Privacy Policy

Last updated: July 17, 2026 — Effective: July 17, 2026

1. Who we are

Lenso is operated by Tarik Bucan, an independent developer based in Bosnia and Herzegovina, operating under the brand name “Lenso”. Contact: privacy@lenso.media.

2. What data we collect

  • Event hosts: email address and account details.
  • Event guests: photos, videos, and text posts submitted through event QR codes. We do not collect names or emails from guests unless voluntarily provided.
  • Technical data: IP address and browser type, from standard server logs used for security and rate limiting.
  • iOS app and App Clip: a one-way hash of your device’s vendor identifier, used only to keep your guest session and uploads linked to the same event if the app restarts. Camera and microphone access is requested only when you choose to capture a photo, video, or voice message — we do not access your device’s location.

3. Legal basis (GDPR)

  • Contract performance (Art. 6(1)(b)) — for providing the service to hosts.
  • Consent (Art. 6(1)(a)) — guests provide explicit consent before uploading.
  • Legitimate interests (Art. 6(1)(f)) — service improvement and fraud prevention.

4. Data storage and location

All data is stored in the European Union (Frankfurt, Germany) via Supabase (database) and Cloudflare R2 (media files, WEUR region). We do not transfer personal data outside the EEA.

5. Data retention

Guest media (photos, videos) are automatically deleted after the retention period selected by the event host (7–365 days). Guest consent records are retained for 3 years for legal compliance. Host account data is retained until account deletion.

6. Your rights (GDPR)

  • Access (Art. 15) — request a copy of your data.
  • Rectification (Art. 16) — correct inaccurate data.
  • Erasure (Art. 17) — delete your account or individual uploads via the delete link provided after upload.
  • Portability (Art. 20) — export your data.
  • Object (Art. 21) — object to processing.

To exercise any right, contact privacy@lenso.media.

7. Third-party processors

  • Supabase — database hosting (EU)
  • Cloudflare R2 — media storage (EU)
  • Resend — transactional email
  • Vercel — application hosting
  • Apple — App Store and App Clip distribution for the iOS app

8. Cookies

We use only strictly necessary cookies for authentication (Supabase session cookie) and for keeping a guest’s session linked to their event. We do not use advertising, analytics, or tracking cookies.

9. Contact & complaints

Data controller: Tarik Bucan, Ulica Zahira Panjete, Bosnia and Herzegovina.
Email: privacy@lenso.media.
Support: support@lenso.media.
You have the right to lodge a complaint with your national data protection authority.