Privacy policy
Last updated: 8 August 2026
This translation is provided for convenience. Only the French version is legally binding.
Time to Flash is a service that collects photographs taken by the guests at an event and reveals them afterwards. This document explains what data is processed, why, for how long, and what your rights are.
1. Who processes your data
BLACK BY C, SASU with share capital of €300, 2 impasse des Ligures, 44840 Les Sorinières, France, RCS Nantes 898 409 446.
Contact: support@timetoflash.fr
BLACK BY C has not appointed a data protection officer, as such an appointment is not mandatory given its activity. Any question about personal data may be sent to the address above.
2. Two situations to distinguish
When you create an event (you are the “Host”), BLACK BY C processes your data on its own behalf: it is the controller.
When guests upload photographs to an event, it is the Host who decides on the collection, invites the guests and determines who can access the content. BLACK BY C then acts only as a processor, on the Host's instructions. Requests concerning this content should be sent first to the Host of the event concerned, with BLACK BY C assisting in responding to them.
One exception: answers to the satisfaction survey. When a Host or a Guest gives their opinion on the service itself, they are addressing BLACK BY C and not the Host of the event. BLACK BY C is then the controller, and the Host of the event never has access to these answers. Details are given in Article 3.3.
3. Data processed and purposes
3.1 Host
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address, surname or first name | creating and managing the account, sending access to the event | performance of the contract | 3 years from the last contact |
| Order and billing data | managing the order, accounting obligations | performance of the contract and legal obligation | 10 years (Article L.123-22 of the French Commercial Code) |
| Email address, content of exchanges | handling support requests | legitimate interest | 3 years from the last contact |
| Acceptance of the Terms and, where applicable, waiver of the right of withdrawal (timestamp, version of the Terms) | proof of contractual consent | performance of the contract and legitimate interest | 10 years (commercial limitation period) |
| Technical connection logs | security of the service, prevention of abuse | legitimate interest | 12 months |
Bank card data is never collected or stored by BLACK BY C. It is processed directly by Stripe.
3.2 Guests
| Data | Purpose | Retention |
|---|---|---|
| Photographs | building the event gallery | 6 months after the reveal date, then automatic deletion |
| First name or nickname entered | identifying contributions within the event | same |
| Email address (optional) | sending, once only, a personal access link allowing the Guest to find their own photographs and remaining shots from another device; sending the album link at the time of the reveal; sending, once only and without reminders, a satisfaction questionnaire (Article 3.3) | same |
| Telephone number (optional, no longer collected) | forwarding of the album link by the Host | same |
| Timestamps, technical connection data | operation and security of the service | 12 months |
No account is required to upload content as a guest.
Entering an email address is optional: guests can take part without providing one. It is used to send them the album link when the photographs are revealed and, where applicable, the satisfaction questionnaire described in Article 3.3. It is used for no commercial marketing purpose, is never passed on to a third party, and is deleted with the event.
The collection of telephone numbers has been discontinued. Numbers collected before this change remain subject to the same rules and are deleted with the event to which they relate. This collection only concerned Guests: a Host may, if they wish, provide their own number in the satisfaction questionnaire, under the conditions set out in Article 3.3.
Photographs may reveal sensitive information: religious practice during a ceremony, apparent state of health, presumed membership of a group. BLACK BY C never uses this information and carries out no analysis of image content, no facial recognition and no profiling.
3.3 Satisfaction survey
BLACK BY C asks Hosts and Guests about their experience of the service, in order to fix what does not work and to guide its development. For this processing, BLACK BY C acts as controller: the answers concern it, and they are never disclosed to the Host of the event, nor to any other guest.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Answers to the questionnaire (rating, difficulties encountered, free comments) | improving the service and fixing malfunctions | legitimate interest | 3 years from the answer |
| Type of device and browser used | reproducing and fixing the technical difficulties reported | legitimate interest | 3 years from the answer |
| Host's telephone number (optional) | a telephone conversation of a few minutes, only if expressly agreed to | consent | deleted after the conversation, and at the latest 6 months after the answer |
Taking part in the survey is entirely optional and is not a condition of access to any feature: refusing to answer, or not answering at all, has no effect on the service provided.
A questionnaire is sent by email once only, and no reminder follows. Each message contains a link to stop receiving requests of this kind, with immediate effect; this refusal does not prevent the album link from being sent, which remains due to any Guest who left their address. These messages contain no commercial offer.
Answers are kept after the deletion of the event to which they relate, but detached from it: they can then no longer identify the event or its host, and are used only to measure changes in the quality of the service over time.
3.4 Trying the service and news from Time to Flash
The QR code and the “Try” button on the home page create a personal trial event, deleted with its photographs the following day. To understand what brings visitors to try the service, BLACK BY C keeps, without any identifying data, where the trial came from (originating site or campaign, landing page) and the steps reached (opening, first name given, photo taken, album viewed). This origin is stored in the visitor's browser, without any advertising cookie, and is only sent when a trial is started. Legal basis: BLACK BY C's legitimate interest in understanding how its website is used.
The email address left during a trial is used for the trial itself. It is only used to send news from Time to Flash (ideas, new features, offers) if the person has ticked the box provided for this purpose, which is never ticked by default. Legal basis: consent. Every message includes an unsubscribe link, effective immediately. If there is no further activity on their part for three years, no more messages are sent to them.
4. Recipients and processors
Data is not sold, rented or disclosed to third parties for advertising or commercial purposes.
It is accessible to the following technical providers, acting on the instructions of BLACK BY C:
| Provider | Role | Location |
|---|---|---|
| Vercel, Inc. | hosting of the website and the application | Europe |
| Supabase, Inc. | database and authentication | Western Europe |
| Cloudflare, Inc. | file storage (R2) | Western Europe |
| Stripe Payments Europe, Ltd. | payment processing | European Union |
| Brevo (Sendinblue SAS) | sending transactional emails | European Union (France) |
| Familink | printing and dispatch of ordered photo prints (name, postal address, ordered photographs) | France |
| Meta Platforms Ireland Ltd. | advertising audience measurement, only after consent | Ireland, United States |
| Google Ireland Ltd. | audience measurement and advertising, only after consent | Ireland, United States |
Meta and Google are only involved on the public pages of the website, and never within an event: photographs uploaded by guests are never passed on to them. See Article 10 for details of these trackers and how to refuse them.
Content uploaded to an event is accessible to the Host of that event and, after the reveal, to the other guests of that same event.
5. Transfers outside the European Union
Data and content are stored in Western Europe.
As some providers are companies incorporated under US law, access from the United States for technical administration purposes cannot be ruled out. These transfers are governed by the standard contractual clauses adopted by the European Commission and, where applicable, by the providers' certification under the Data Privacy Framework.
6. Retention periods
Content uploaded to an event is automatically deleted six months after the reveal date chosen by the Host. This deletion is final and irreversible: it is the Host's responsibility to download any content they wish to keep before this deadline.
The other periods are set out in the tables in Article 3.
7. Your rights
In accordance with Regulation (EU) 2016/679 and French Law No. 78-17 of 6 January 1978, you have the following rights:
- access to your data;
- rectification of inaccurate data;
- erasure of your data;
- restriction of processing;
- objection to processing based on legitimate interest;
- portability of the data you have provided;
- setting instructions on what happens to your data after your death.
These rights can be exercised by writing to support@timetoflash.fr. You will receive a reply within one month, which may be extended by two months for complex requests.
If you appear in a photograph uploaded by someone else and would like it removed, write to support@timetoflash.fr stating the event identifier. Your request will be forwarded to the Host and the content in question may be removed without delay.
Finally, you have the right to lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
8. Image rights
Image rights, based on Article 9 of the French Civil Code, are distinct from the right to data protection. Everyone has the right to object to their image being captured and shared.
It is the Host's responsibility to obtain the necessary permissions from the people photographed and, for minors, from their legal representatives.
9. Security
BLACK BY C implements appropriate technical and organisational measures: encryption of communications (HTTPS/TLS), isolation of data between events, access control, logging, backups, automated deletion at the end of the retention period.
As no system is infallible, in the event of a personal data breach likely to result in a high risk to your rights and freedoms, you would be informed without undue delay, in accordance with Article 34 of the GDPR.
10. Cookies and trackers
Strictly necessary cookies. Session, authentication, security. In accordance with Article 82 of the French Data Protection Act, they do not require your prior consent and cannot be disabled without making the service unusable.
Audience measurement and advertising trackers. The website uses the Meta pixel (Meta Platforms Ireland Limited) and the Google Analytics and Google Ads services (Google Ireland Limited), in order to measure traffic to the website, assess the effectiveness of our advertising campaigns and improve their targeting.
These trackers are only placed after your express consent, obtained through the banner displayed on your first visit. Until you have accepted, no script from these companies is loaded. Refusing is as easy as accepting and does not affect how the service works in any way.
Withdrawing your consent. Your choice is kept for six months at most. You can change it at any time via the “Cookies” link in the footer, which reopens the banner.
Legal basis: your consent (Article 6(1)(a) GDPR). Transfers outside the European Union: as these providers may transfer data to the United States, these transfers are governed by the Data Privacy Framework to which Meta and Google have signed up, supplemented by the European Commission's standard contractual clauses.
You can also object to this processing directly with the companies concerned: Meta ad settings and Google ad settings.
11. Minors
The service is not intended to be used independently by people under the age of fifteen.
As minors may appear in photographs taken at a family event, it is the Host's responsibility to make sure that the holders of parental authority have given their consent.
12. Changes
This policy may be amended to take account of legal or technical developments. The applicable version is the one published on the website on the date you use the service.