How Afterglow handles your information.

Afterglow is operated by OptimusYou LLC, an Arizona limited liability company doing business as Afterglow, of 1820 E. Ray Road #1000, Chandler, AZ 85225 (“Afterglow,” “we,” “us”). This policy applies to three kinds of people the Service handles data for:

• Couples — who buy a gallery, upload photographs and films, and manage the guest list.
• Guests — invited people who open a gallery, search for themselves, upload their own photos, or order prints.
• Studios — photography businesses that upload a wedding and hand the finished gallery to the couple.

We collect the following categories of information:

Account and guest-list information

When a couple sets up a gallery, we store their account details and the guest list they upload or enter: each guest's name, the household or party they are grouped under, and — when supplied — phone number, email address, postal address, and whether they were invited to restricted events such as a rehearsal dinner. A guest does not need to have given Afterglow anything directly to appear in this list; the couple provides it. Each guest or household receives a personal access code to open the gallery.

Photographs and films

Every photograph and film uploaded to a gallery — by the couple, a studio, or a guest — is stored in full resolution, along with technical metadata such as capture date, dimensions, and file size.

Face search (biometric information)

This is a biometric data practice and we want it to be plainly visible, not buried in a list. To let a guest find every photo they appear in, Afterglow uses Amazon Rekognition, an automated face-recognition service, to detect and index faces in every photo and video uploaded to a gallery. This produces a mathematical representation of each detected face (a “face vector”), stored in a Rekognition collection dedicated to that one wedding, for as long as the gallery exists.

When a guest wants to find themselves, they submit a selfie. That selfie is used in memory, for the length of that one search request only, to compare against the faces already indexed from the gallery — it is not saved to storage, written to our database, or written to logs. What we keep afterwards is the result: a list of which photos matched, and a similarity score, tied to the searching guest.

Face geometry is treated as a sensitive, regulated category of personal data in a number of jurisdictions, so here is exactly what happens, stated plainly. When a gallery is uploaded, a face vector is created for every person detected in every photograph — not only for guests who later use the search. That includes people who never open the gallery and never use Afterglow at all. The couple or studio uploading the wedding is the party that decides which photographs go in, and is responsible for having the right to upload them; we provide the notice you are reading now. A vector is a mathematical descriptor and cannot be turned back into a photograph, it is never used across weddings, and the collection is destroyed when the gallery is deleted. Any person may have their face vector deleted at any time by writing to hello@getafterglow.app — they do not need an account, and it does not remove them from the photographs, only from the search index. Illinois, Texas and Washington regulate this processing specifically and impose requirements beyond this notice; we are seeking advice on those before offering face search to guests in those states.

Payment and shipping

Print orders are processed by Stripe. We do not see or store payment card numbers — Stripe handles that directly. We do receive and store the order details Stripe returns to us: the buyer's email address and the shipping address for the order.

Email activity

We send two kinds of email, from separate sending addresses: the invitation and account messages a guest is expecting (gallery links, password resets, order confirmations), and separate follow-up messages. Follow-up email carries a one-click unsubscribe link; invitation and account email does not, because it is service correspondence rather than marketing.

Automatically generated content descriptions

To make a gallery searchable by what is actually in a photo (e.g. “cake,” “first dance”), each photograph is sent to a hosted AI model, reached through Vercel's AI Gateway (currently an Anthropic Claude model), which returns a short written description and a list of search tags. The photograph is sent to that model for this one-time captioning step; the description and tags are stored, searchable, alongside the photo.

Access and device information

We keep a record of when a gallery link was first and most recently opened, and use a session cookie to keep a guest or host signed in. This cookie is required for the Service to function and is not used for advertising or cross-site tracking.

• To operate the gallery: display photographs and films to the people entitled to see them, and restrict access to any album a couple has marked as limited to certain guests.
• To run face search, so a guest can find photographs of themselves without scrolling through everyone else's.
• To generate searchable descriptions of photographs and films.
• To send the account and gallery correspondence a guest or couple is expecting, and, where permitted, occasional follow-up messages guests can opt out of at any time.
• To process and ship print orders, and to pay studios their share of print revenue.
• To secure the Service — rate-limiting abuse, detecting fraud, and enforcing which albums a given guest is allowed to see.
• To maintain and improve the Service.

We do not sell personal information. We share it with the following service providers, each acting on our instructions to provide part of the Service:

• Amazon Web Services (Rekognition) — face indexing and face search, as described above.
• Cloudflare (R2) — storage of original photographs and films.
• Neon — hosting of our database (guest lists, orders, gallery structure, and the other records described in this policy).
• Stripe — payment processing for print orders.
• Resend — delivery of account and follow-up email.
• Vercel (AI Gateway) and its underlying model provider — generating searchable descriptions of photographs.
• Photography studios — a studio that shot a wedding retains the access needed to hand the gallery over and to be paid its share of print orders placed against that gallery.

We may also disclose information where required by law, to protect the rights or safety of Afterglow or others, or as part of a merger, acquisition, or sale of assets — in which case this policy would continue to apply to the information involved unless the new owner adopts its own.

Afterglow's core promise is that a gallery does not expire — there is no automatic deletion date on a wedding's photographs, films, or the guest list attached to it. That promise governs how long we keep this data: as a rule, for as long as the gallery exists, which is intended to be indefinitely.

Deletion on request. A guest, couple, or studio can ask us to delete specific personal information — a guest's contact details, a face vector, an uploaded photograph — by writing to hello@getafterglow.app. Because a gallery is a shared record kept on a couple's behalf, some requests (for example, deleting a whole gallery) are handled through the couple or studio account that controls it rather than by Afterglow unilaterally. We acknowledge every request within 3 business days and complete it within 30 days. We will ask you to verify your identity before acting — usually by replying from the email address the request concerns, or by confirming a detail only the account holder would know — because acting on an unverified deletion request is itself a way to lose somebody's wedding.

Unsubscribing from follow-up email stops those messages but does not delete the gallery or remove a guest's access — it only opts them out of that one mailing stream.

If the Service shuts down. Every gallery can be exported and downloaded, in full resolution, by the couple who owns it, at any time — this is intentional, so that the “permanent” promise does not depend on Afterglow continuing to operate forever. If Afterglow is ever discontinued or wound down, we will give at least 90 days' notice by email to every account, keep full-resolution export working for the whole of that period, and delete all remaining originals and face vectors at the end of it rather than transferring them to anyone who was not already a subprocessor under this policy.

We use reasonable technical and organizational measures to protect the information we hold, including access codes and authenticated sessions to gate who can view a gallery, and restricting an album to specific guests where a couple has configured it that way. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

• Opt out of follow-up email at any time using the unsubscribe link in the message, or by writing to us.
• Request access to, correction of, or deletion of personal information we hold about you, as described in Section 5.
• Ask what information we hold about you.

We do not sell personal information, and we do not share it for cross-context behavioural advertising — under the California Consumer Privacy Act or otherwise. We run no advertising, no ad network and no third-party analytics on galleries. California residents additionally have the right to know, to delete, to correct, and not to be discriminated against for exercising those rights; all of them are honoured through Section 5 at no charge. Afterglow is operated from the United States and is not currently offered to residents of the European Economic Area or the United Kingdom, so no GDPR lawful-basis or transfer regime is asserted here; if that changes this policy will be updated before it does.

The Service is not directed to children, and account holders (couples and studios) must be adults. Photographs of minors may appear in a wedding gallery as guests of the couple; that inclusion is the couple's decision, made as part of curating their own event, not a case of a child using the Service directly.

Afterglow is hosted in the United States and intended for use there. Face indexing runs in Amazon Web Services' us-east-1 region. Our database is hosted by Neon and our application by Vercel, both in United States regions. Original photographs and films are stored in Cloudflare R2, which distributes content globally in order to serve it quickly; a guest opening a gallery from outside the United States will therefore be served from a location near them. If you are outside the United States and use the Service, you are sending your information to the United States, where privacy law differs from that of your own country.

We may update this policy from time to time. Material changes will be reflected by a new effective date at the top of this page.

Questions about this policy, or a request under Section 5 or 7, can be sent to hello@getafterglow.app. A person reads it. Afterglow operates only in the United States and has not appointed a Data Protection Officer or an EU or UK representative, none being required of it; if the Service is ever offered in those regions, one will be appointed and named here first.