Privacy
Bada builds private albums from the photos guests upload. This page explains what data we handle and how.
Who is responsible
Hyunah Lee, NIE Y8269358K, Av. del Mundo 33, 1A, 30155 Murcia. Contact: support@bada-album.app.
What we collect
From people who create an account: name, email, language and, if they sign in with Google, their profile photo. Passwords are stored hashed, and payment details are handled by Stripe. From people who add photos: the photos and videos, their name and email, and the capture time (from EXIF, when present). From people who use a gallery: their likes and comments. We do not use facial recognition.
Signing in with Google
If you choose "Continue with Google", Google shares only your name, email address and profile photo with us (the openid, email and profile scopes). We use them only to create your account, sign you in, and show your name and photo next to your albums and comments. We do not access your Gmail, Drive, Photos or any other Google data; we do not sell or share this data, or use it for advertising or to train AI models. You can remove Bada's access at myaccount.google.com/permissions and ask us to delete your account as described below.
Lawful basis
Contract (Art. 6(1)(b) GDPR) for your account, your albums and payments. Legitimate interest (Art. 6(1)(f)) for keeping the photos guests add to a private album. Consent (Art. 6(1)(a)) for analytics and for any email that is not part of the service; you can withdraw it at any time.
Where it is stored, and who helps
Photos, videos and the database are kept in the European Union (Supabase, Ireland). To run Bada we also use Vercel (hosts the website), Stripe (takes payments; we never see your card), Resend (sends emails), Google (sign-in if you choose it, and Analytics only if you accept it) and Meta (ad measurement, only if you accept advertising). Some of them process data outside the EU under GDPR safeguards (standard contractual clauses or the EU-US Data Privacy Framework). We do not sell your data. If you accept, we only tell Meta what you did on Bada after seeing an ad; never your photos.
How long
An album's photos and data are kept for one year after it first closes (private albums, a year from creation), then deleted; the host is reminded before. If the host chooses “Keep forever”, they are kept while the album stays on Bada. If the host deletes the album, it stops being reachable at once and its content is permanently deleted after 30 days, or sooner if you ask.
Your rights
You can access, correct, delete or take a copy of your data, or object to its processing. In the app itself: as a guest you can remove your photos while the album is open; as a host you can hide or delete photos and delete the whole album. To delete your account and everything linked to it, or for any other right, write to us from "Write to us" (bada-album.app/feedback) or at support@bada-album.app. We reply within one month. If you are not satisfied, you can complain to your data protection authority (in Spain, the AEPD at aepd.es).
Cookies
Bada uses functional cookies that cannot be turned off: your language, your theme, and your session if you signed in. We also store your answer to the cookie notice, so we do not ask again. They are asked for separately, and only with your yes: Analytics loads Google Analytics, which measures which pages get visited; Advertising loads Meta's pixel and lets us tell Meta, from our server, when someone who came from an ad signs up, creates an album or pays (with your email hashed, your IP address and your browser), so we know which ads work. Whatever you decline is not loaded at all: the script never reaches the page and nothing is sent. You can change your mind any time from the "Cookies" link in the footer.
Children
Photos where children are the central subject require a parent or guardian's agreement before uploading.
Contact
For any privacy question, contact support@bada-album.app.