Privacy Policy

Last updated: 14-10-2026

1. Who we are

Lense is a service of Rewaive B.V. We are the controller for the personal data described in this policy.

  • Address: Lieshoutsedijk 21 A, 5491 SN Sint-Oedenrode, the Netherlands
  • Chamber of Commerce (KvK): 94766878
  • Email: [email protected]

We have not appointed a data protection officer, because we are not required to.

2. Whose data we process

  • Organizers: people who create an event.
  • Guests: people who join an event through the app, the App Clip, the instant app or the web camera.
  • People in photos: people who appear in photos or videos taken at an event, even if they do not use Lense.
  • Website visitors: people who visit lense.app.

3. What data we collect

  • Account data: your name and email address; your Apple or Google account ID if you sign in with Apple or Google, and whether you use Apple's private email relay; login codes; your language and time zone.
  • Guest data: the name you enter when you join an event; your email address, if you choose to give it (for example to receive the album link); the IP address you used to join.
  • Photos, videos and related data: the photos and videos you take or upload, captions, likes, and when you uploaded them. We store the original files. Photos and videos you upload from your library can contain metadata, such as the time and place they were taken, if your phone recorded it. Other participants who download a file may be able to see this metadata. We use the time a photo was taken to sort photos.
  • Messages that organizers send to their guests through Lense.
  • Purchase data: what you bought, for which event, the amount and currency, your country, and the order and customer IDs from the reseller (Apple, Google, Paddle or Lemon Squeezy). For purchases on our website, Paddle also shares your name, email address and limited payment details, such as the type of payment method, and we store the IP address used for the purchase. We never receive your full card number.
  • Device and usage data: a random device ID created by the app; the app version, your operating system, and your language and time zone settings; your push notification token; crash and error reports; and how you use the app and the website (see section 7).
  • Communication: emails you send us, feedback, and reviews you submit on our website (name, location, rating, text and email address).

4. Why we use your data, and our legal basis

  • Providing the Service (accounts, events, sharing photos with the organizer and participants, downloads, and notifications about your event): contract (art. 6(1)(b) GDPR).
  • Service messages (login codes, purchase confirmations, notices before photos are deleted): contract (art. 6(1)(b) GDPR).
  • Handling purchases and refunds, and keeping financial records: contract and legal obligation (art. 6(1)(b) and (c) GDPR).
  • Content moderation (automated checks of photos and organizer messages, and handling reports): our legitimate interest in a safe service (art. 6(1)(f) GDPR) and our legal obligations under the Digital Services Act (art. 6(1)(c) GDPR).
  • Security, preventing abuse and fixing errors (logs, error reports, IP addresses): legitimate interest (art. 6(1)(f) GDPR).
  • Usage statistics without cookies, to improve Lense: legitimate interest (art. 6(1)(f) GDPR).
  • Analytics with cookies and session recordings on our website: consent (art. 6(1)(a) GDPR).
  • Emails to organizers with tips, reminders and offers about Lense, and requests for feedback or a review: legitimate interest (art. 6(1)(f) GDPR). You can unsubscribe at any time.
  • Customer support: contract or legitimate interest (art. 6(1)(b) or (f) GDPR).

5. Who can see what

  • The organizer can see the names of the guests, how many photos and videos each guest added, and all photos and videos of the event, including those that have not been revealed yet. The organizer can remove photos and guests, and download the full album. File names in that download contain the name of the person who took each photo.
  • Other guests can see, depending on the reveal settings the organizer chose, the names of the participants and the photos and videos of the event, with the name of the person who took them, captions and likes.
  • People at the event can see photos if the organizer shows them live on a screen.
  • Anyone with an album link: the organizer can create a link to the album. Anyone who has that link can see the photos and the names of the organizer and participants.
  • Lense does not make events public or searchable.
  • Reviews you submit on our website are published with your name and location. Your email address is not published.

6. Content moderation

  • We automatically check uploaded photos for nudity and explicit content with software that runs on our own servers. Photos are not sent to another company for this. If the check flags a photo, it is removed. If you think this was a mistake, contact [email protected] and a person will review it.
  • Messages from organizers to guests are checked automatically for abusive content by an AI service of Anthropic before they are sent.
  • These checks do not lead to decisions with legal or similarly significant effects for you.

7. Analytics and cookies

Website

  • We use cookies that the website needs to work, such as session, security and language cookies. These do not need your consent.
  • In the EU, the EEA and the UK, we ask for your consent before we use analytics cookies. If you accept, we use PostHog with cookies, and Microsoft Clarity for heatmaps and session recordings, in which what you type in input fields is masked. If you decline, we only collect anonymous usage statistics without cookies (PostHog in cookieless mode), which do not identify you.
  • Outside these regions, we use PostHog and Clarity without asking first.
  • When you buy something on our website, we always record the purchase in our usage statistics.
  • You can change your choice by deleting the cookies for lense.app in your browser settings.

App

  • The app collects usage statistics with PostHog, hosted in the EU, linked to a pseudonymous user ID. We do not record your screen, and we do not send your name or email address to PostHog. We do this based on our legitimate interest in improving Lense. You can object at any time by emailing [email protected].
  • The app sends crash and error reports to Sentry. These contain the app version, your device type, your user ID and your name.

8. Who we share data with

We do not sell your personal data.

Service providers. These companies process data on our behalf, and only for the purposes in this policy:

  • Our hosting provider: hosting of our servers and database, in Germany
  • Cloudflare: storage of photos and videos in the EU, delivery of photos and videos, upload processing and security
  • PostHog: usage statistics (EU)
  • Microsoft (Clarity): website analytics
  • Sentry: error monitoring
  • Resend and Amazon Web Services (SES): sending emails
  • Anthropic: automated checks of organizer messages, and help with handling support requests
  • Slack: internal notifications about errors
  • LogSnag: internal notifications about new events and purchases
  • ip-api.com: determining your country and time zone from your IP address, if we cannot do this otherwise
  • Apple, Google and your browser's push service: delivering push notifications
  • Google: fonts and spam protection (reCAPTCHA) on our website

Independent controllers. These companies process data under their own privacy policies:

  • Apple (App Store), Google (Google Play), Paddle and Lemon Squeezy, when you view prices or buy something
  • Apple and Google, when you sign in with them

Others: other users, as described in section 5, and authorities when the law requires it.

9. Transfers outside the EEA

Your photos and videos are stored in the EU. To deliver them quickly, Cloudflare may temporarily keep copies in its data centers closer to the viewer, including outside the EU.

Some of these companies are based in the United States or process data outside the European Economic Area. We only allow this with appropriate safeguards, such as an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified companies) or the European Commission's Standard Contractual Clauses. You can ask us for more information.

10. How long we keep your data

  • Account data: until you delete your account. We then delete your account data within 30 days.
  • Photos and videos: at least 12 months after the event date, or longer with a storage extension. After that, we may delete them, after telling the organizer at least 30 days in advance. If you delete a photo or video, it is removed from the event right away, and the file is permanently deleted within 14 days.
  • After you delete your account: photos and videos you added to other people's events stay in those events, without your name, until the event is deleted. You can delete them yourself before you delete your account, or ask us to remove them later. If you organized events, those events are deleted with your account, including all photos and videos in them.
  • Guest data, including the IP address you used to join: for as long as the event exists.
  • Purchase data: 7 years, because Dutch tax law requires it.
  • Usage statistics: as long as they help us improve Lense. Microsoft Clarity deletes session recordings after 30 days and other Clarity data after 13 months.
  • Error reports: at most 90 days (Sentry). Server logs: 14 days.
  • Support emails: as long as needed to handle your question and any follow-up.
  • Backups: deleted data stays in our backups until they are overwritten in our regular backup cycle.

11. Your rights

You have the right to:

  • Access: ask for a copy of your personal data.
  • Rectification: have incorrect data corrected.
  • Erasure: have your data deleted, unless we have to keep it by law.
  • Restriction: have the processing of your data limited.
  • Portability: receive your data in a structured, machine-readable format.
  • Object: object to processing based on our legitimate interest, including usage statistics and marketing emails.
  • Withdraw consent: at any time, without affecting earlier processing.

To use these rights, email [email protected]. We respond within one month. We may need to verify your identity first.

You can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or with the authority in your own country.

12. People in photos, and children

  • If you appear in a photo or video and want it removed, ask the organizer, or email [email protected] with a description of the photo and the event. We will assess your request and remove the photo where appropriate.
  • Lense is meant for people aged 16 and older. Younger guests may take part under the supervision of a parent or guardian. Parents and guardians can ask us to remove photos of their child.

13. Emails and notifications

  • We send emails and push notifications about your events, such as login codes, purchase confirmations, new photos, the reveal of an album, and notices before photos are deleted. These are part of the Service.
  • If you organize an event, we may also email you tips, reminders and offers about Lense. Every such email has an unsubscribe link.
  • You can turn off push notifications in your device settings.

14. Security

We protect your data with encryption in transit, access controls and regular backups. If a data breach is likely to put your rights at risk, we report it to the Autoriteit Persoonsgegevens within 72 hours. If the risk to you is high, we also inform you.

15. Changes to this policy

If we make important changes, we tell you at least 30 days in advance by email or in the app. Corrections and changes that the law requires can take effect sooner. The date at the top shows the latest version.

16. Contact

Rewaive B.V.
Lieshoutsedijk 21 A, 5491 SN Sint-Oedenrode, the Netherlands
KvK: 94766878
Email: [email protected]

📸 Try the demo camera