Privacy policy — ZAFA

1. The ZAFA app (team)

The app is for the ZAFA team (admin and photographers) on iPhone, iPad, Mac, Android and Windows. It uses:

• Account details: name, email, phone number, team role and language — entered by the admin. Your password is stored only as a one-way hash that nobody can read.
• Work data: the events assigned to you (number and name, date and time, place and map link, the groom’s name and instructions), your replies, notes, tasks, your busy days, and your fees and payments.
• The «I’ve arrived» button: when you tap it we record only the time and whether you tapped it from the notification or the app. We never collect or store your location — the app does not ask for location permission.
• Photos and videos you upload: only the files you choose yourself from your photo library, camera or computer; they are stored in ZAFA’s own archive for that event together with the file name, size, upload time and who uploaded it.
• Devices and notifications: your device’s push notification token, device type and name, app version, and the sign-in key of the app, widget and Apple Watch (stored hashed) with its last-used time.
• Face ID / fingerprint: handled entirely on your device; we never receive any biometric data.

2. Wedding galleries, invitation cards and the guestbook

• Gallery: a private link for each groom with the photos and videos of his wedding, protected by a password where needed (stored encrypted). We keep the groom’s name and the wedding date, the number of visits and the last visit time, and the favourites he picks. Galleries close after a set period.
• Invitation card: the details the groom enters (his name, his father’s and the bride’s father’s names, the occasion, day, date, time, place and notes), the photos he picks, and the finished designs.
• Guestbook: the guest’s name, relation, message and card style. To prevent duplicates and spam we keep a signed cookie on the guest’s device and a one-way code derived from the connection (not the IP address itself).

3. Live streaming

Some weddings are streamed live by agreement with the client. The event’s video and sound go to YouTube (Google) as an «Unlisted» stream that only people with the link can watch, and it may appear in the client’s gallery through youtube-nocookie.com. The stream key is stored encrypted, and the small preview pictures the hall computer sends to the admin are kept only temporarily in server memory and never saved.

4. Website visits

On the public page zafabh.com we count visits and button clicks per day. Unique visitors are counted with a one-way daily code made from the IP address and browser, and that code is erased at the end of each day; only the daily totals are kept. We use no cookies for statistics and no third-party analytics or advertising tools. The server may keep short technical logs (such as IP address and request time) for security and troubleshooting.

5. Cookies and on-device storage

We use only necessary cookies:

• the sign-in cookie of the team area, and the language cookie;
• ZAFA app cookies inside its pages (that the page is open in the app, and light or dark mode);
• gallery cookies: unlocking with the password, preview links, and the device that wrote a guestbook message.

On your device we also keep small preferences (such as the last tab you opened). There are no advertising or tracking cookies.

6. Why we use the data and the legal basis

• To provide the service and perform our agreements with clients and the team: planning and assigning events, uploading and delivering photos and videos, designing invitation cards and live streaming.
• Legitimate interests: protecting accounts and preventing misuse, anonymous daily statistics to improve the website, and internal accounting.
• Legal obligations: keeping financial records.
• Your consent: notifications (you can turn them off in your device settings), photo access, and live streaming agreed with the client.

7. What we never do

• No ads in the app or the galleries.
• We do not sell your data or share it for marketing.
• We do not track you across other apps or websites.

8. Who it is shared with

The data is kept on ZAFA’s own servers in the Kingdom of Bahrain. We share it only with the following, and only as much as needed:

• Apple Push Notification service (Apple devices) and Google Firebase Cloud Messaging (Android): only the notification text and the device token.
• YouTube (Google): the video and sound of live streams.
• Our email provider: for team emails, when email is used.
• Inside the studio: the admin sees team and event data; a photographer sees only his own events and the names of the team on them, and of the invitation card only the occasion, the groom’s name, day, date, time and place.
• Authorities: only when the law requires it.

Apple, Google and YouTube may process data outside Bahrain under their own policies.

9. How long we keep data

• Team account data: while the account is active; deleted within 30 days of a confirmed deletion request.
• Financial records: for as long as the law requires.
• Notifications: up to 120 days.
• Sign-in keys: expire after 90 days without use; device registrations are removed at sign-out or within 30 days after they stop working.
• Website statistics: the visitor code is erased at the end of the day; daily totals are kept for up to two years.
• Event photos and videos: part of the client’s archive as agreed with the client; galleries are open for a set period.
• Account deletion requests: we keep a record of the request and when it was handled.
• Backups: rotate automatically within about 45 days.

10. Security

All connections are encrypted (HTTPS); passwords and sign-in keys are stored as one-way hashes; stream keys are encrypted; access depends on your role (photographers cannot reach admin pages); and repeated wrong sign-ins are locked for a while. No system is 100% secure, but we do our part and will tell those affected if something happens.

11. Your rights

You can ask for a copy of your data, its correction or deletion, object to or restrict its use, and withdraw your consent (for example by turning notifications off) at any time. Clients can also ask for a gallery, a guestbook message or a stream recording to be removed. You may also complain to the Personal Data Protection Authority of the Kingdom of Bahrain.

12. Account deletion

Ask for your account to be deleted inside the app (My account → Request account deletion) or on the Account deletion page. Once we confirm the request is yours we delete the account and its data within 30 days, except accounting records we must keep by law.

13. Children

The app is for adult team members and the galleries are for clients; we do not knowingly collect data from children. Photos from a client’s event that show children are part of the client’s archive and are treated with the same confidentiality.

14. Changes to this policy

We may update this policy; the date of the last update is shown at the top, and important changes are announced in the app or on the website.

15. Contact us

For any privacy question or to exercise your rights:

• Studio ZAFA Photography Studio — Kingdom of Bahrain
• WhatsApp +97337099307
• Instagram @zafabh
• Website zafabh.com