Privacy Notice
Last updated: September 10, 2026
1. Controller
The controller for the processing described in this notice is:
Philipp Aigner
Mörmoosen 23
84577 Tüssling
Germany
Email: swdev.pa@gmail.com
2. Scope
This notice applies to the photo2calendar.com website, the /appstore redirect page, and the marketing, help and legal pages published on this domain.
The separate iOS app Photo2Calendar is offered by the same operator. If you use the app, the additional information in sections 8 to 10a applies to image processing, purchases, product analytics and ad measurement in the app.
3. Website access and server log data
When you visit the website, our web server and hosting providers process technically necessary connection data such as IP address, date and time of access, requested URL, referrer URL, browser type, operating system and transferred data volume.
We process this data to deliver the website, maintain stability and security, and analyse technical errors. The legal basis is Art. 6(1)(f) GDPR. Recipients may include our hosting and IT service providers where required for the operation of the website.
Log data is kept only for as long as necessary for those purposes. Longer retention may occur where a specific security or misuse incident has to be investigated.
4. Consent management and locally stored preferences
We use a technically necessary consent signal to remember whether you have consented to optional technologies. This allows us to restore your choice on later visits and to avoid loading consent-based services without your decision.
The storage of this preference is based on the equivalent of strictly necessary storage under section 25(2) no. 2 TDDDG and on Art. 6(1)(f) GDPR for documenting your choice.
5. Google Tag Manager and Google Analytics
We use Google Tag Manager and Google Analytics only if you have explicitly consented. Without your consent, these services are not loaded on this website.
Purpose: audience measurement, technical usage analysis and website optimisation.
Legal basis: Art. 6(1)(a) GDPR and section 25(1) TDDDG.
Recipients: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Data categories: online identifiers, cookie IDs, usage data, page views, technical device information and approximate location data. According to Google, IP addresses are not logged or stored in Google Analytics 4.
International transfers: processing in the United States or other countries outside the EEA cannot be ruled out if Google processes data across its group. Google provides additional information at https://policies.google.com/privacy.
Retention: the precise retention period inside Google Analytics depends on the settings of the relevant Google Analytics property. Google documents 2 or 14 months as standard options for event data retention.
Withdrawal: you can withdraw or change your consent at any time for the future by using the “Cookie settings” link in the footer. Where possible, we attempt to delete previously set analytics cookies on this website after a withdrawal. You can also use Google's browser add-on: https://tools.google.com/dlpage/gaoptout.
6. Whop Pixel and conversion tracking
After your explicit consent, we load the Whop Pixel from Whop, Inc., 300 Kent Ave #401, Brooklyn, New York 11249, USA. The pixel records page views and helps us measure whether visitors click a link to download the Photo2Calendar app from the Apple App Store. For this purpose, our website sends the custom event app_store_click.
If you come from a Whop ad and consent to tracking, the Whop Pixel can store the anonymous visitor ID _wuid in your browser. When you click an App Store link, the website can add this value as whop_wuid to the AppsFlyer OneLink. AppsFlyer can pass conversion or deferred deep-link data to the app. The app stores only a validated visitor ID and can send it to RevenueCat as a subscriber attribute. After an eligible paid App Store purchase, RevenueCat sends a server-to-server webhook to our backend. The backend sends only the first eligible purchase event, price, currency and anonymous visitor ID to Whop. It does not send email addresses, phone numbers, calendar images, recognized text, event titles or event details to Whop.
Purpose: campaign attribution, measurement of marketing performance and improvement of our website and app marketing.
Legal basis: Art. 6(1)(a) GDPR and section 25(1) TDDDG.
Data categories: depending on the pixel function, the event name, event time, page URL, referrer URL, clicked-link information, online identifiers and browser, device and network data may be processed. Whop states that its pixels and similar technologies can process IP addresses, unique identifiers and browsing or activity data.
Recipient and international transfer: Whop, Inc., 300 Kent Ave #401, Brooklyn, New York 11249, USA. Whop is headquartered in the United States. Processing or access from the United States or other countries outside the EEA cannot be excluded. Whop states that it uses written data processing or transfer terms and, where required, standard contractual clauses or another approved safeguard. Further information is available in the Whop privacy notice.
Retention and withdrawal: Whop determines its retention period under its privacy notice. You can change or withdraw your consent at any time through the “Cookie settings” link in the footer. After withdrawal, the pixel is not loaded on the next page load and no new match starts. Processing that occurred before withdrawal remains lawful; you can contact Whop about data requests relating to its processing.
7. External links, App Store and redirects
Our website contains links to the Apple App Store and provides a redirect page at /appstore. Once you follow such links, you leave our website and the privacy terms of the relevant third party, for example Apple, apply.
8. Image processing in the separate iOS app
If you use the separate Photo2Calendar iOS app and choose or capture an image there, we process the image content, extracted event details and any event information you confirm or correct in order to provide the requested calendar-conversion or ICS-export feature.
Purpose and legal basis: providing the app feature you requested, based on Art. 6(1)(b) GDPR.
Recipients: we use Google Gemini for image analysis. This may involve transfers to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Storage: we do not intend to keep selected images or generated ICS files longer than technically necessary for the immediate processing workflow. Short-lived caches or technical logs at infrastructure providers cannot be fully ruled out.
9. Purchase validation and RevenueCat in the iOS app
Apple processes App Store payments; we do not receive full payment-card details. We use RevenueCat, Inc. to validate purchases, restore access, manage subscription status and recognize customers who bought an earlier paid version of Photo2Calendar.
Data categories: an anonymous app user identifier, App Store receipt, transaction and product information, subscription status, storefront, original app version, IP address and technical app or device information.
Purpose and legal basis: fulfilling the app-access contract, preventing unauthorized access and preserving eligible lifetime access under Art. 6(1)(b) and, where applicable, Art. 6(1)(f) GDPR.
Recipient and international transfer: RevenueCat, Inc., United States. Processing in the United States may occur. RevenueCat provides details about safeguards, subprocessors and retention in its privacy notice.
10. Product analytics with PostHog in the iOS app
We use PostHog EU Cloud to measure whether app features work and where technical errors occur. PostHog processes an anonymous device identifier, technical app and device data, app lifecycle events, feature actions, and broad error reasons.
We do not send flyer images, shared links, recognized text, event titles, or event details to PostHog. Session replay, screen capture, touch capture, and IP-based location collection are disabled. We do not use this data for advertising or cross-app tracking.
Purpose and legal basis: product analytics, error analysis, and reliable operation of the app under Art. 6(1)(f) GDPR.
Recipient: PostHog, Inc. The project uses PostHog's EU Cloud. More information is available in the PostHog privacy notice.
10a. Ad measurement with Adapty and TikTok in the iOS app
With your permission, we use Adapty to measure our TikTok ads. Adapty can process app and device identifiers, installation data, product and transaction identifiers, subscription status, prices and currencies. Adapty sends trial, purchase and renewal events to TikTok. These events help us measure and improve our ads. We do not send photos, calendar content or recognized text to these services. IP address collection is disabled in the app SDK.
Apple purchase notifications are forwarded through RevenueCat to Adapty. This includes renewals while the app is closed. We require your permission to link this data to TikTok ads. The legal basis for ad measurement is your consent under Art. 6(1)(a) GDPR.
The app asks after its introduction. We also require tracking permission in iOS. Your choice does not change your access to app features. You can withdraw permission in the app under Settings → Ad measurement, or from the purchase screen. The app sends the withdrawal to Adapty when a connection is available. A withdrawal does not delete data already processed. Contact us if you want to request deletion.
Recipients include Adapty Tech Inc., USA, and TikTok. Processing outside the European Economic Area can occur. See the Adapty privacy notice and the TikTok privacy notice for information about processing and data protection.
11. Your rights
Subject to the GDPR, you have the right to access, rectify, erase, restrict processing, data portability, object to processing based on Art. 6(1)(f) GDPR, and withdraw consent with effect for the future.
12. Right to lodge a complaint
You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.
13. Contact
If you have questions about data protection or want to exercise your rights, contact us at swdev.pa@gmail.com. You can also review our German provider notice and our Terms of Service.