Privacy Policy
Last updated: October 17, 2026
Effective from October 17, 2026.
1. Who is responsible
This policy covers the patifot.app website, the Patifot dashboard and the Patifot iPad app. They are operated by PATIFOT, société par actions simplifiée à associé unique (SASU), capital 30 000 €, RCS Paris 983 410 473, SIREN 983 410 473, TVA intracommunautaire FR02983410473, registered office 58 rue de Monceau, CS 48756, 75380 Paris Cedex 08, France ("Patifot", "we"). Privacy contact: [email protected], +33 1 84 16 54 39.
This policy describes the website, business accounts and the iPad Service, including Event Guest processing explained below. Stationary booths for which Patifot itself is the controller have separate privacy information, provided on the booth screen before any AI choice.
2. Our two roles
Patifot is the data controller for operator accounts, this website, billing, support and the security of the service.
For photos and related data of Event Guests, the booth operator, our customer, is the controller and Patifot is its processor under Article 28 of the GDPR. Our data processing agreement, version 2026-10-17, forms part of the Terms of Service and governs this processing, including during a free trial. If the operator enables AI for an Event, OpenAI Ireland Ltd. is a subprocessor for the AI processing described in this policy.
For photos taken with the standalone Standard print function, the operator is the sole controller. Those photos stay on the operator's iPad. Patifot does not receive or process them and is neither controller nor processor for them. Classic at an Event is a separate mode and follows the Event archive rules.
3. What we process and for how long
The table below gives, for each purpose, the data we use, the legal basis under Article 6 of the GDPR, how long we keep the data and whether you have to provide it.
| Purpose | Data | Legal basis | Retention | Required? |
|---|---|---|---|---|
| Operator account and sign-in | Name, business e-mail address, company details, password (stored as a hash), sign-in sessions, the iPads you activate, the files you upload to prepare events (frames, idle screens), and the operator name and contact you choose to show to guests | Contract (Art. 6(1)(b)) | While the account exists, then deleted as described in section 6 | Yes. Without it we cannot open or run your account. |
| Unconfirmed registrations | Details entered in the registration form | Contract (steps before the contract, Art. 6(1)(b)) | Deleted 7 days after registration if the e-mail address is not confirmed | Yes, to open an account. |
| Support | Your messages and the details you send us by e-mail or phone | Contract; legitimate interest in answering requests (Art. 6(1)(f)) | While your account exists. Without an account (for example an access request or a guest's request), 3 years after our last exchange. Then deleted. | No, but we can only help with what you tell us. |
| Product news and offers by e-mail | Your e-mail address, your choice, its date and the version of the wording you agreed to | Consent (Art. 6(1)(a)); you can withdraw it at any time | Until you unsubscribe or the account is deleted; the record of your choice stays with the administrative records | No. |
| Billing and invoices | Plan, amounts, dates, Paddle customer and subscription identifiers, invoice details. Paddle handles payment details as an independent controller, and we never receive card numbers. | Contract; legal obligation to keep accounting records (Art. 6(1)(c)) | 10 years | Yes, to buy a plan. |
| Administrative and access records | Actions Patifot staff take on your account, such as granting or ending service access, and the service access granted; no e-mail address | Legitimate interest in securing the service and proving what was done on the account (Art. 6(1)(f)) | While the account exists. After deletion, 10 years with the pseudonymised billing records | Created automatically. |
| Security logs and technical logs | IP address, browser or device details, requests, sign-in and error events | Legitimate interest in keeping the service secure and working (Art. 6(1)(f)) | No more than 90 days | Collected automatically; the service cannot run without them. |
| Booth telemetry | Device health, printer and paper status, error events and configuration version, linked to the iPad and your account | Contract; legitimate interest in running and supporting booths (Art. 6(1)(f)) | No more than 90 days | Collected automatically while a booth runs. |
| Print counters | Time of each print, number of copies, printer paper level, the iPad and your account; no photo and no guest data | Contract; legitimate interest in running the service and showing you your usage (Art. 6(1)(f)) | Individual print events: no more than 90 days. A monthly total per account: while the account exists | Collected automatically when a booth prints. |
| Guest photos and Event archive, Patifot as processor | Accepted and rejected takes, finished prints, Event and session identifiers; for AI sessions, the source photo selected for AI and the generated result | Operator's instructions under Article 28. Optional AI processing relies on Guest consent under Article 6(1)(a). The operator specifies the basis for other purposes | Patifot archive: 90 days after the later of the end of the Event day in local time and the last confirmed upload. Temporary AI processing and OpenAI retention are described in section 4 | Booth participation is optional. AI is optional and Classic is available |
| Record of the notice and Guest's actions, Patifot as processor | Notice version, time, Start action, Event and session references; for AI, the version of the AI information shown and the recorded choice. No Guest name or photo | Operator's instructions under Article 28; used only for accountability and to establish, exercise or defend legal claims | Five years, until the end of the fifth anniversary of the Event day in the Event's local time. Backup deletion follows the existing 15-day rule | Recorded when the relevant notice and action occur |
| AI style instructions and text rewriting, Patifot as processor | Selected style text, rewritten instructions and the moderation reason used for rewriting; personal information if included in those texts. The photo is not sent to the text model | Operator's instructions under Article 28; Guest consent for optional AI processing | Style texts and rewritten instructions are stored in the AI job record while the customer account exists and are deleted when the account is deleted, as described in section 6. Source photo and result files are deleted according to the periods in section 4. OpenAI's separate retention is described in section 4 | Only for AI processing. Do not include unnecessary personal information in prompts |
| Operator's documented AI instruction, Patifot as controller for the business account record | Account and acting-user reference, Event reference, DPA version, confirmation wording, time and choice | Contract, Article 6(1)(b), for documenting the requested Event configuration | While the account exists, then deleted as described in section 6 | Required to enable AI for an Event |
| Backup copies | Copies of the database kept on the server, and encrypted copies kept off site | Legitimate interest in restoring the service after an incident (Art. 6(1)(f)) | A record deleted from the live database disappears from backup copies no later than 15 days after that deletion | Automatic. |
| Deletion journal | Random identifiers of the account, events, photo takes and iPads, content hashes and signatures; no photos, names, e-mail addresses or free text | Legal obligation to erase data and legitimate interest in proving the erasure (Art. 6(1)(c) and (f)) | No end date: it is kept as long as the service runs, because it stops an older backup from bringing deleted data back. Its off-site copy in the EU cannot be erased for 3,000 days after it is written. | Automatic. |
| Account deletion requests | Confirmation code (stored only as a keyed hash), the e-mail address for the completion notice, dates and status of the request | Legal obligation to handle erasure requests (Art. 6(1)(c)) | The code expires after 10 minutes and is erased with the account. The e-mail address is erased once the completion notice is sent. The dates and status, without name or e-mail address, stay with the pseudonymised billing records for 10 years as proof of the deletion. | Only if you ask for deletion. |
| Built-in demo in the app | Demo photo and a local technical record, kept on the iPad only and never uploaded | Legitimate interest in letting you try the app (Art. 6(1)(f)) | 48 hours on the iPad. If the iPad was switched off at that time, the data is deleted at the next launch. | Optional. |
| Standard print on the iPad | Guest photo, print image and a local technical record, on the iPad only, never uploaded | Not processed by Patifot; the operator is the controller | Deleted when the print is done, at the latest 24 hours after the photo was taken (up to 7 days only if a print record is damaged); if the iPad was off, at the next launch. A deletion record without photo stays on the iPad for 12 months | Optional for guests. |
If a record is needed for a legal claim, a documented legal hold can extend its retention only as long as required. When the hold ends, the original deadline applies again.
AI generates or transforms an image. This function does not make decisions about a person that have legal or similarly significant effects.
Free trial checks
When an iPad asks for a free trial, we check that the company, its e-mail address, the iPad and the Apple Account have not had a trial before. A trial we gave manually on request also counts when the same company or e-mail address asks again. We never receive the iPad serial number or the e-mail address of the Apple Account.
- We keep a pseudonymised HMAC fingerprint of the account e-mail address and a pseudonymised fingerprint of the Apple AppTransaction identifier of the app download. They stay for their full period even after the account is deleted.
- The app sends us one-time DeviceCheck tokens. We forward them to Apple and do not store them. Apple keeps a mark on this iPad saying that its free trial has been used. The mark is shared by all apps of our Apple developer team and has no expiry date. We use it only when we check whether a trial is allowed. We do not reset it automatically, and a manual exception we sometimes grant on request does not remove it. During the check we learn the value of the mark for your organisation's iPad.
- The outcome of each check (trial allowed or refused and the reason, without the mark, the tokens or the fingerprints) is stored in the record of the request attempt and in the trial action log.
- The trial action log has two kinds of entries. Technical check events (result code, iPad, date) are deleted after 30 days. Lifecycle events and support actions on a trial (offer, claim, exception, move to another iPad, seat release, early end, closing an attempt, import of a manual trial) are kept and deleted together with the trial record; if that record no longer exists, such an event is deleted 24 months after it was created.
Every deletion below is automatic and also applies to backups we restore. In backup copies, a deleted record disappears no later than 15 days after it leaves the live database. You can object to these checks by writing to [email protected].
| Trial record | Data | Legal basis | Retention | Required? |
|---|---|---|---|---|
| Repeat-trial fingerprints | Pseudonymised HMAC fingerprint of the account e-mail address; pseudonymised fingerprint of the Apple AppTransaction identifier | Legitimate interest in preventing repeat trials (Art. 6(1)(f)) | 24 months after they are recorded, including after the account is deleted | Needed to get a free trial. |
| DeviceCheck tokens and the Apple mark | One-time tokens from the app; a mark on the iPad held by Apple | Legitimate interest in preventing repeat trials (Art. 6(1)(f)) | Tokens: not stored by us. Mark: kept by Apple with no expiry date, not reset automatically | Needed to get a free trial. |
| Trial record, its lifecycle events and support actions | Dates, iPad, access granted, version of the accepted data processing agreement; offer, claim, exception, move, seat release, early end, closed attempts and imported manual trials | Contract; legitimate interest in keeping a minimal commercial record (Art. 6(1)(f)) | 24 months after the later of the end of the trial and the expiry of the offer. A lifecycle event without a trial record: 24 months after it was created | Created with the trial. |
| Request attempts | Technical record of each trial request and its outcome | Legitimate interest in running the check reliably (Art. 6(1)(f)) | 30 days after the attempt ends, including an attempt interrupted by a failure | Created automatically. |
| Technical check events in the trial action log | Result code, iPad, date | Legitimate interest in running the check reliably (Art. 6(1)(f)) | 30 days | Created automatically. |
4. Guest photos at Events
Guests see the Patifot notice before the camera starts, and the booth takes photos only after the Guest presses Start shooting. For a child in a Classic session, a parent, a legal guardian or an adult authorised by one of them must start the session, subject to applicable law.
Event photos are uploaded to Patifot's servers in the EU and kept in a closed archive for the event operator or an event host the operator authorises. There is no public gallery, and Guests do not receive Event photos by QR code or PIN. A rejected take remains in the same closed archive and follows the same deadline.
On the iPad, a file can be deleted seven days after the server confirms its upload, once upload and printing are complete. A file still waiting for upload or printing stays until that is done or its deletion is authorised.
AI is available only if the operator chooses to enable it for the Event. Before AI processing, the Guest always sees an information window with “I agree” and “I do not agree” choices and access to the full information. The operator cannot disable this window. Refusal leads to Classic and the photo is not sent to OpenAI. The window also explains that Guests can withdraw consent at any time through the operator identified below it or [email protected], and that a photo already sent or printed cannot be recalled.
Everyone visible in an AI photo must be at least 15 years old and must have given the required consent. If anyone is younger or does not agree, Classic must be used. The operator, as controller, is responsible for ensuring the age condition and consent of everyone photographed, including adults. In the information window, the Guest confirms for everyone visible in the photo that they all agree to AI processing and are all at least 15 years old. The age condition relies on this declaration; the Service does not check identity documents or automatically determine age. Optional AI processing relies on consent under Article 6(1)(a) of the GDPR.
For an AI session, the photo selected for AI and the style instructions are sent through Patifot's EU infrastructure to the Global OpenAI API. OpenAI processes the inputs and generated result under its standard DPA, with OpenAI Ireland Ltd. as Patifot's contracting entity. An OpenAI text model may rewrite the style instructions using the text and moderation reason. The photo is not sent to that text model.
This Global service does not include EU data residency or Zero Data Retention. Processing and retention may take place outside the EU/EEA, including in the United States. The storage country of a particular photo is not established. Transfer safeguards are described in section 5.
OpenAI may retain API content for up to 30 days for abuse monitoring and technical caching, longer only where required by law or for safety. Images flagged as potential child sexual abuse material (CSAM) may be retained for manual review; OpenAI does not publish a maximum period for that exception.
API content is not used for model training by default, and Patifot does not opt in. Patifot's temporary AI working files are removed when no longer needed; archived photos and results follow the Event archive deadline. These rules do not set OpenAI's retention periods. Deleting a photo or an account at Patifot does not automatically delete copies retained by OpenAI.
Patifot does not run face recognition, create face templates or use Guest photos for advertising. Guests exercise their rights with the operator named in the notice, and Patifot helps the operator respond.
With standalone Standard print, the photo remains on the operator's iPad. It is printed there, never uploaded, and deleted after printing, at the latest 24 hours after capture, or up to 7 days if a print record is damaged. The operator named on the booth screen is the controller; Patifot receives only a count of prints.
5. Recipients
We share data only with the recipients below. Providers that process data on our behalf do so under a contract that meets Article 28 of the GDPR and protects the data at least as well as this policy. Paddle and Apple are independent controllers for their own services. We do not sell personal data and we do not run advertising.
| Recipient | What it does | Where | Safeguard outside the EU |
|---|---|---|---|
| UpCloud Oy (Finland) | Application servers and storage | EU | No transfer |
| Backblaze (B2 storage, EU region) | Off-site backup copies in its EU region; database copies kept there are encrypted | EU | Data stored in the EU; Backblaze, Inc. is certified under the EU-US Data Privacy Framework |
| Cloudflare, Inc. | Hosting of this website, DNS and proxy for our services, and routing of e-mail sent to patifot.app addresses | EU and USA | EU-US Data Privacy Framework; standard contractual clauses |
| Brevo (France) | Sending account e-mails (address confirmation, password reset, account deletion codes), booth notifications, and product news and offers if you agreed to receive them | EU | No transfer |
| Proton AG (Switzerland) | Mailbox that stores messages sent to [email protected], as our processor under the Proton data processing agreement | Switzerland, Germany or Norway | EU adequacy decision for Switzerland; Germany and Norway are in the EEA |
| Paddle.com Market Limited (United Kingdom) | Checkout, payment, invoices and VAT, as Merchant of Record and independent controller | United Kingdom and EU | EU adequacy decision for the United Kingdom |
| Apple | App Store distribution of the iPad app, App Attest checks that requests come from a genuine copy of the app, and DeviceCheck for free trial checks; independent controller | EU and USA | Standard contractual clauses used by Apple |
| jsDelivr (Volentio JSD Limited, United Kingdom) | Delivers the style sheet the dashboard loads, as our processor under the jsDelivr data processing agreement. Your browser sends it your IP address and browser details when you open the dashboard. | United Kingdom; its content delivery network serves from many countries | EU adequacy decision for the United Kingdom; EU standard contractual clauses in the jsDelivr data processing agreement for onward transfers |
| Telegram | Delivers booth notifications, only if you connect Telegram to your account yourself | Outside the EU | No adequacy decision or standard contractual clauses. The transfer relies on your explicit consent when you connect Telegram (Art. 49(1)(a)). You can use e-mail notifications instead and disconnect Telegram at any time. |
| OpenAI Ireland Ltd., Ireland | Subprocessor for optional Event AI processing: image generation or editing, text-only rewriting, and associated moderation, abuse monitoring and safety checks. Receives the photo selected for AI, style text and necessary request data, and processes the generated result | Global service; processing and retention may occur outside the EU/EEA, including the United States. The storage country of a particular photo is not established | Onward transfers under §4.1 of the standard OpenAI DPA rely on applicable Standard Contractual Clauses or an applicable European Commission adequacy decision. The EU-US Data Privacy Framework applies only to covered transfers to a recipient with valid certification. Request information and a copy of the applicable safeguards at [email protected] |
Guest photo archives go to the event operator, and to an event host when the operator authorises it.
OpenAI is used for the optional AI workflow described above. Routine account administration, billing and support processing is not sent to OpenAI as part of that workflow. Consent to AI processing is not used as a transfer derogation under Article 49(1)(a). The separate existing Telegram arrangement described in the table is not the mechanism used for OpenAI.
6. Deleting your account
The account owner can ask for deletion in the dashboard at api.patifot.app/portal/account/delete. You confirm with your password and a code we send to the account e-mail address. You then have 7 days to cancel the request. When the 7 days are over, deletion starts: we remove your identity and account data, delete the event photos and ask each iPad on the account to erase its copies. An iPad that is offline erases its copies when it next connects, so full completion can take longer. We send an e-mail when the deletion is complete. If a paid subscription is still active, deletion waits until the subscription is cancelled.
We also delete an account that has not been used for 24 months (no sign-in, no linked iPad contacting us, no event, no active plan or trial). We e-mail the owner 30 days and 7 days before; signing in keeps the account. The deletion then follows the steps above.
Invoices and payment records stay for 10 years because accounting law requires it. They remain linked only to a pseudonymised account record, together with a minimal log of the administrative actions and service access on the account that contains no e-mail address. The dates of the deletion request stay with them as proof of the deletion. The deletion journal and the record of the notice shown to guests keep their own deadlines (section 3). Free trial fingerprints and trial records also keep their own deadlines (section 3).
Account deletion covers Patifot's systems and the device-deletion process described above. It does not automatically erase content already retained by OpenAI. Where an applicable request concerns OpenAI processing, Patifot assists the event operator and follows the request through the contractual processing chain. The completion notice must distinguish completion in Patifot's systems from any outstanding provider request or retention exception.
7. Cookies
This website sets no tracking cookies and uses no analytics. The dashboard sets only the cookies it needs to work: one keeps you signed in and one remembers your language. None of them is used for tracking, so we do not show a cookie banner. The Paddle checkout window is run by Paddle, and Paddle's own privacy and cookie notices apply to it.
8. Security
Data travels encrypted (TLS). Access to production systems is restricted and logged, and backup copies stored off the server are encrypted.
9. Your rights
Under the GDPR you can ask to access, correct or delete your data, to restrict its processing or to receive it in a portable format. You can object to processing based on our legitimate interest. Where processing relies on consent, you can withdraw it at any time; this does not affect processing already done. Write to [email protected]: we answer within one month. You can also complain to the CNIL (www.cnil.fr) or to the data protection authority where you live or work.
Event Guests: the event operator named in the booth notice is the controller for your photos. Contact that operator using the details shown. You can withdraw your consent to optional AI processing at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. A completed transfer or physical print cannot be undone, but you can still request applicable erasure and the stopping of further consent-based processing. You can also write to [email protected]; Patifot will pass the request to the operator and help it respond, including where the request concerns OpenAI. Deletion from Patifot's archive does not by itself confirm deletion at OpenAI.
10. Changes
We update this policy when the service changes and show the date of the last change at the top. For material changes that affect operators, we notify them by e-mail.
This policy also exists in French, German and Spanish. The English and French versions are equally authoritative. The German and Spanish versions are translations for convenience; if they differ, the English version prevails.