Cookies

About this policy: This Cookie Policy explains what cookies are, which cookies alby Online Ltd uses on the alby platform and website, why we use them, and how you can manage your preferences. It applies to all visitors to www.alby.com and to the alby platform itself, including event Hosts and Contributors who access a Host’s album via a shared link or QR code.

1. What Are Cookies?

Cookies are small text files that are placed on your device (computer, smartphone, or tablet) when you visit a website or use an online service. They are widely used to make websites and applications work more effectively, to remember your preferences, and to provide information to the operators of those services.

Cookies can be:

• First-party cookies — set directly by alby when you visit our platform or website;

• Third-party cookies — set by third-party organisations (such as analytics or advertising providers) whose services we use.

Cookies can also be categorised by how long they last:

• Session cookies: temporary cookies that expire when you close your browser;

• Persistent cookies: cookies that remain on your device for a set period of time, or until you delete them.

2. How We Use Cookies

We use cookies and similar technologies (such as local storage, pixels, and device fingerprinting) for the following purposes:

• To operate the platform: certain cookies are strictly necessary for the platform to function. Without them, services such as logging in, accessing a password-protected album, or uploading media would not work.

• To remember your session: so that returning visitors — including Contributors who have previously accessed an album — do not need to re-enter their name and access details on the same device.

• To understand how the platform is used: we use analytics tools to measure traffic, page performance, and feature usage, which helps us improve the product.

• To deliver and measure advertising: we use advertising and retargeting technologies to show relevant alby adverts to people who have visited our website or platform, including on third-party platforms such as Google, Meta (Facebook and Instagram), and others. These technologies enable us to measure the effectiveness of our marketing campaigns.

3. Cookies We Use

The table below sets out the main categories of cookies used on the alby platform and website. Specific cookie names and durations may change over time as our technology partners update their services.

3.1 Strictly Necessary Cookies

These cookies are essential for the platform to function and cannot be switched off. They do not require your consent.

alby_session — Maintains your authenticated session as a Host. Expires at the end of your browser session.

alby_guest_token — Maintains your contributor session when accessing an album without a full account. Stores your display name and session state so you do not need to re-enter details on the same device. Persistent, up to 30 days.

alby_csrf — Cross-site request forgery protection token. Session cookie.

alby_consent — Records your cookie consent preferences. Persistent, 12 months.

alby_pw_auth — Records that you have successfully entered a password for a password-protected album. Persistent for the duration of the album’s active period, up to 90 days.

3.2 Functional Cookies

These cookies enhance the functionality of the platform and remember choices you have made. They are not strictly necessary but improve your experience. You can disable them but some features may not work as intended.

alby_prefs — Stores your display preferences such as gallery view mode (grid or list) and slideshow settings. Persistent, 90 days.

alby_locale — Stores your language and timezone settings. Persistent, 12 months.

alby_upload_queue — Local storage entry (not a cookie) that preserves your upload queue state if your connection drops or you navigate away. Cleared on successful upload completion.

3.3 Analytics and Performance Cookies

These cookies help us understand how visitors use the platform so we can improve it. The data collected is aggregated and, where possible, anonymised. We use the following analytics providers:

Google Analytics (_ga, _gid, _gat) — Set by Google Analytics. Used to distinguish users, throttle request rates, and collect information about how visitors use our site. Data is aggregated and not linked to personal identity. We have enabled IP anonymisation. Persistent, up to 2 years. Google’s privacy policy: policies.google.com/privacy.

Hotjar (_hjSession, _hjid) — Set by Hotjar. Used for session recording and heatmaps to help us understand user behaviour on the platform. Hotjar does not track users across sites not using Hotjar. Persistent, up to 12 months. Hotjar’s privacy policy: hotjar.com/legal/privacy-policy.

3.4 Advertising and Retargeting Cookies

We use advertising cookies to serve alby adverts to people who have previously visited our website or platform, and to measure the performance of our marketing campaigns. These cookies are set by third-party advertising platforms and may track your activity across other websites.

These cookies apply to:

• Visitors to www.alby.com — including prospective Hosts browsing our marketing site;

• Contributors who access a Host’s album via a link or QR code — by visiting an alby-hosted album URL, you are visiting a page served by alby, and our advertising and analytics technologies operate on those pages. If you have consented to advertising cookies, you may subsequently see alby adverts on other platforms.

Google Ads / Google Tag Manager (_gcl_au, _gac_*) — Used to measure the effectiveness of our Google advertising campaigns and to enable conversion tracking and remarketing. Persistent, up to 90 days. Google’s advertising privacy policy: policies.google.com/technologies/ads.

Meta Pixel (_fbp, _fbc) — Set by Meta Platforms (Facebook/Instagram). Used to measure the effectiveness of alby’s advertising on Meta platforms, to build Custom Audiences, and to serve retargeted adverts to platform visitors on Facebook and Instagram. Persistent, up to 90 days. Meta’s data policy: facebook.com/privacy/policy.

TikTok Pixel (_ttp, tt_pixel_session_index) — Set by TikTok. Used to measure campaign performance and deliver retargeted adverts on TikTok. Persistent, up to 13 months. TikTok’s privacy policy: tiktok.com/legal/privacy-policy.

LinkedIn Insight Tag (li_sugr, UserMatchHistory, AnalyticsSyncHistory, lidc, bcookie) — Set by LinkedIn. Used to track conversions, retarget website visitors, and gather insights about our LinkedIn campaigns. This may be relevant if we run campaigns targeting event planners, photographers, or corporate event managers. Persistent, up to 12 months. LinkedIn’s privacy policy: linkedin.com/legal/privacy-policy.

Pinterest Tag (_pinterest_ct_ua, _pin_unauth) — Set by Pinterest. Used to track conversions and deliver retargeted adverts. Persistent, up to 12 months.

Note for Contributors: If you access a Host’s alby album via a shared link or QR code, you are visiting a webpage served by alby. If you consent to advertising cookies, alby’s advertising partners may set cookies that could result in you seeing alby adverts on other platforms. We do not share your name or any personal data you provide to the Host’s album with our advertising partners; the information shared is limited to browsing and interaction signals.

3.5 Similar Technologies

In addition to cookies, we may use the following similar technologies:

• Local storage and session storage: browser-based storage used to maintain upload queue state and display preferences. This data is stored on your device and is not transmitted to our servers except as part of normal platform operation.

• Pixels and web beacons: invisible 1x1 pixel images embedded in pages or emails that allow us and our advertising partners to confirm that a page has been loaded or an email has been opened. These are used in conjunction with advertising cookies to measure campaign reach.

• Device fingerprinting: some of our third-party analytics partners may collect device-level information (such as screen resolution, browser type, and installed fonts) to help distinguish between users without setting cookies. We use this only in aggregate for analytics purposes.

4. Your Choices and Cookie Preferences

Except for strictly necessary cookies, you can choose which cookies you consent to. You can manage your preferences in the following ways:

4.1 Our Cookie Consent Tool

When you first visit the alby website or platform, you will be shown a cookie consent banner. You can choose to accept all cookies, accept only certain categories, or reject all non-essential cookies. You can change your preferences at any time by clicking “Cookie Settings” in the footer of our website.

4.2 Browser Settings

Most browsers allow you to control cookies through their settings. You can set your browser to refuse all cookies, accept only first-party cookies, or delete cookies after each session. Note that disabling cookies may affect your ability to use certain features of the platform — for example, you may not be able to maintain a session as a Contributor or as a Host.

Browser-specific guidance:

• Google Chrome: Settings → Privacy and Security → Cookies and other site data

• Safari: Preferences → Privacy → Manage Website Data

• Firefox: Settings → Privacy & Security → Cookies and Site Data

• Microsoft Edge: Settings → Cookies and site permissions

4.3 Opting Out of Advertising and Retargeting

You can opt out of interest-based advertising from specific providers using the following tools:

• Google: adssettings.google.com

• Meta (Facebook and Instagram): facebook.com/adpreferences

• TikTok: tiktok.com/settings (Ads → Ad Personalisation)

• LinkedIn: linkedin.com/psettings/advertising

• Network Advertising Initiative opt-out: optout.networkadvertising.org

• Your Online Choices (EU/UK): youronlinechoices.eu

Please note that opting out of targeted advertising does not mean you will stop seeing adverts altogether — it means the adverts you see will be less tailored to your interests.

4.4 Do Not Track

Some browsers transmit a “Do Not Track” signal to websites. There is currently no universally agreed standard for how websites should respond to this signal. alby does not currently respond to Do Not Track signals, but you can use the tools in Sections 4.2 and 4.3 to manage your preferences.

5. Legal Basis for Cookie Processing

We process personal data collected through cookies on the following legal bases under UK GDPR and, where applicable, EU GDPR:

• Strictly necessary cookies: processed on the basis of contract (necessary to provide the service you have requested) and legitimate interests (platform security and session management). These do not require consent.

• Functional, analytics, and advertising cookies: processed on the basis of your consent (UK GDPR Article 6(1)(a)), given through our cookie consent tool. You can withdraw consent at any time by updating your cookie preferences.

For users in the EEA, we comply with the requirements of the ePrivacy Directive (implemented in the UK via the Privacy and Electronic Communications Regulations 2003, as amended) and the EU ePrivacy framework.

6. Third-Party Cookies and Data Sharing

Some cookies described in this policy are set by third-party organisations. These organisations have their own privacy and cookie policies, and alby is not responsible for how they use data collected through their cookies. We encourage you to review the privacy policies of our key third-party partners, linked in Section 3.4.

We do not sell cookie data or browsing data to third parties. Data shared with our advertising partners through cookies is used solely for the purpose of measuring and improving our own marketing campaigns.

7. International Data Transfers

Some of our third-party analytics and advertising partners (including Google, Meta, TikTok, and LinkedIn) may process data collected through cookies in countries outside the UK and the European Economic Area, including the United States. These transfers are subject to appropriate safeguards including Standard Contractual Clauses and, where applicable, adequacy decisions.

For further information about cross-border data transfers in relation to personal data more broadly, please refer to our Privacy Policy at alby.com/privacy.

8. Retention of Cookie Data

The retention period for data collected through cookies varies by cookie type:

• Session cookies expire when you close your browser.

• Persistent cookies expire on the dates indicated in Section 3, or sooner if you delete them.

• Data collected by third-party analytics and advertising partners is retained in accordance with those partners’ own data retention policies. We encourage you to review their policies for further detail.

9. Changes to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in our technology, legal obligations, or the services we offer. When we make material changes, we will update the “Last updated” date at the top of this page and, where required, seek fresh consent through our cookie consent tool.

We recommend checking this page periodically for any updates.

10. Contact Us

If you have any questions about this Cookie Policy or our use of cookies, please contact:

Alby Online Ltd

Email: legal@alby.photos

Website: www.alby.photos

Registered in England and Wales

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.