Version 1.1, 30 October 2026.
1.1 The controller is Gayane Sargsyan Garniki IE, Yerevan, Republic of Armenia ("Byeselfie", "we"). Contact for privacy questions: hello@byeselfie.com.
1.2 We apply the EU General Data Protection Regulation (GDPR) to the data of people in the EU, and the Law of the Republic of Armenia on Protection of Personal Data.
| Data | Whose | Why we use it | Legal basis (GDPR) |
|---|---|---|---|
| Name, email, sign-in method (email code, or Google if offered), app language, optional profile photo, sign-in sessions | Tourists, Creators | Create and secure your account, log in, send booking messages | Contract (Art. 6(1)(b)) |
| Push notification subscription | Users who turn on notifications | Send booking reminders and messages | Consent (you can turn it off in your device settings) |
| Booking details: package, date, time, group size, meeting point, ideas and reference links, reference images you upload (up to 5 MB), offer terms, extras, start code use, status, cancellations | Tourists, Creators | Make and manage bookings, apply the cancellation rules | Contract |
| Card and booking fee payment: payment provider token, card brand, last 4 digits, expiry date, booking fee, card hold and refund records | Tourists | Take the booking fee, place and release the card hold, give refunds, keep accounting records | Contract; legal obligation for accounting records (Art. 6(1)(c)) |
| In-person payment confirmations (that a payment was made, method, time) | Tourists, Creators | Show both sides what was confirmed, handle payment issues | Contract; legitimate interest in resolving disputes and preventing fraud (Art. 6(1)(f)) |
| In-app chat messages (phone numbers, emails and links to outside contact are hidden automatically) | Tourists, Creators | Let you plan the Shoot; review reports and disputes; safety; keep bookings on the Platform | Contract; legitimate interest in safety, dispute handling and preventing fee avoidance |
| Location point (one GPS point and time from your device, only with your permission) when you enter the start code, report a no-show or a payment issue | Tourists, Creators | Confirm the Shoot started at the agreed place; give proof in no-show and payment disputes | Consent (Art. 6(1)(a)), asked by your device at that moment. You can say no; the Shoot can still go ahead, but we will have less proof in a dispute |
| Location point when you press SOS | Tourists, Creators | Help you and, if needed, emergency services in an emergency | Vital interests (Art. 6(1)(d)), and legitimate interest in user safety (Art. 6(1)(f)) |
| Creator ID document and selfie, checked by our team; afterwards we keep only the result and date | Creators | Verify identity before going live; keep the Platform safe | Legitimate interest in safety and fraud prevention; legal obligation where the law requires us to identify traders or report income |
| Creator profile: name, photo, bio, city, languages, Instagram handle, up to 30 portfolio items, packages, prices, calendar, accepted in-person payment methods, trader/private status | Creators | Show your profile to tourists | Contract |
| Gender, only if you choose to give it | Creators | Let tourists filter for female creators | Consent; you can remove it at any time |
| Reviews and ratings | Tourists and Creators (each can review the other after a Shoot) | Help tourists choose; ranking | Legitimate interest in honest, useful reviews |
| Reliability records: late cancellations, no-shows, warnings | Creators | Apply the reliability and removal rules | Contract; legitimate interest in reliable bookings |
| Reports, support and dispute files | Anyone who contacts us | Answer you, decide on reports, meet our legal duties under the Digital Services Act | Legitimate interest; legal obligation |
| Tax details (only if the law requires us to collect them) | Creators | Report to tax authorities as required by law | Legal obligation |
| Device and usage data: IP address, device type, app version, error logs, essential cookies | All users | Keep the service working and secure, detect fraud | Legitimate interest in security and fraud prevention; necessary for the service |
| Analytics (PostHog): pages viewed, clicks, sign-up and booking steps, device and browser type, approximate location from your IP address, the link you came from; and recordings of how you use the screens (session replay) with everything you type hidden | Users who accept analytics cookies | Understand how the site and app are used and improve them | Consent (see the Cookie Policy). You can withdraw it at any time under "Cookie settings" |
| Marketing emails | Tourists, Creators | Send news and offers | Consent, or for existing customers our legitimate interest with an easy opt-out in every email |
| Public business contact details of possible Creators (name, public handle, public business email or contact page, public work) | People we may invite to join | Invite them once to join Byeselfie as Creators | Legitimate interest (see section 8) |
About analytics. We load PostHog only after you accept analytics cookies. We do not send your name or email to PostHog; it sees only an internal account number. Session replay hides everything you type and the names shown on the screen, and never records the ID check pages or our admin pages. If you reject or withdraw consent, PostHog does not run.
4.1 Between tourist and Creator. When you book, the Creator sees your first name, profile photo, booking details, meeting point and chat. The tourist sees the Creator's public profile and chat. Phone numbers and emails are hidden in the chat.
4.2 Service providers (processors) who work for us under a data processing agreement:
| Provider | Service | Location of data |
|---|---|---|
| DigitalOcean | Hosting and database (servers in Amsterdam) | Netherlands (EU) |
| Resend | Account and booking emails (EU region) | Ireland (EU) |
| PostHog Inc. (EU Cloud) | Website and app analytics and session replay, only with consent | Frankfurt, Germany (EU) |
| OpenFreeMap | Map tiles (your device loads them directly; the provider sees your IP address) | Not stated by the provider; it says it sets no cookies |
| Sign-in, only if offered and you choose it (independent controller for its own accounts) | United States / EU | |
| 4.3 Payment provider. Our card payment provider processes card payments and card holds. For card data it acts as an independent controller under its own privacy policy and banking law. |
4.4 Authorities and courts, when the law requires it, or to protect someone's safety.
4.5 A buyer of our business, if the business is sold, under the same protections.
We do not sell personal data.
Byeselfie is based in Armenia. The European Commission has not decided that Armenia's data protection is adequate. When your data moves from the EU to Armenia or another country without an adequacy decision, we use the European Commission's Standard Contractual Clauses and extra measures such as encryption and access controls. PostHog Inc. is a US company; our PostHog data is stored in the EU, and PostHog's data processing agreement includes the Standard Contractual Clauses for any access from outside the EU. You can ask us for a copy at hello@byeselfie.com.
| Data | How long |
|---|---|
| Account data | While your account is open. When you delete your account, we anonymise your profile and delete your cards and sessions at once, except what we must keep below |
| Sign-in codes and sessions | Deleted daily when expired |
| Bookings, payment confirmations, chat text | 2 years after the Shoot date, then deleted or anonymised; longer only while a dispute or legal claim is open |
| Reference photos sent in the chat | 180 days |
| Copies of emails we sent you | Content deleted after 30 days |
| Location points (start code, no-show, payment issue, SOS) | 90 days after the Shoot, or until a dispute or safety case about that Shoot is closed |
| ID document images and selfie | Deleted right after the verification decision. We keep the result (verified yes/no, date, provider reference) while the profile exists and 1 year after |
| Reliability records and warnings | 12 months, used for the 90-day rules and repeated problems |
| Booking fee payment records and invoices | 5 years, or as long as accounting and tax law requires |
| Reports, disputes and decisions (including under the Digital Services Act) | 2 years after the case is closed |
| Removed or banned users: minimum data to stop re-registration | 3 years |
| Possible Creator contacts who did not join | 12 months after our last message. If you ask us not to contact you, we delete your data and keep only your email or handle on a do-not-contact list |
| Analytics data | 1 year |
You can ask us to:
Write to hello@byeselfie.com or use the privacy settings in the app. We reply within one month. We may ask you to confirm your identity.
Decisions with legal or similar effects. Ranking is automatic. Before we remove a Creator under the reliability rules, a person checks the records. You can always ask for a person to review a decision.
Complaints. You can complain to the data protection authority where you live or work, for example the Garante per la protezione dei dati personali (Italy), the CNIL (France), the AEPD (Spain), the CNPD (Portugal), the Autoriteit Persoonsgegevens (Netherlands), the ÚOOÚ (Czechia), the ICO (United Kingdom), or the Personal Data Protection Agency of the Republic of Armenia.
8.1 Before launch and after it, we look for local photographers and reel makers in our cities. We use only information that people publish for business: their public profile or website, public work, and the business contact they list publicly. We do not buy lists.
8.2 We may write to you once to invite you, and follow up at most twice. Every message says who we are and how to stop messages. If you say no, we stop at once.
8.3 Legal basis: our legitimate interest in inviting professionals to offer their services. You can object at any time.
Byeselfie is for adults (18+). Children can appear in a Shoot only with their parent or guardian. We do not receive Shoot content, so we do not process images of children from Shoots.
We use encryption in transit, access controls, and limited staff access. If a data breach is likely to put you at risk, we tell you and the authorities as the law requires.
We will tell you about important changes in the app or by email before they apply.
Version: 1.1, 30 October 2026 (analytics added).