Privacy Policy

Article 1: Data Controller

The controller for the processing activities described in Articles 2 to 5 is:

Huskox, John Houzi, a business registered under number 337927834, with its registered office at Abarbanel 49, Tel Aviv - Yafo. Huskox is a studjoow service (studjoow.com).

Contact for any question relating to personal data: hello@huskox.com

No data protection officer (DPO) has been appointed, as this appointment is not mandatory for Huskox's activity. The contact address above is the single point of entry for any question relating to personal data.

Article 2: Data We Collect as Data Controller

We deliberately limit collection to what is strictly necessary. Below is the exhaustive list of processing activities for which Huskox acts as data controller.

2.1 Contact and Quote Requests (Leads)

When you fill in the contact form or one of the short forms on the site's landing pages, we collect, depending on the form: your name, your email address, the type of event, its date, its location, the number of guests, the desired package, and your message. Only your name and email address are required. No phone number is requested.

Each form submission triggers three operations: recording your request in our database (Supabase), sending a notification email to the publisher, and sending an automatic acknowledgment to the email address provided, via our provider Resend (see Article 6).

This data is used solely to respond to your request and to prepare a possible commercial proposal. The fields marked as required on the form are necessary to process your request: without them, we will not be able to respond to you.

Legal basis: performance of pre-contractual measures taken at your request (article 6(1)(b) GDPR).

2.2 Client Area Account

Creating an account on the client area requires only one piece of data: your email address. The events you have entrusted to us, as well as the progress of your timeline (see 2.3), are then linked to your account.

Sign-in takes place via a magic link: a single-use sign-in link is sent to you by email. No password is created, requested, or stored. This is a deliberate data minimization measure: the less information we hold, the less you are exposed in the event of an incident. In particular, it removes any risk of password leakage or reuse.

Legal basis: performance of the contract binding us (article 6(1)(b) GDPR).

2.3 Checklist Check-Marks and Timelines

Two situations coexist and should not be confused:

• on the public site (wedding checklist, event page timelines), your progress (the boxes you check) is saved only in your browser's local storage: this information is never transmitted to our servers, and Huskox has no access to it (see the "Cookies and Local Storage" page). This therefore does not constitute a collection of personal data by Huskox;
• in the client area, by contrast, the boxes you check on your event's timeline are saved in our database and linked to your event, so that you can find your progress again from one device to another. Legal basis: performance of the contract (article 6(1)(b) GDPR).

2.4 Transactional Emails

We send you emails strictly related to the operation of the Service: sign-in magic link, confirmations, and notifications relating to your event. These are sent via our provider Resend (see Article 6). These are not marketing emails.

Legal basis: performance of the contract, or pre-contractual measures for exchanges prior to subscription (article 6(1)(b) GDPR).

2.5 Online Payment

Payment for packages ordered on the Site is operated by Stripe, our payment provider. Your banking details are entered on Stripe's payment page and processed directly by Stripe: Huskox never has access to your card number. Huskox retains only the information necessary for billing and proof of payment: the name and email address entered at payment, the package purchased, the amount, the currency, the date, and the transaction reference. Stripe processes payment data in accordance with its own privacy policy (stripe.com/privacy).

Legal basis: performance of the contract (article 6(1)(b) GDPR) and, for the retention of accounting records, legal obligation (article 6(1)(c) GDPR).

2.6 Copying Your Album to Google Drive

From your album space, you can ask us to copy your photos and videos to your own Google Drive. The copy only happens at your request, after you have authorized it on Google's consent screen.

We request the narrowest access Google offers ("drive.file"): it only lets us read the free space of your Drive, to check before starting that the album will fit, then create a folder in it and upload your album's files there. We do not see, read, modify or delete any other file in your Drive.

The authorization issued by Google is stored encrypted for the duration of the copy, then deleted and revoked with Google as soon as the copy stops, whether it is completed, stopped by you or failed. You can also withdraw this access at any time from your Google account (myaccount.google.com/permissions). Once copied, the files are in your Drive and fall under your Google account.

Data obtained through Google APIs is used only to perform this copy: it is never sold, shared with third parties, used for advertising or used to train artificial intelligence models. Huskox's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Legal basis: performance of the contract between us, at your request (Article 6.1.b GDPR).

Article 3: Event Media, Huskox Acts as Processor

This is the most important point of this policy.

The Service allows an event's guests (wedding, celebration, or other) to upload photos and videos to a shared album. For this media, and the data that accompanies it:

• the data controller is the event organizer, that is, our client, who decides the purpose of the album (gathering memories of their event) and invites their guests to contribute to it;
• Huskox is a processor within the meaning of article 28 GDPR: we host and process this media solely on behalf of the organizer and on their instructions, without using it for our own purposes.

In practical terms, this means that:

• Huskox never uses guests' photos and videos for commercial or advertising purposes, or to train any system whatsoever;
• if you are a guest at an event and wish to exercise your rights over media concerning you (for example, requesting the deletion of a photo in which you appear), your first point of contact is the event organizer; you may also write to us at the contact address given in Article 1: we will forward your request to the organizer and assist them in handling it, as the GDPR requires us to;
• Huskox implements the technical and organizational measures necessary to protect this media and notifies the organizer in the event of a data breach.

Media is hosted on servers located in Europe, on infrastructure separate from the site. It stays online for 30 days from the end of collection, or until the end of the Vault if the client has purchased one (one more year per purchase), then it is deleted (see article 4).

Article 4: Retention Periods

At the end of these periods, the data is deleted.

The 30-day period runs from the end of collection; the client is notified before closure. Where an extension is agreed between the organiser and Huskox (see the general conditions of sale), that period runs from the end of the extended period. Throughout that period, the client may download all of their content, at original quality and without a watermark. The Vault, purchased by the client, extends that period by one year per purchase.

Article 5: No Profiling or Targeted Advertising

Huskox carries out no profiling, no decision based solely on automated processing that produces legal effects, no targeted advertising, and no resale of data. Your data is never sold or rented to third parties for commercial purposes.

As of today, the site uses no advertising cookies, no third-party audience measurement tools, and no tracker subject to consent. Only technical session cookies (client area and administration) and browser local storage (public checklist and timelines) are used. Details are set out on the site's "Cookies and Local Storage" page.

Article 6: Processors and Transfers Outside the European Union

To provide the Service, Huskox uses the following providers, which access data only to the extent necessary for their task:

Event photos and videos, meanwhile, are hosted on servers located in Europe, on infrastructure separate from that of the site (see Article 3).

Apart from these providers, no data is transmitted to third parties, except where legally required.

Article 7: Security

Huskox implements appropriate technical and organizational measures to protect data: passwordless sign-in via a single-use magic link, collection reduced to what is strictly necessary, and access limited to only those who need it. In the event of a data breach presenting a risk to your rights and freedoms, we will inform the competent supervisory authority and, where applicable, the individuals concerned or the relevant data controller, under the conditions set out by the GDPR.

Article 8: Your Rights

In accordance with the GDPR, you have the following rights over data concerning you:

• right of access: to obtain a copy of the data we hold about you;
• right to rectification: to have inaccurate or incomplete data corrected;
• right to erasure: to request deletion of your data, within the limits provided by law;
• right to restriction of processing;
• right to object, on grounds relating to your particular situation;
• right to portability of the data you have provided to us.

To exercise these rights, write to the contact address given in Article 1. We will respond within one month, extendable by two months for complex requests, in which case you will be informed. If there is reasonable doubt as to your identity, proof of identity may be requested.

Important reminder: for an event's photos and videos, the data controller is the event organizer (see Article 3). You may nevertheless write to us: we will forward your request to the organizer and help them respond to it.

Article 9: Complaint to a supervisory authority

If, after contacting us, you believe your rights are not being respected, you may file a complaint with the data protection authority of your country of residence.

Article 10: Changes to This Policy

This policy may be updated, in particular as the Service evolves. The date of the last update appears at the top of this document. In the event of a material change, users with an account will be notified by email.