We never sell or rent your data under any circumstances, and we never use your event's content for advertising or to train artificial intelligence models. The Service is operated from Honduras under the Brinddi trade name, and in this Policy we call it "Brinddi", "we" or "the Service". By using Brinddi you accept the practices described in this Privacy Policy.
1.Who the controller is and how to contact us
The controller of the data in this Policy is Brinddi, the brand under which the QR memories Service is operated from Honduras. Brinddi decides what data is collected and for what purposes, within the limits this Policy explains.
For any matter about privacy, your rights or how the Service works, you can write to us anytime at hola@brinddi.com. We handle requests in the order they arrive and reply within a reasonable time.
2.Scope of this Policy
This Policy applies to the information we process on the Brinddi website, in the web app (PWA) guests use to upload photos and videos, and in the dashboard where the host manages their event and downloads the content. We may process data about two kinds of people:
- Hosts, who create an account, set up an event and pay for the Service.
- Guests, who scan the event's QR and upload photos or videos from their browser without installing anything or creating an account.
This Policy doesn't cover third-party sites, apps or services you reach from Brinddi, such as the payment gateway. Each third party has its own policies, and we recommend you review them.
Brinddi is offered in the 13 countries where our payment processor can charge cards: Mexico, the United States, Guatemala, El Salvador, Honduras, Nicaragua, Costa Rica, Panama, the Dominican Republic, Belize, Guyana, Suriname and Sint Maarten. It's also offered in other territories where the processor operates and the law allows it.
We process your data under the personal data protection law that applies in your country. Some examples are Mexico's Federal Personal Data Protection Law (LFPDPPP), US state laws such as California's CCPA/CPRA, Costa Rica's Law No. 8968, Panama's Law No. 81 of 2019, Nicaragua's Law No. 787, El Salvador's Personal Data Protection Law and the Dominican Republic's Law No. 172-13. Where that law doesn't exist yet or doesn't designate a specific authority, as in Honduras or Guatemala, we still apply this Policy's commitments as a minimum standard of protection.
3.What data we collect
3.1 Host account data
To create and manage your account we collect your email and the details you give us when you sign up. You sign in with your email and a password, or with a one-time code we email you. Your password is never stored as is: we keep an encrypted fingerprint that can't be reversed.
If you upload a profile photo, we store it resized to 256 px. Only you see it when you sign in to your account. It's deleted when you remove it or when your account is deleted.
3.2 Event data
When you create an event, we collect the information that sets it up: the event type, its name, its date, the "moments" or sections you define, the visual theme you choose and the plan you buy. This data is linked to your account.
3.3 Event content and technical metadata
We collect the content that's uploaded: the photos and videos you and your guests contribute to the event. With each file we may receive technical metadata that the file itself or the browser includes, such as the capture date and time, the file type and size and, sometimes, EXIF data like the device model or orientation. If the guest's device recorded the location, the image may carry geolocation data in its EXIF. We recommend guests turn that option off if they don't want to share it.
3.4 Guest email and phone
To join an event and upload content, we ask the guest for their email. We use it to send them the album with the photos and videos they captured themselves at that event. In that same email we may invite them to create their own event on Brinddi. If they want, the guest can also leave their phone or WhatsApp number, and we use it only to send that same album through that channel.
Separately, and if they want, the guest can check a box to receive news and promotions from Brinddi. The box isn't required to join the event or to receive the album. It only turns on recurring marketing communications, which the guest can cancel at any time, as section 11 explains. Brinddi processes this guest contact data as the controller. The event host doesn't get access to guests' emails or phone numbers.
Brinddi doesn't verify a guest's age when it receives their email or phone. If a guest is a minor, it's the host who must get their parents' or guardians' consent to collect and use that data, under the law of your country. We don't knowingly send marketing communications to minors. If we detect that we're processing a minor's data without proper authorization, we delete it. If you're a parent or guardian and think we collected data from a minor in your care, write to us and we'll sort it out.
3.5 Usage and analytics data
To operate, secure and improve the Service, we collect minimal technical usage data, such as IP address, browser and device type, pages visited, timestamps and basic interactions. We use this information in aggregate, for the operation and security of the Service. We don't use it to build commercial profiles of people.
3.6 Transaction data
When you pay, the charge is processed by Pagadito, our payment gateway. Your card number, expiration date and CVV never go through Brinddi's servers and aren't stored by us. You enter them directly in Pagadito's secure environment. For each purchase we keep only the transaction data we need to confirm the payment and provide support: an operation identifier, the amount, the currency (USD), the date and the payment status, which may be approved, declined or refunded.
3.7 Credit wallet and white-label
If you're a planner or a company that uses Brinddi to manage several events, we also process your credit wallet data: available balance, credit purchases, usage, validity and rollover, meaning the credits carried over from one period to the next. We also process information about the events you create with those credits.
In the white-label, or reseller, model, the planner is the controller or joint controller toward its end clients and guests, and Brinddi processes that data on its behalf to provide the Service. In that case the planner must inform its clients about how their data is processed and get their consent.
3.8 Partner access request
To see pack prices and buy credits you need to request Partner access through a form. There you give us your full name, your role, your company's name, what it does, what your business is about, how many events you run per month, your website or Instagram, your email, your WhatsApp with country code, your city and your country. If you request it while signed in, we also keep which account requested it.
We use this data to review the request, write to you with the code that activates access, and learn who's interested in reselling Brinddi. The code arrives in your email, works once, expires after 30 days and can only be activated with an account using that same email. We keep the date it was activated. We don't use your WhatsApp for automated messages or share it with anyone. You can ask us to delete your request by writing to hola@brinddi.com.
3.9 Replies to our emails
If you reply to an email we sent you, we keep your address, the subject and the text of your reply. An automated process sorts it based on what you wrote: an option number, a problem, another question or an unsubscribe request. That determines whether you get an automatic reply and, if you never paid for a plan, a discount code. If you ask to unsubscribe, we stop sending you those emails. You can ask us to delete your reply by writing to hola@brinddi.com.
4.What we use your data for and on what basis
These are the purposes for which we process your data, each with its legal basis:
- Providing the Service: creating and managing your account and event, hosting the content, generating the QR and allowing downloads. Based on the performance of the contract you have with us.
- Processing payment through Pagadito and confirming the event's activation. Based on the performance of the contract.
- Reviewing your Partner access request and writing to you with the code. Based on the pre-contractual steps you request when filling it out.
- Handling your reply to one of our emails: keeping it, sorting it automatically so we can answer and, where applicable, sending you a discount code. Based on our legitimate interest in responding to what you write to us.
- Sending you service emails: access links, confirmations, storage reminders and upcoming deletion notices. Based on the performance of the contract and our legitimate interest in keeping you informed about your event.
- Sending each guest their personal album with the photos and videos they captured. Based on the legitimate interest in delivering the keepsake they left their email for when they joined.
- Inviting the guest, within the album email, to create their own event on Brinddi and, if they consented with the checkbox, sending them news and promotions. The initial invitation, which comes from their use of the Service, is based on legitimate interest. Recurring marketing communications are based on their consent. The guest can object or unsubscribe at any time, and every email includes a way to unsubscribe.
- Providing security and preventing abuse: protecting accounts, detecting fraud and misuse and keeping technical logs. Based on our legitimate interest in running a secure service.
- Improving the Service with aggregate analytics. Based on legitimate interest, using the minimum data necessary.
- Meeting legal obligations, such as accounting, tax or requests from a competent authority. Based on compliance with a legal obligation.
5.Cookies and similar technologies
We use cookies and similar technologies, such as the browser's local storage, to the extent needed for the Service to work. There are three kinds:
- Essential ones keep you signed in, remember the active event and ensure security. The Service can't operate without them, so they don't require consent.
- Preference ones remember choices such as the theme or language.
- Analytics ones help us understand, in aggregate, how the Service is used, so we can improve it.
You can manage or block cookies in your browser settings. If you block the essential ones, the Service may not work properly.
6.Providers that process your data
To operate we use providers, or subprocessors, that process data on Brinddi's behalf and under its instructions, with confidentiality and security commitments. These are the six main ones:
- Vercel hosts the website and the app.
- Cloudflare R2 stores the events' photos and videos.
- Supabase is the PostgreSQL database where we store account data, event data and guest contact data.
- Resend sends the service emails: access links, confirmations, payment receipts, each guest's personal album and, with consent, news.
- Pagadito processes card payments. Card details are handled by Pagadito, not Brinddi.
- Forward Email receives the emails you send to hola@brinddi.com and forwards them to us.
We aim for these providers to offer adequate data protection guarantees. If we make relevant changes, we'll update this Policy.
7.International data transfers
Some of our providers store or process information on servers located outside the territory where you live, so your data may be subject to an international transfer. When that happens, we aim for the transfer to have adequate safeguards, such as contractual clauses and security commitments from providers, so your information keeps a level of protection equivalent to this Policy.
8.Who we share data with
We share data only in these cases:
- With the providers in section 6, to the extent needed to provide the Service.
- With the event host, to whom the content uploaded by their guests belongs, so they can view and download it.
- With the planner, when the event is bought through a planner who resells it under their own brand, as white-label. In that case the planner is the host or joint controller and also applies their own terms.
- With competent authorities, when there's a legal obligation or a valid request.
- In a corporate transaction, such as a reorganization. This Policy's protections remain in place.
9.Storage and deletion
We keep the event's content only for your plan's storage period, which ranges from 7 days on the Free plan to 365 days on Premium. The exact number is in Pricing and in your event's details.
Day zero of the storage period is the event date you set. The date you created the event and the date you paid don't count, so the storage period runs after the event and booking early doesn't use up any days before the event. These are the steps:
- You create the event as a draft, with its type, name, date, moments, theme and plan.
- You pay by card through Pagadito. The payment confirms the event, a snapshot of the plan is saved with its limits and storage days, and the QR is generated.
- You open the event to put it live, manually or automatically at the configured date and time, and guests can start uploading content.
- Your plan's storage period runs from the event date.
- Before the storage period ends we send you two reminders, 7 days and 1 day before the end. Then there are 3 grace days. When they're over, the content is deleted automatically and permanently.
Once deleted, content can't be recovered. Download your memories before the storage period ends.
Account data is kept while your account is active and deleted when you ask or when it's no longer needed. Transaction data, which doesn't include your card details, is kept for the period required by applicable accounting and tax rules, even if the event's content has already been deleted.
If you ask to delete your account and you have valid credits in your wallet, before deleting it we'll tell you how the deletion will affect your balance, so you can decide with all the information. Rollover and unused credits are governed by the Terms and the Refund Policy.
10.Information security
We apply reasonable technical and organizational measures to protect your data. They include these six:
- HTTPS/TLS encryption in transit for all communication with the Service.
- Encryption at rest for photos and videos, which are stored on infrastructure from providers that apply encryption at rest and access controls.
- Signed access and secure links to content, so it isn't publicly exposed.
- Passwords stored only as an encrypted fingerprint, and one-time codes to sign in or recover access.
- Access controls that limit who can see data, based on role and need.
- Separation by event, so one event's content isn't mixed with another's.
10.1 Internal access to content
Brinddi staff don't routinely access your event's content. We only access it in limited cases: when you ask us for support and access is needed to help you, when it's strictly necessary to operate, maintain or repair the Service, or in response to a complaint or a valid legal request. In those cases access is logged and limited to what's essential for that specific purpose.
10.2 Security breach notification
No system is infallible, and ours isn't either. If there's a security breach that significantly affects your data or your event's content, we'll notify you by email or with a notice in the Service. We'll do so within the deadlines required by applicable law or, if it doesn't set any, without undue delay once we know. Where the law requires it, we'll notify the authority and the affected people within 72 hours, as in El Salvador and the Dominican Republic, or within the period set by local data protection rules, such as Costa Rica's two business days. In that notice we'll tell you what we know about the nature of the incident, the data affected, the measures taken and what you can do to protect yourself.
11.Your rights and how to exercise them
As the data subject, you can exercise these rights:
- Access, to know what data of yours we process.
- Rectification, to correct inaccurate or incomplete data.
- Erasure, to ask us to delete your data when appropriate. In Mexico it's called cancellation.
- Objection, to object to certain processing based on legitimate interest.
- Withdrawal of consent, to revoke at any time the consent you gave, for example to receive the album, without affecting the lawfulness of earlier processing.
- Portability, to receive the data you gave us in a commonly used format.
To exercise any of these rights, write to us at hola@brinddi.com. Before handling the request we may ask for information to verify your identity, to protect your own data. If you think we didn't handle your request properly, you have the right to go to the competent data protection or consumer authority in your jurisdiction, if there is one.
Competent authorities by country
Depending on your country of residence, you can contact the relevant authority:
- In Mexico, the consumer authority is PROFECO, the Federal Consumer Protection Office. Data is governed by the Federal Personal Data Protection Law (LFPDPPP).
- In the United States, the consumer authority is the FTC, the Federal Trade Commission. For data, the applicable state laws apply, such as California's CCPA/CPRA, along with the relevant state authority.
- In Honduras, the consumer authority is DIPROCONSUMIDOR, the Consumer Protection Directorate. To date there's no specific personal data protection authority.
- In Guatemala, the consumer authority is DIACO, the Consumer Attention and Assistance Directorate. A Personal Data Protection Law was approved in 2024 but isn't in force yet. In the meantime we apply this Policy as the standard.
- In El Salvador, the data authority is ACE, the State Cybersecurity Agency, and the consumer authority is the Defensoría del Consumidor.
- In Nicaragua, the data authority is the Personal Data Protection Directorate and the consumer authority is DIPRODEC.
- In Costa Rica, the data authority is PRODHAB, the Agency for the Protection of Inhabitants' Data, and the consumer authority is the National Consumer Commission, part of MEIC.
- In Panama, the data authority is ANTAI, the National Authority for Transparency and Access to Information, and the consumer authority is ACODECO.
- In the Dominican Republic, the consumer authority is Pro Consumidor, the National Institute for the Protection of Consumer Rights. Data is protected under Law No. 172-13, and there's no designated central data authority.
- In Belize, Guyana, Suriname, Sint Maarten and other territories where the Service is available, you can contact your country's consumer or data protection authority. Write to us and we'll point you in the right direction. In the meantime we apply this Policy's commitments as a minimum standard.
12.Guests and the host's responsibility
The host who creates the event decides who takes part and what's done with the collected content. They are the controller or joint controller of their guests' data.
As the host, it's up to you to:
- Let your guests know that the event uses Brinddi and that the content they upload will be available to you during the storage period.
- Have the necessary consent when you collect emails or other personal information from guests.
- Use the content lawfully and respect the image and privacy rights of the people who appear in it.
By taking part, each guest consents to uploading their content, and can choose whether or not to leave their email. Brinddi provides the technical means. The relationship between the host and their guests is also governed by the host's decisions.
13.Minors
The Service isn't intended for minors as account holders, and to create an account you must be an adult, at least 18 years old. At a quinceañera or a baptism it's common for minors to appear in photos and videos. In that case, the host is responsible for having the parents' or guardians' consent and for treating that content with respect. If you think a minor gave us personal data without proper authorization, write to us and we'll take care of it.
14.Automated decisions
Brinddi doesn't make automated decisions with legal or significant effects on people, or build profiles for those purposes. The automated processes that exist, such as sending reminders, deleting content when storage ends, or the automatic reply to someone who answers one of our emails, which may include a discount code, are technical operations provided for in this Policy and in the plan you bought. If you reply to one of our emails, a person on the team may also read it and answer you.
15.Changes to this Policy
We may update this Policy because of changes to the Service, our providers or applicable regulations. We'll always publish the current version with its "Last updated" date. If changes are significant, we'll try to notify you through a reasonable channel, such as an email or a notice in the Service. If you keep using the Service after the changes are published, you accept them.
16.Contact
To exercise your rights or ask privacy questions, write to us at hola@brinddi.com. That email is our point of contact for personal data protection and receives access, rectification, erasure and objection requests. There are more ways to reach us on the Contact page.