Privacy Policy

Your Privacy Matters

OccasionPack (“OccasionPack”, “we”, “us”, or “our”) creates personalised digital content for special occasions, including event invite videos, using photographs, information and creative preferences provided by our customers.

We understand that the content you share with us may include personal and family photographs, including photographs of children. Protecting this information is a core part of how OccasionPack is designed.

This Privacy Policy explains what information we collect, why we process it, how long we keep it, and the choices available to you.

1. Who We Are

OccasionPack is operated by:

Triangel Systems OÜ
Registry code: 17566651
Harju maakond
Estonia

Privacy contact: info@occasionpack.com

For users in the European Economic Area and the United Kingdom, Triangel Systems OÜ is the controller of personal data processed through OccasionPack, except where otherwise stated.

For users in the United Kingdom, we have appointed a representative under Article 27 of the UK GDPR. UK individuals and the Information Commissioner’s Office (ICO) can contact our UK representative, via info@occasionpack.com, about any data protection matter.

For users in Canada, the person responsible for our compliance with applicable privacy law can be reached at info@occasionpack.com.

2. Who May Use OccasionPack

OccasionPack is intended for adults aged 18 or older.

Our service is not directed at children and children may not create accounts, place orders or upload photographs themselves.

A parent, legal guardian or another authorised adult may use OccasionPack to create personalised content featuring people younger than 18.

3. Information We Collect

Personal Information

When you create an account or use our services, we may collect:

• Email address
• Name (if provided)
• Order ID
• Order information and payment status

All purchases are made through Stripe Technologies Europe Ltd, which acts as merchant of record. Stripe collects your card and billing details and handles VAT or sales tax for your country. We never receive or store your full card number. Stripe shares with us only what we need to deliver your order, such as your name, email address, country and payment status.

Content You Upload

To provide our service, we collect:

• Photos and images you upload
• Occasion details, such as a name, age, date or celebration type
• Descriptions, interests, themes and creative preferences
• Style preferences and selections
• Generated invite videos, images and other digital assets
• Ratings and feedback you provide

Automatically Collected Information

We automatically collect certain information when you use our service:

• Log files and analytics data: order creation related data
• If you accept marketing cookies: page visits, IP address and browser information collected by the Meta, TikTok and Pinterest tags (see section 16)

Other Information

• Customer support communications
• Consent and privacy preference records

4. Photographs of Other People

You may only upload photographs or other media that you have the right to use. The rules for uploading photographs of other people, including children, are set out in our Terms of Service and Content Policy.

5. How We Use Your Information

Service Delivery

Process your photos to generate event invite videos and images.

Download Manager

Manage your orders together with our merchant of record, and provide customer support.

Service Improvement

Anonymised analysis of usage patterns to improve our service quality and user experience.

Communication

Send service updates, order confirmations, and respond to your inquiries.

Safety and Legal Compliance

Prevent fraud and misuse, enforce our Terms, meet other legal obligations and keep accounting and tax records.

6. How We Use Uploaded Photographs

Photographs uploaded to OccasionPack are used to provide the service you requested, including creating personalised invite videos, images, invitations and other selected occasion assets.

We may need to transmit uploaded media to AI generation and infrastructure providers acting on our behalf in order to produce your content.

• OccasionPack does not sell your private photographs.
• We do not publish your private photographs or creations in a public gallery by default.
• We do not use private customer photographs in OccasionPack marketing unless you have separately and explicitly agreed to this.
• OccasionPack does not train AI models and does not use customer photographs to train its own models.

Our AI generation provider may use the photographs, prompts, event details and generated content it receives to train and improve its own AI models and algorithms, under its own privacy policy. Content that has already been used to train a model cannot be removed from that model. If you delete your content or account, it will not be used for further training. See section 10 for details.

7. Legal Bases for Processing

Where the EU GDPR or the UK GDPR applies, we process personal data only where we have an appropriate legal basis. Depending on the activity, this may include:

• performing our contract with you;
• your consent;
• compliance with legal obligations;
• our legitimate interests in securely operating, improving and protecting the service, where those interests do not override your rights.

Legal basis by purpose

Purpose	Legal basis
Creating your invite videos and other ordered content	Performance of contract
Account management, payments and customer support	Performance of contract
Sharing order details with Stripe as merchant of record	Performance of contract
Accounting, tax and fraud-prevention records	Legal obligation
Security, service improvement and aggregated analytics	Legitimate interests
Cookieless, aggregated website statistics	Legitimate interests
Marketing cookies (Meta Pixel, TikTok Pixel, Pinterest Tag), only after you accept marketing cookies	Consent
Marketing emails	Consent, or legitimate interests for similar products you have bought, where permitted by law
Featuring your creation in our marketing	Consent
Content safety review and misuse prevention	Legitimate interests in protecting people and the service; legal obligation where reporting is required

Where consent is the applicable legal basis, you may withdraw it as provided by applicable law.

8. AI Processing

OccasionPack uses artificial intelligence services to create personalised content. This may involve processing:

• uploaded photographs;
• reference images;
• prompts and creative instructions;
• generated images and videos.

We select AI providers with the aim of ensuring appropriate privacy, security and data-processing safeguards.

Where customer content is processed by third-party AI providers, we seek contractual and technical safeguards governing permitted use, retention, deletion and confidentiality of that content. How our AI generation provider may also use content for its own purposes is described in sections 6 and 10.

Automated decision-making

We do not use your personal information for automated decisions that produce legal or similarly significant effects on you. AI is used only to generate the creative content you request.

9. Facial and Biometric Information

OccasionPack does not operate a facial-recognition service and does not use customer photographs to identify people across different customers or external databases.

We do not intentionally maintain a persistent database of facial templates or biometric identifiers for identification purposes.

Our AI generation provider may analyse facial characteristics transiently in order to preserve a person’s appearance in generated content. It does not store them as biometric data.

We do not create or process biometric data for the purpose of uniquely identifying a person. We do not run face matching, do not compare faces between customers or against other sources, and do not store facial templates or face embeddings. This means we do not process special category data within the meaning of Article 9 of the EU GDPR or the UK GDPR when we create your content.

Photographs can incidentally show characteristics such as ethnic origin, religious clothing or a health condition. We do not use your photographs to identify, infer or record any of these characteristics.

We do not sell, lease, trade or otherwise profit from any biometric identifiers or biometric information.

10. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties.

We do not “sell” personal information as that term is defined under California and other US state privacy laws. If you accept marketing cookies, the Meta, TikTok and Pinterest tags described in section 16 pass limited browsing information to those platforms for advertising measurement, which some US state laws treat as “sharing” for cross-context behavioural advertising. You can refuse or withdraw this at any time through the cookie settings on our website.

We may share your information only in the following limited circumstances:

Service Providers

We work with trusted third-party service providers who assist us in operating our service:

• AI generation: Image and video generation (photos are processed securely; see “AI Generation Provider” below)
• Cloud hosting and storage: Secure file storage and backup
• Communications: Email and customer support tools
• Analytics and Security: Service monitoring, fraud prevention and cookieless website analytics
• Advertising measurement: Meta Platforms (Meta Pixel), TikTok (TikTok Pixel) and Pinterest (Pinterest Tag), only after you accept marketing cookies (see section 16)

Providers are listed by category. Our hosting, storage, communications and analytics providers act on our instructions under data processing agreements. Meta Platforms, TikTok and Pinterest are independent controllers of the information their tags collect, under their own privacy policies.

AI Generation Provider

Our AI generation provider creates your images and videos from the photographs, prompts and event details you provide. It is based in the United States and may use service providers in other countries. In addition to generating your order, it may use this content to train and improve its own AI models and algorithms. For that purpose it acts under its own privacy policy, not on our behalf. Its handling of facial characteristics is described in section 9.

Merchant of Record

Stripe Technologies Europe Ltd acts as merchant of record for all purchases. It processes payment, billing, tax and fraud-prevention data as an independent controller under its own privacy policy, not on our behalf. We share order details with Stripe, and Stripe shares payment status and the details listed in section 3 with us.

You can ask us which providers receive your personal data, including the identity and privacy policy of our AI generation provider, by contacting info@occasionpack.com.

Legal Requirements

We may disclose your information if required by law or to protect our rights and the safety of our users.

Business Transfers

In the event of a merger, acquisition, or sale of assets, user information may be transferred as part of the transaction.

11. International Data Transfers

We host our website, database and file storage in the European Union where our providers allow it. Some providers, including AI generation services, may process information outside the European Economic Area and the United Kingdom, including in the United States and other countries where our AI generation provider and its service providers operate.

Where required, we use appropriate mechanisms for international transfers of personal data, such as adequacy decisions or approved contractual safeguards.

For transfers from the EEA, these safeguards include the EU–US Data Privacy Framework where the recipient is certified, or the European Commission’s Standard Contractual Clauses. For transfers from the UK, they include UK adequacy regulations (which cover the EEA), the UK Extension to the EU–US Data Privacy Framework where the recipient is certified, or the UK International Data Transfer Agreement or UK Addendum to the Standard Contractual Clauses. If you are in Australia or Canada, your information may be disclosed to recipients in the European Union and the United States; we take reasonable steps to ensure those recipients protect it to a comparable standard. You may request more information about these safeguards at info@occasionpack.com.

12. Data Security

We implement industry-standard security measures to protect your information:

Encryption

All data transmitted to and from our servers is encrypted using SSL/TLS protocols.

Secure Storage

Photos and generated files are kept in private storage. You download them through personal, time-limited links. Database access is restricted to the records each account is allowed to see.

Access Controls

Employee access to your data is limited to those who need it to provide our services.

Regular Updates

We regularly update our security measures and monitor for potential vulnerabilities.

Data Breaches

If a personal data breach occurs, we will notify the competent supervisory authority and affected users where required by law, within the timeframes that law sets.

No internet service can guarantee absolute security, but we design OccasionPack around collecting and retaining as little sensitive customer content as reasonably necessary.

13. Data Retention

We follow a data-minimisation approach and aim to keep personal media only for as long as reasonably necessary to provide the service.

Account Data

We retain your account information for as long as your account is active or as needed to provide services.

Original Uploaded Photographs

We delete the uploaded photographs once all the assets associated with your order have been generated and made available to you. If the assets need to be re-generated then the photographs need to uploaded once again by the customer.

Generated Content

Up to 90 days after completion of the relevant order, unless you delete it earlier or choose an available longer-storage option.

Order and Legal Records

Order, transaction and legally required records are retained for the period required by applicable accounting, tax, fraud-prevention and other legal obligations. Stripe, as merchant of record, keeps its own payment and tax records under its privacy policy.

Analytics Data

Anonymized usage data may be retained for up to 2 years for service improvement purposes.

Where technically feasible, expired customer media is automatically deleted. Backups and service-provider systems may require a limited additional period before deletion is fully propagated; our AI generation provider may keep deleted content on its active servers for up to 30 days and in backups after that. Content already used to train an AI model cannot be removed from that model.

14. Marketing Use of Your Creations

Purchasing an OccasionPack product does not give us permission to use your photographs or personalised creations in advertising.

If we would like to feature your creation on our website, social media, advertising or examples, we will request separate permission.

Marketing permission is optional and is not required to purchase or use OccasionPack. You may withdraw such permission for future use by contacting us.

We keep marketing data, such as newsletter subscriptions and marketing preferences, separate from the data we use to create your products, such as your photographs, event details and generated content. We never use your photographs, event details or creations to build advertising audiences, and we never share them with advertising or social media platforms.

15. Your Rights and Choices

You have the following rights regarding your personal information:

Access and Portability

Request a copy of your personal data in a portable format

Correction

Update or correct inaccurate personal information

Deletion

Request deletion of your personal data (subject to legal requirements). Content already used by our AI generation provider to train a model cannot be removed from that model.

Opt-out

Unsubscribe from marketing communications at any time

Restriction and Objection

Restrict or object to certain processing, including processing based on legitimate interests

Withdraw Consent

Withdraw consent at any time where processing relies on consent, without affecting earlier processing

Complaint

Lodge a complaint with an applicable data-protection authority

To exercise these rights, please contact us at info@occasionpack.com with your request and account information. For payment and tax data held by Stripe as merchant of record, you can also contact Stripe directly; we will help you with that request.

We may need to verify your identity before completing certain requests.

We respond within one month in the EEA and the UK, and within 45 days under US state privacy laws. We may extend these periods where the law allows and will tell you if we do. We will not discriminate against you for exercising your rights.

European Economic Area

Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). You may also complain to the authority in the country where you live or work.

United Kingdom

You may complain to the Information Commissioner’s Office (ICO) at ico.org.uk. You can also contact our UK representative, as described in section 1, about any data protection matter.

United States

Residents of California and other states with privacy laws may have the right to know what personal information we collect, use and disclose; to delete and correct it; and to opt out of sale, sharing or targeted advertising. We do not sell personal information, and we share browsing information with Meta Platforms, TikTok and Pinterest only if you accept marketing cookies; you can opt out at any time through the cookie settings on our website. We do not use sensitive personal information to infer characteristics about you. We honour Global Privacy Control signals. You may use an authorised agent, and you may appeal a decision on your request by replying to our response.

Canada

You may access and correct your personal information and withdraw consent, subject to legal or contractual restrictions. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.

Australia

You may access and correct your personal information under the Australian Privacy Principles. Please contact us first; we aim to respond within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

16. Cookies and Tracking Technologies

We use cookies and similar technologies in two groups.

Strictly necessary cookies run OccasionPack and do not need your consent:

• Keep you signed in to your account
• Remember your cart and order while you create your pack
• Protect payments against fraud (set by Stripe, our merchant of record, during checkout)
• Remember your cookie choice (set by our own cookie banner)

Marketing cookies are set only if you accept them in the cookie banner. We use the Meta Pixel (Meta Platforms Ireland Ltd), the TikTok Pixel (TikTok Technology Ltd) and the Pinterest Tag (Pinterest Europe Ltd) to measure whether our advertising on Facebook, Instagram, TikTok and Pinterest brings visitors to our website. When active, each records that you visited a page, together with your IP address and browser information, and may set cookies in your browser. With the same marketing consent, we also send TikTok product views, checkout starts and confirmed purchases (pack identifier, quantity, currency and amount), browser information and a TikTok cookie identifier through its Pixel and Events API. An opaque event identifier prevents duplicate counting. We do not pass your name, email address, photographs, event details or creations to Meta, TikTok or Pinterest. Each may combine this information with your account on its platform under its own privacy policy and may transfer it outside the EEA, including to the United States, under the safeguards described in section 11.

Our website analytics do not use cookies, do not collect personal data and do not track you across other websites. We see only aggregated statistics, such as page views and referring sites.

The cookie banner asks for your consent before any marketing cookie is set, as required by EU and UK law. You can refuse, change or withdraw your choice at any time through “Cookie settings” in the footer of our website. The full list of cookies is shown at the end of this page. You can also control cookies through your browser settings, but blocking strictly necessary cookies may stop the service from working.

17. Third-Party Services

The categories of third-party providers we use, including our AI generation provider and our merchant of record, are described in section 10. Payments, including Apple Pay and Google Pay, are subject to Stripe’s own privacy policy and terms.

18. AI-Generated Content

Content produced by OccasionPack is generated or modified using artificial intelligence.

Where required by applicable law, OccasionPack will provide appropriate disclosures or technical markings indicating that content was generated or modified using AI.

AI-generated results may contain inaccuracies or unexpected visual details. Customers should review generated content before sharing or publishing it.

19. Prohibited Uses and Content Safety

What you may and may not upload, enter or create with OccasionPack is set out in our Content Policy, which forms part of our Terms of Service.

We may reject or remove content and suspend access where reasonably necessary to protect individuals, comply with law or enforce our Terms and Content Policy.

Content Safety Review

To prevent misuse, we check uploaded photographs, prompts, occasion details and generated content with automated filters and, where needed, human review. Reviewers see only what is necessary to assess a flagged item. We keep records of flagged content and enforcement decisions for as long as needed to handle the case, respond to appeals and meet legal obligations. Content that appears to involve child sexual abuse or exploitation is reported to the competent authorities.

20. Children’s Privacy

Age Requirement

As set out in section 2, our service is intended for adults aged 18 or older. We do not knowingly collect personal information directly from children. If you believe a child has provided us with personal information, please contact us immediately and we will delete it.

Photographs of children uploaded by a parent, legal guardian or authorised adult are processed to create the requested content and are deleted in line with section 13. Our AI generation provider may also use them to train its AI models, as described in section 6.

21. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Privacy Inquiries

info@occasionpack.com

General Support

support@occasionpack.com

Company Details

Triangel Systems OÜ
Registry code: 17566651
Harju maakond
Estonia

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify users of significant changes via email or through our service.

The latest version and effective date will always be available at occasionpack.com.

Last updated: October 2026 · Effective date: 08.10.2026

OccasionPack (occasionpack.com) is a brand of:

Triangel Systems OÜ
Registry code: 17566651
Harju maakond
Estonia

Contact: info@occasionpack.com