Privacy Policy

Jolti provides a platform through which organizers (also referred to as "hosts"; user accounts that register and book a plan) create their own events and let guests upload photos via a QR code/link, from which AI-generated videos are created automatically and displayed live on the event screen. From a data-protection perspective there are two separate roles:

• For an organizer's account, billing, and usage data (sign-up, plan purchase, login, support), Jolti (snackbits | Mischa Brammer) itself is the controller within the meaning of Art. 4 (7) GDPR.
• For photos guests upload during a specific event, and the videos generated from them, the respective organizer(the person or organization who created the event) is the controller. Jolti processes this content on the organizer's behalf as a processor pursuant to Art. 28 GDPR. Details of this processing arrangement — in particular the role of external AI providers — are set out in the Data Processing Agreement (DPA).

Guests uploading photos to a specific event also see a short first-visit notice directly on the upload page, naming that event's organizer.

• Account data (organizers): name, email address, user identifier, registration time, language preference.
• Event and guest content data: photos uploaded by guests, AI videos generated from them, an anonymous device-level identifier (no user account), processing time and status.
• Transaction and payment data: booked plan, amounts, timing, payment status; card payment itself is handled entirely by our payment processor Stripe — we never receive full card details.
• Technical data: IP address (possibly truncated), device type, browser, timestamps, log data necessary for the security and stability of the application.
• Communication data: content of support requests you voluntarily share with us.

• Art. 6 (1)(b) GDPR (contract): to provide the platform, the user account, process plan purchases, and run the video generations you trigger.
• Art. 6 (1)(a) GDPR (consent): where separately obtained (e.g. the withdrawal-right consent in the checkout flow, see the Right of Withdrawal page).
• Art. 6 (1)(c) GDPR (legal obligation): to fulfil statutory obligations (e.g. tax and commercial retention duties).
• Art. 6 (1)(f) GDPR (legitimate interest): IT security, abuse prevention, platform stability, asserting legal claims.

We use, in particular, the following categories of service providers:

• Stripe (payment processing):payment data and transaction handling for plan purchases. Stripe's own terms and privacy notices apply.
• AI providers chosen by the organizer (photo/video processing): for each event, the organizer configures in the event settings which AI provider turns uploaded photos into videos (e.g. Runway, kie.ai — the providers actually enabled are listed in the DPA record), and supplies their own API key for that provider (bring-your-own-key — the platform itself holds no shared access to these providers). The AI provider processes the uploaded photos directly on the organizer's behalf to generate videos; processing in third countries (in particular the USA) is possible. Because the organizer engages the AI provider directly using their own access, that provider is the organizer's own independent processor and not a sub-processor of Jolti; Jolti merely transmits the content using the key the organizer configured, without itself becoming a party to that processing. See the DPA record for details.
• Own or commissioned server infrastructure: database, cache, and object-storage services used to operate the platform (including storage of uploaded photos/videos); technical log data may be generated.

(Draft — legal review pending) Jolti processes uploads and prompts solely to technically forward them to the external AI provider chosen by the host, who performs the actual image/video generation under their own responsibility.

Processing agreements pursuant to Art. 28 GDPR are entered into with processors where required. Data is disclosed to authorities only where legally required or ordered by a court.

Some AI providers we use process data in the USA. For transfers to companies certified under the EU-US Data Privacy Framework (DPF), an EU Commission adequacy decision applies, whose validity was recently confirmed by the EU courts. Because this framework is not considered politically permanent, we additionally agree, where possible, EU Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR as a supplementary safeguard with the relevant providers, so that the transfer can continue to rely on an adequate safeguard even if the DPF were to lapse.

Account data: after you delete your account, your personal data is automatically anonymized or deleted; any remaining technical records (e.g. completed payment transactions) are removed permanently after 30 days at the latest, unless a statutory retention obligation applies. Accounts with no activity and no running event receive a notice after 12 months of inactivity ahead of any further processing.

Event content (guest photos/videos):remains stored while the event is active or ended, or until the organizer deletes the event or individual content. If the organizer generates an archive (a ZIP download of all of an event's media), the download link is time-limited (7 days) for security reasons and must be regenerated afterward.

Log data: is regularly deleted or anonymized on a rolling basis, unless longer retention is required for evidentiary purposes.

When a photo is uploaded, we store the full IP address of the uploading device in addition to the upload metadata. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in preventing abuse, preserving evidence in the event of legal infringements, and fraud prevention). The IP address is deleted automatically and irreversibly 30 days after the upload, unless in an individual case it is needed longer to pursue a specific incident that has already been reported. You have the right to object to this processing under Art. 21 GDPR.

Guests uploading a photo to an event actively confirm before the upload (via a mandatory checkbox that is never pre-ticked) that they are at least 18 years old and have obtained the express consent of every person depicted — for depicted minors, the consent of their legal guardians and, for minors aged 14 or over, additionally that of the minor themselves.

This confirmation is documented and stored per upload together with the time and the exact text version confirmed, so that the consent can be demonstrated pursuant to Art. 7 (1) GDPR. The uploading guest is responsible for inaccurate statements and may in particular be liable under § 22, § 33 KunstUrhG (German Art Copyright Act) and Art. 82 GDPR.

Depicted persons who do not agree with the processing or display of a piece of content can report it via the reporting procedure described in section 9; consent once given can be withdrawn at any time with effect for the future (Art. 7 (3) GDPR).

Reports of unlawful content can be submitted via the report form (the "Inhalte melden / Löschung anfragen" — report content / request deletion — link on the respective event page), stating your name and email address (Art. 16 DSA). Upon receipt you will immediately receive a confirmation of receipt by email. Reported content is made invisible to the public without delay and reviewed within 72 hours. If the review shows that the report was manifestly unfounded, the event's organizer can restore the content. Otherwise the content is permanently deleted. You will be informed of every decision and of available remedies (Art. 16 (5), (6) DSA).

Subject to statutory requirements, you have the right to:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object (Art. 21 GDPR),
• withdraw any consent given, with effect for the future (Art. 7 (3) GDPR).

Two-track deletion path for guest content:since the respective organizer is the controller for event photos/videos, please direct deletion requests about that content primarily to that event's organizer (contact details are shown on the event's upload page). If the organizer is unreachable or does not respond adequately, a reporting channel directly to Jolti is also available (the reporting function on the event page, or email to kontakt@snackbits.dev) as a fallback.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

We use only technically necessary cookies and local storage (e.g. session, security, language preference, acknowledgement of the first-visit notice on event pages), Art. 6 (1)(b) or (f) GDPR. We do not use non-essential cookies (e.g. for marketing or broad analytics purposes).