Security & Media Storage
How Photo Poodle keeps your guests' photos and videos safe — from upload to download.
Two-tier media storage
Every photo or video uploaded to Photo Poodle is stored in two forms. Full-resolution originals are written to private, access-controlled storage and are never publicly reachable by URL. Compressed display versions (thumbnails and medium-resolution previews) are served through a content delivery network (CDN) for fast, reliable loading during your event.
Signed URLs for original downloads
When a guest or event owner requests a download of an original file, the server generates a time-limited signed URL on the fly. This URL is cryptographically tied to the specific file and expires after a short window (5 minutes by default). No permanent, guessable link to your originals ever exists.
Memory Album password protection
Event owners can set an optional password on the Memory Album. Only visitors who enter the correct password can view or download photos. The password is stored securely and is never exposed in the URL or any public endpoint.
Moderation & visibility controls
Event owners control what appears on the Photo Wall through an optional moderation queue — photos only go live once explicitly approved. Individual photos can also be hidden from the guest gallery at any time without deleting them.
Infrastructure & data residency
Photo Poodle is built on the Base44 cloud platform, which runs on enterprise-grade cloud infrastructure. All data is encrypted at rest and in transit using industry-standard TLS encryption. Media files are stored with redundancy to prevent data loss.
Storage retention & expiry
Storage retention is tied to your subscription. When a storage expiry date is set on an event, media associated with that event is automatically removed at the scheduled time. You will always know how long your data is kept.
GDPR compliance
As a company registered in Estonia (EU), Photo Poodle complies with the General Data Protection Regulation (GDPR). We process personal data only on a lawful basis, honour all data subject rights (access, rectification, erasure, portability, and objection), and provide clear information about how your data is used in our Privacy Policy.
Breach notification
In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, as required by GDPR Article 33. If the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.
Data Processing Agreements
We maintain Data Processing Agreements (DPAs) with our key sub-processors, including our hosting provider and payment processor (Stripe). Organisations requiring a DPA for their own compliance (e.g. Pack Leader customers acting as data controllers for guest data) can request one by contacting support.
Quick summary
- ✓Full-resolution originals stored in private, non-public storage
- ✓Time-limited signed URLs for all original file access
- ✓Display media served via CDN with TLS encryption in transit
- ✓Optional album password protection per event
- ✓Moderation controls — you decide what guests see
- ✓Automatic media expiry aligned to your subscription
Questions about security? Contact us at support@photopoodle.com
Last updated: August 14, 2026