Legal
Last updated: 4 October 2026
Framejar Ltd ("Framejar", "we", "us", "our") provides private, self-hosted photo and video gallery hosting for weddings, parties, and other events. This policy explains what personal data we collect, why, how long we keep it, and the rights you have over it.
If you have any questions about this policy or how your data is handled, contact us at mark@framejar.co.uk.
This policy applies to two groups of people:
From hosts:
From guests:
We do not require guests to create an account or provide a name, email address, or any other personal details to upload a photo, unless the host has specifically asked for this as part of their event.
Technical logs: our web server automatically records standard access logs (such as IP address and browser type) for every visitor, used only to keep the service secure and investigate abuse or attacks. These logs are kept for a maximum of 14 days before being permanently deleted, and are not used for tracking, profiling, or marketing.
We process this data to create and operate the gallery a host has purchased, receive and store guest uploads, take payment, send hosts confirmation and account-related emails, and meet our legal obligations (e.g. tax and accounting records). Where a host has separately opted in, we also send occasional marketing emails about new Framejar features or offers.
Our legal basis for processing host data is performance of a contract and, where relevant, legal obligation. Our legal basis for processing guest uploads is legitimate interest — enabling the gallery service the host has purchased and the guest has chosen to use by uploading a photo.
Password reset emails. If a host asks to reset their password, we send a one-time reset link to the email address held for that gallery. This is a service message, not marketing, so it is sent whether or not the host has opted in to marketing emails. To make the link work, we store a one-way hash of a random token and its expiry time against the gallery, along with the times of recent reset requests so that repeated requests can be limited. The link works once and expires after one hour; the token data is removed when the link is used, replaced if a newer link is requested, and deleted with the gallery. We also email the host to confirm when a password has been changed.
The confirmation emails, expiry reminders, and other messages needed to deliver your gallery are sent regardless, since they're a necessary part of the service you've purchased.
Separately, at checkout you may be offered the option to opt in to occasional marketing emails about new Framejar features or offers. This is entirely optional, is never pre-selected on your behalf, and you can withdraw consent at any time by using the unsubscribe link in any marketing email or by contacting mark@framejar.co.uk. Declining marketing emails has no effect on your gallery or the service you've purchased.
Our lawful basis for sending these marketing emails is your explicit consent, given via this opt-in checkbox, in line with the Privacy and Electronic Communications Regulations (PECR) and UK GDPR.
Every gallery has a fixed term, chosen by the host at purchase: 30, 90, 180, or 360 days.
We do not keep guest photos or videos beyond this cycle. Host account and billing records may be kept longer where we have a legal obligation to do so, but never guest-uploaded media itself.
By default, every gallery is private: only the host can view or download the photos and videos guests have uploaded. Guests can add to a gallery, but cannot see what anyone else has added.
A host can choose to switch a gallery to shared mode at any time from their dashboard. Once switched on, anyone with the gallery's link or QR code — not just the host — can view and download every photo and video in that gallery, without needing a password. This is entirely the host's choice, can be switched back to private at any time, and does not affect who can delete photos: only the host, using their password, can ever delete anything from a gallery, regardless of its sharing setting.
If you're a guest uploading to a gallery, the host may have sharing switched on for that event — you can ask the host directly if you're unsure whether other guests can see what you've uploaded.
We use a small number of trusted service providers to help run Framejar, and never sell, rent, or share your data for marketing.
Under UK GDPR, you have the right to access, correct, request deletion of, object to, or restrict processing of your data, and to complain to the ICO at ico.org.uk or 0303 123 1113.
Guest photos specifically: if you appear in a photo uploaded to a gallery — whether or not you're the person who uploaded it — you can ask us to remove that specific photo at any time by emailing mark@framejar.co.uk. We will act on genuine requests promptly, regardless of whether the gallery's term is still active, warned, or locked.
To exercise any of these rights, contact mark@framejar.co.uk. We will respond within one month, as required by law.
If you believe we have mishandled your personal data, you have the right to complain directly to us. You can do this using our data protection complaints form, or by emailing mark@framejar.co.uk. We will acknowledge your complaint straight away and respond in full within 30 days.
You also have the right to complain directly to the Information Commissioner's Office at any time, whether or not you've contacted us first — at ico.org.uk or 0303 123 1113.
We take data security seriously. Measures include redundant mirrored storage, isolated storage per gallery, automatic permanent deletion at the end of each term, and restricted infrastructure access. No online service can guarantee absolute security, but Framejar is designed to minimise risk at every stage, from upload to deletion.
Framejar is designed for hosting event photos, which may include images of children attending an event. Hosts and guests uploading such photos are responsible for ensuring they have appropriate permission to do so.
We do not use cookies of any kind — no tracking, no advertising, and no strictly necessary cookies either. When you log in to manage your gallery, your session is kept only in your own browser's temporary storage, which is never sent to us and is automatically cleared when you close the tab.
We may update this policy from time to time. The "Last updated" date above reflects the most recent revision.
Framejar Ltd
Company No. 17425529 (registered office address available on our Companies House record)
Email: mark@framejar.co.uk
Website: framejar.co.uk