information, we will notify you and the National Privacy Commission as the law requires.

Host accounts and purchases are for people aged 18 and over. Guest Can Film is not directed at children. Hosts are responsible for getting any consent needed for photos of children taken at their events. If you believe a child has given us personal information, contact us and we will delete it.

We may update this policy as the service changes. We will change the "Last updated" date above and, for significant changes, tell hosts by email or in the app. See also our Terms of Service.

Guest Can Film, based in the Philippines
Privacy and data requests: support@guestcanfilm.com