Privacy Policy

MB Saugiskis Jono Šliūpo g. 13A, Vilnius, Lithuania Contact: support@blicas.com

We are the data controller responsible for the personal data processed through the Blicas service.

Account data: email address, password hash, Google account identifier if you use Google sign-in.

Event data: event title, welcome message, event date, cover image URL, color preferences, QR link identifier.

Uploaded content: photos and videos guests upload to your event, along with the guest's optional display name and an anonymous upload token used to identify their session.

Payment data: when you purchase a paid plan, our payment processor collects billing details on our behalf. We only receive the payment confirmation and a reference ID — we do not store card numbers.

Technical data: IP address, browser type, device type, timestamps of access, and pages visited. This is collected automatically via server logs and analytics.

• Provide the service: create and host event pages, store uploaded media, generate download archives. • Authenticate users and secure accounts. • Process payments for paid plans. • Communicate service-related messages (account confirmation, support replies). • Improve the service through aggregated usage analytics. • Comply with legal obligations.

We process personal data on the following legal bases: (a) performance of the contract with you when providing the service; (b) your consent for analytics and optional features; (c) our legitimate interest in securing and improving the service; (d) compliance with legal obligations.

We use the following providers to operate the service. Each has their own privacy policy and handles your data under a data processing agreement with us:

• Supabase — authentication and database (EU/US). • Cloudflare R2 — storage of uploaded photos and videos. • Dodo Payments — payment processing for paid plans. • Google — sign-in (OAuth) and usage analytics. • Hostinger — server hosting infrastructure.

We do not sell your personal data to third parties.

Event media is retained for the retention period of the plan you select (7, 30, or 90 days from the event date). After that, media is automatically deleted from our storage.

Account data is kept for as long as your account is active. You may request deletion at any time.

Payment records are kept as required by tax and accounting laws (typically 10 years in Lithuania).

Server logs are kept for up to 12 months.

We use strictly necessary cookies for authentication and session management. We use Google Analytics to understand how the service is used in aggregate. You can disable analytics in your browser settings or via a consent control where applicable.

Under the GDPR (EU users) you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to withdraw consent where processing is based on it. You may also lodge a complaint with the State Data Protection Inspectorate of Lithuania (VDAI).

Under the CCPA (California residents) you have the right to know what personal data we collect, to request deletion, to opt out of the sale or sharing of personal information (we do not sell), and to non-discrimination for exercising your rights.

To exercise any right, contact support@blicas.com.

The service is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

Some of our processors are located outside the European Economic Area. When we transfer personal data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. Material changes will be announced on the service.

Questions about this Privacy Policy or your personal data? Email support@blicas.com.