Privacy policy

English version, updated 4 October 2026 · Version française.

Who is responsible for your data

Entourage is a service published by One Hour Labs Limited, a company incorporated under the law of Mauritius, registered under BRN C26236235, whose registered office is Domaine Victoria, V2, Sottise Road, Grand Baie, Mauritius. Contact: contact@entourage.photos. See also the legal notice.

What we collect, and why

Photos and videos sent by guests. They are stored so as to be made available to the host of the event and to that event's guests. Their only outsourced automated analysis is the safety moderation described below. We do not sell them, use them to train a model, or use them for any purpose other than providing, securing and, at the host's request, exporting the album.

Optional messages from guests, so they can be shown during the event slideshow after moderation. When one is sent, we do not keep the raw IP address: we calculate a pseudonymised fingerprint specific to that event. It stays with the message for the same retention period, solely for security and the investigation of possible abuse, with no audience analytics or profiling across events.

The optional first name entered by a guest when sending, solely to show who shared what. Leaving it blank prevents nothing.

The event name and the host's first name, to personalise the album.

No account is required for guests: no sign-up, no password, no advertising tracker, no data resale.

Automated moderation by Google and OpenAI

Depending on the mode chosen for the album and the services configured, we use two tools to prevent clearly violent, sexual or threatening content from being projected in front of guests:

• Google Cloud Vision SafeSearch analyses a JPEG thumbnail of each photo. For a video, it receives the preview image and up to two still frames extracted from the video, never the complete video. Those images are sent within the request, with no name, email address or account identifier;
• OpenAI's Moderations API analyses the text of guest messages. No photo or video is sent to OpenAI by this processing;
• the services return safety categories and risk scores. Entourage uses them to publish, withhold, or queue the content for human review. This classification can be wrong; it has no legal effect and does not create a profile of the person.

Google and OpenAI act here as technical providers and may process data in the countries where they and their subprocessors operate, under their contractual safeguards. For the synchronous calls used by Entourage, Google states that images are processed in memory without being persisted to disk and are not used to train Cloud Vision; OpenAI states that content sent to /v1/moderations is not retained and is not used to train its models. Their current information is available in the Google Cloud Vision data usage notice and the OpenAI API data controls.

We keep the returned verdict and scores with the relevant content for the life of the album, so as to explain the classification and enable review. You may challenge a classification with the host or at contact@entourage.photos.

If you sign in with Google

Signing in to your host area with Google is optional: the link sent by email is enough and keeps working. If you choose Google:

• we request only openid email profile. That authorisation gives no access to your photos, your calendar or your mailbox;
• we receive from Google a stable identifier, your email address, your first name and your language. That is all, and that is all we keep;
• no Google access token is stored: we have no way of contacting Google on your behalf after you have signed in;
• we match your Google identity with an existing account only if Google confirms to us that the address is yours;
• you can unlink that account at any time from My account, losing nothing.

If you connect your Google Photos

The host connects their Google account so that their guests' photos land directly in their own Google Photos library. That is the whole point of the product: the photos go home with the host instead of sleeping with us.

What we receive from Google

• the https://www.googleapis.com/auth/photoslibrary.appendonly authorisation, in the form of a refresh token;
• your Google email address (openid email), so that the screen can show you which library your photos are about to enter;
• in return for each upload, the identifier of the album we created and of each photo added.

What we do with it, and nothing else

• create one album in your library, under the name you chose;
• add to it the photos and videos your guests sent for that event;
• show the progress of the upload and a link to the album;
• keep the identifier of each photo added so that we never send it twice, and so that we know it has arrived before erasing our transit copy.

This authorisation gives no read access to your library: we can neither see your other photos, nor modify them, nor delete them, nor even find the album we created if you delete it. Nor can we add to an album that already existed: Google only allows it for albums the application created itself.

What we keep, and for how long

• the refresh token, encrypted, until you withdraw the authorisation. Removing it from My account erases it from our databases immediately;
• your Google email address and the date of the authorisation, for the same period;
• the album and photo identifiers, for as long as the Entourage album exists.

You can withdraw this authorisation at any time, from My account or from your Google account. Photos already delivered to your library belong to you and stay there: we have no way of taking them back.

Limited Use

Our use of data received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. In particular:

• this data serves only the features described above, which are visible on screen;
• we transfer it to no one, except at your request, where the law requires it, or for the strictly technical hosting needs described below;
• we never use it for advertising or profiling, and we do not sell it;
• we never use it to develop, improve or train artificial intelligence models, generalised or otherwise;
• no human reads it, except with your express consent, for security reasons, or where the law compels us.

Who we share your data with

We sell no data, and we transfer none for advertising purposes without your express consent. The only third parties that process any are the technical providers below, each for one precise task, each bound by a processing agreement:

One exception, and only if you agree to it: if you create an album from a Google ad and tick the box provided, we tell Google its ad worked. Google then receives that data as the controller of its own advertising service, not as our provider. The details are under Measuring our campaigns.

The data we receive from Google about you is transferred to none of these providers, with the single exception of OVHcloud, which hosts the database where it is recorded and does not access it. It goes neither to Brevo, nor to Sentry, nor to Paddle, nor to any moderation service, nor to the audience measurement, which only ever sees the public pages, nor to the measurement of our advertising campaigns.

Beyond those cases it may be disclosed in two situations only: where the law or a judicial authority compels us, and if the Entourage business were one day transferred, in which case you would be informed before any transfer and could ask for erasure.

How we protect your data

• In transit: the whole site and every exchange with Google's APIs go over HTTPS (TLS). No page of the service is served in the clear;
• The Google token, at rest: it is encrypted before it even reaches the database, using authenticated encryption, with a key that is not in the database. Access to the database alone does not make it usable;
• Logs and error reports: a filter removes tokens, album secrets and addresses from the reports sent to Sentry, before they leave. No Google token is ever written to a log;
• Files: they are reachable only through signed, short-lived addresses, never through a guessable URL. The storage is not public;
• Access: administration of the service is restricted to a named list of addresses, checked on every request, and is never granted by a value stored in the database;
• Erasure: deleting a media item or an account is applied to the primary storage and to its backup, never to one alone.

How long we keep your files

How long depends on the plan chosen by the host:

• Discovery — fourteen days after the album is created;
• Complete — one year from the date of purchase;
• Essential — the files are only passing through. Once this purge is in service, seven days after closure we will erase only those copies whose export has been confirmed; if an export fails, we will alert the host after seven and twenty-one days and keep the original long enough for them to retrieve it, until a final purge announced after thirty days. Exported originals remain in the cloud chosen by the host, with no expiry date set by Entourage; that service's own policy applies to them;
• Pro — for the duration of the subscription, then one year from its end.

Albums created before these plans were introduced are subject to no automatic expiry. These durations are the ones we apply from the moment they are technically implemented; until then, no album is deleted automatically. To delete an album before its due date, write to us at contact@entourage.photos: we delete it permanently within 30 days.

Where your data is hosted

On servers located in the European Union (France), with OVHcloud. If you use direct export, originals go to the storage service you have designated yourself, and its policy then applies to them.

A backup is replicated to a second OVHcloud container, also located in France but in a separate region. It is neither public nor used to serve the album. Every media deletion is applied to both the primary storage and this backup.

Your rights

Under the GDPR, you may request access to, rectification of, erasure of or portability of your data, and object to its processing. A request sent to contact@entourage.photos receives a reply within 30 days. If a photo of you was sent by someone else and you want it taken down, write to us: we delete it without questioning your reasons.

Removing a photo you sent

After sending, the thank-you screen lists what your device sent and lets you remove any item, with no account and without writing to us. The photo disappears from the album at once; the file and all its derived versions — thumbnail, display copy, video preview image — are erased from our servers within seven days.

That link relies on a random identifier kept for 90 days in a technical cookie shared across the site. The same cookie may therefore accompany contributions to several albums. Its value is stored with media so they can be removed, and with messages to apply sending limits. We do not use it for audience measurement, navigation tracking, profiling or matching your activity across events. If you have lost it — another phone, private browsing, cookies cleared — the album's host can remove any item, and you can always write to us.

The removal window stays open for as long as the album accepts uploads. Once the album is closed, it is the host who decides.

Audience measurement

We count visits to the site's public pages — the home page, the explanatory pages, the legal pages and the creation form — using Matomo, a tool we host ourselves on our own servers. The figures go to no advertising network and are sold to nobody.

This measurement does not enter the albums. Neither a guest's page, nor the gallery, nor the slideshow, nor the host area is measured: the address of those pages contains the album's code or secret, and sending it to an analytics tool would amount to depositing a private album there. Your photos, your messages and the name of your event are therefore never seen by this measurement, in any way.

On the public pages it records the address of the page viewed, without its parameters (no campaign label, no click identifier), the site you came from where it is outside ours, reduced to its name alone, your language and the type of device. It works without storing a single cookie: that is why the site does not ask you for consent, and it is also why it cannot recognise a returning visitor. If your browser sends a Do Not Track signal, we honour it and nothing is recorded.

Measuring our campaigns

We make Entourage known through Google ads, through partners (for instance the EntouragePhotos poster template shop on Etsy) and on social networks. The links we place there carry a campaign label, for instance "google / cpc / search-en". It names the campaign, not you: everyone who follows the same link carries the same one.

• Arrivals. When a public page is opened from such a link, we add one to that label's counter for the day. The counter keeps neither your IP address, nor your device, nor the time: nothing that could recognise you;
• Your album. If you create an album, its label is recorded with it, so that we know which channels bring us hosts. It follows you through the site in the address of its pages, never in a cookie, and goes to nobody. This rests on our legitimate interest in knowing which campaigns work; you can object by writing to us, and we erase the label.
• Your Pro account. If you open an account from the Pro page, the label of your visit is recorded with your account, for the same reason. It travels through the form, then through the sign-in code we send you (or, with Google, through the sign-in session alone, which forgets it on return), never in a cookie. Same basis, same right to object.

If you arrive through a Google ad, Google adds a click identifier to the link. We keep it, and send it back to Google, only if you agree, by ticking a box that is never ticked in advance when you create your album. Google then learns that its ad led to an album being created and, where it happens, to a purchase: the click identifier, the kind of event, its date and, for a purchase, its amount before tax. Never your name, your email address, the name of your event or your photos. We do not allow it to use this to personalise the ads it shows you.

Google Ireland Limited receives this data as the controller of its advertising service, under its own privacy policy; it may be processed outside the European Union, including in the United States, under the safeguards Google puts in place. Without your consent, the identifier is forgotten as soon as the album is created and nothing goes to Google. With it, the identifier is kept with the album and erased with it. You can withdraw your consent at any time from the album's settings: the identifier is erased at once and nothing more is sent, what has already been sent remaining subject to Google's policy.

No advertising tag is loaded on the site: we do the sending, and only what is written here.

Cookies

We use no advertising cookies, and neither the audience measurement nor the measurement of our campaigns described above stores any. Only technical cookies strictly necessary for the site to work are stored, and here they all are:

• your language choice, so we do not ask again on every page;
• your light or dark theme choice, kept by your browser alone;
• a site-wide device identifier, kept for 90 days and stored with your media so they can be removed, and with messages to apply sending limits, with no audience analytics or profiling;
• a session cookie and, if you ask for it, a sign-in cookie, in the host area.