Privacy policy

Who is responsible?

The data controller is Max Bryselbout, an individual, 82 avenue de Bretagne, 59000 Lille, France. For any question: max.bryselbout@gmail.com. The complete details are in the legal notice.

What we collect

If you organise an album (an account is required): your email address, your name, your password (stored as a hash, never in the clear) and your sign-in sessions.

If you take part in an album (no account): the first name you type to sign your uploads and comments, and a random technical key placed on your device (see the cookies below). That key allows one thing only: recognising you as the author of your own uploads, so that you can delete them.

The album's content: the photos and videos uploaded, their technical metadata (file name, dimensions, dates) and the uploader's first name; the emoji reactions and the comments, tied to their author. Thumbnails are generated automatically for display.

The guest book's entries: the written note and, where there is one, the voice or video recording left by a guest, tied to their first name. A recording carries the voice, and a video the face, of an identifiable person: we treat them with the same care as the photos, with no automatic analysis of any kind. The organiser chooses who may view them, themselves alone or everyone with access to the album, and can close the guest book at any time.

If you buy the Event plan: the information needed for the payment and its follow-up (amount, date, status, transaction identifier passed on by our payment provider). We never collect or store your card details: they are entered directly with our provider (see Payment below).

Technical logs: like any online service, our servers record logs (IP address, request timestamps) needed for security and for the service to work.

If you upload a photo, a video, a comment or a guest book entry: we keep, alongside your contribution, the IP address it was sent from and its date. This is not a commercial choice: the French law on confidence in the digital economy requires the host of content uploaded by a third party to keep enough to identify its author, so as to be able to answer a judicial authority. That address is never displayed: not to the other guests, and not to the album's organiser. It is erased automatically after 365 days, without your contribution being deleted.

Audience measurement: we measure traffic to the site with OpenPanel, an open source tool configured without cookies and without cross-site tracking: page views, referrer, device type, as statistics. No Google Analytics, no ad network, no session recording.

Why, and on what legal basis?

• Providing the service (creating the album, receiving and returning media, signing uploads, allowing reactions and comments): performance of the contract for organisers, legitimate interest for guests taking part.
• Securing the platform (logs, abuse prevention): legitimate interest.
• Knowing what makes Medley known (the channel you arrived through, kept next to the account you create): legitimate interest. That data serves our own internal statistics alone, is passed to nobody, and serves neither advertising nor profiling.
• Inviting you to leave a review after your event (the end-of-event email sent to the organiser and, if we have switched them on, the Trustpilot invitation that follows it): legitimate interest. You can object at any time, by replying to that email or through the invitation's unsubscribe link.
• Being able to identify the author of uploaded content (the IP address kept alongside a photo, a video, a comment or a guest book entry): a legal obligation, the one article 6 of the French law on confidence in the digital economy places on a host. That data has no other use: it is disclosed only to a judicial authority that requires it, never to the organiser, never to the other guests, and it serves neither moderation nor audience measurement.
• Processing your purchase of the Event plan (payment, follow-up, proof): performance of the contract, and compliance with our legal accounting and tax obligations for keeping the records.

Nothing else. Your data serves neither advertising, nor profiling, nor the training of models, and is never sold.

Cookies

Medley only sets cookies that are strictly necessary for the service to work, exempt from consent: that is why there is no cookie banner.

• mdl_guest (12 months): a random technical guest key, which lets you delete your own uploads and reactions.
• mdl_name (12 months): the first name you typed, so we do not ask you again.
• mdl_lang (12 months): the language you chose, so we serve you the site in it.
• mdl_attr (90 days): which door you came in through (a search engine, a social network, an AI answer, a campaign link), so we know what makes Medley known. It holds no identifier, follows you on no other site, is passed to nobody, and is read exactly once: if you create an account.
• Session cookies: authentication of signed-in organisers.

No advertising cookie is set, and none follows you from one site to another: mdl_attr only says which door you came in through on this one. The audience measurement (OpenPanel, described above) also works without cookies.

Who sees your content?

A Medley album is reachable by anyone holding its link or its QR code: that is the principle of the service (guests join without an account). Anyone with that link can view and download the album's photos and videos, including yours. Albums are neither public, nor indexed by search engines, nor listed anywhere: only the people the link is passed to can reach them. Only share the link with the people concerned by the event.

Outside that circle: our technical subprocessors (hosting, audience measurement, payment, email delivery) process the data on our behalf, inside the European Union. A single case steps outside that frame, and it is announced in the very email that carries it: if we have switched the review invitations on, the organiser's name and email address and the album's title are passed to Trustpilot (Trustpilot A/S, Copenhagen, Denmark) along with the end-of-event email, for the sole purpose of inviting them to leave a review. That transmission never concerns guests, and the invitation can be declined in one click.

Where is your data?

The data and the media are hosted by OVH (OVH SAS, Roubaix, France), a French host acting as a processor, in data centres located in the European Union, with no transfer to third countries. That is a founding commitment of Medley, not an option.

Payment

The Event plan is paid through Mollie (Mollie B.V., Amsterdam, Netherlands), a licensed European payment provider, which handles the transaction on our behalf. Your card details are entered and processed directly by Mollie, inside the European Union: they never pass through our servers and we do not store them. On our side, we keep only the trace of the transaction (amount, status, Mollie identifier) and, on that trace, what an accounting record has to carry: your name, your e-mail address and the album title, frozen at the moment of purchase. That is what lets us follow up your purchase and meet our accounting obligations.

For how long?

• Media, reactions and comments: kept for the album's retention period (during the test phase, at least until December 31, 2026; see section 10 of the terms of use), and in any case until their deletion by their author or by the organiser, or the deletion of the album. We never delete an album at the end of its retention without having informed the organiser first.
• The original files: The originals of your photos and videos are kept with the album: nothing is reduced to web quality during the test phase. They therefore follow the album's duration, above.
• The IP address attached to a guest contribution: 365 days, the duration assigned to the identification data a host must keep. After that it is erased, and the contribution stays.
• Payment data: 10 years, the period assigned to accounting records. A confirmed payment therefore survives the deletion of its album and of its account: that is an obligation resting on us, and one the right to erasure gives way to. At the end of the term the name, the address and the album title are erased; what is left is an amount and a date, which name nobody.
• The organiser's account: until it is deleted, which you can do yourself from your account page, or on request. A confirmed payment, however, stays: see the line above.
• Guest cookies: 12 months.
• The arrival channel: the cookie 90 days, and the row kept next to an account follows the life of that account.
• Technical logs: a limited period, for security purposes.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability over your data. Two reservations, and both come from the law rather than from us. The first: as long as we host content you have uploaded, the IP address kept alongside it can be neither objected to nor erased in isolation, since that is an obligation resting on the host. Delete the content and it goes with it; otherwise it erases itself after a year. The second: a confirmed payment is an accounting record, which we have to keep for 10 years even if you delete your account. Everything else goes. Two routes:

• Straight in the album: from the device you uploaded with, you can delete your own photos, videos, reactions, comments and guest book entries yourself. The organiser can remove any content from their album.
• From your account page (organisers): under your account, you can at any time change your details, export all your data as a file (portability), and permanently delete your account with all your albums and media (right to erasure, applied immediately).
• By email: max.bryselbout@gmail.com, stating the album concerned. We answer as soon as we can, and within one month at the latest.

If you believe your rights are not respected, you can lodge a complaint with your national data protection authority. The authority competent for the controller, established in France, is the CNIL (Commission nationale de l'informatique et des libertés), cnil.fr.

The image rights of the people photographed

The photos of an event often show people other than their author. By uploading a medium, you make sure it does not infringe the rights of the people appearing in it. If a photo of you has been uploaded to an album and you want it removed, contact the event's organiser or write to us: it will be removed.