Last updated: 13 November 2026. Version 1.0.
1. Data controller
Aasyn Studio, Danish company reg. no. (CVR) 46034597, Bülowsgade 41, 8000 Aarhus C, Denmark, is the controller of the personal data processed in Samling. You can contact us at hello@samling.cloud.
Polar Software, Inc. handles payments and is an independent controller of the payment data it collects. Polar’s privacy policy is available on polar.sh.
2. What we process, why and on what legal basis
Owners: email, name, language, the Samling’s name, description, cover photo and settings. To create and run the Samling and send emails about it, including sign-in codes, storage, closing and deletion. GDPR Art. 6(1)(b) (contract).
Owners: amount, currency, order number and the tick “start right away” from Polar (never card details). To deliver the purchase and handle withdrawals and refunds. Art. 6(1)(b) (contract).
Owners: purchase, withdrawal and refund records. Bookkeeping. Art. 6(1)(c) (legal obligation, the Danish Bookkeeping Act).
Guests: photos and videos and the people shown in them, and the name the guest enters (unless they share anonymously). To receive, store and display the content in the Samling. Art. 6(1)(f) (our and the owner’s legitimate interest in collecting photos from an event).
Guests: the steps of a visit to the upload page (opened, picked files, uploaded, and whether it failed), timings, the kind of phone and browser, photo or video and a rough size. No names, file names, photos, IP addresses, device IDs or cookies are recorded, and the steps can’t be traced to a person. To make uploading work better. Art. 6(1)(f) (legitimate interest).
Owners: what you do in Samling (signing in, creating, editing and deleting a Samling, sharing the link, downloading, deleting files), linked to your account and seen only by us. To make Samling work better. Art. 6(1)(f) (legitimate interest).
Everyone: IP address, browser, timestamps in our providers’ server logs. Security, preventing abuse and fixing errors. Art. 6(1)(f) (legitimate interest).
Everyone: reports of content and our answers. Handling reports of illegal content. Art. 6(1)(c) (legal obligation, the Digital Services Act).
Location in photos. Photos and videos can contain information your phone saved in them, such as where and when they were taken. We keep the files as they were uploaded, so anyone who saves a photo from the Samling can see this information.
Children. Photos from parties often show children. Only share photos of children if their parents are comfortable with it.
3. Who can see the content
Anyone with the link or QR code to a Samling can view and save everything in it. The owner decides who gets the link, and can delete files. We never list Samlinger publicly, and we ask search engines not to show them.
4. Who we share data with
We never sell personal data and never use photos or videos for advertising or AI training. We use these processors, who may only process the data on our instructions:
Supabase: database, photo and video storage, and sign-in. Stored in the EU.
Vercel: runs the app at app.samling.cloud. USA, with servers worldwide.
Resend: sends our emails. USA.
Google (Workspace): our email inbox, hello@samling.cloud. EU and USA.
Framer: our website, samling.cloud. EU and USA.
Polar receives the data needed for payment as an independent controller. When data is transferred to a country outside the EU/EEA, this is based on the European Commission’s standard contractual clauses or the EU-U.S. Data Privacy Framework.
5. How long we keep data
Photos and videos: until the Samling is deleted, at the latest 30 days after it closes for uploads, or when the owner deletes them. Backup copies are deleted no later than 7 days after that.
Uploads that were never shared: deleted after a day.
Owner data: for as long as you have an account. When you delete your account, everything is deleted after 72 hours.
Bookkeeping records (purchases, withdrawals, refunds): 5 years from the end of the financial year they relate to, also when the Samling or account is deleted.
Statistics about visits and actions: 13 months.
Server logs: 30 days.
Content reports: 12 months after the case is closed.
6. Your rights
You have the right to access, correct and delete your data. You can also restrict processing, object to processing based on legitimate interest and receive your data in a portable format. Write to hello@samling.cloud. Guests’ statistics can’t be traced to a person, so we can’t look them up for a request.
If you are a guest and want a photo removed, you can ask the owner to delete it or write to us. We answer within one month.
7. Cookies
We only use cookies and storage on your device that Samling needs to work: keeping you signed in, remembering your language and light or dark mode, and, on the upload page, remembering your name and “share anonymously” and resuming an upload that was interrupted. These do not require consent. We use no cookies for statistics or advertising.
8. Complaints
You can complain about how we process personal data to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk, or to the data protection authority in your own EU country. You are also welcome to contact us first.