Privacy Policy

Last updated: 14 June 2026

This Privacy Policy explains how we collect, use, and protect your personal data when you use MemoryBook.wedding.

1. Data Controller

The controller of your personal data is memorybook.wedding, with its registered office in Poland.

memorybook.wedding

Technopark Pomerania

Cyfrowa 6

71-441 Szczecin

Poland

Email: [email protected]

If you have any questions about this Privacy Policy or how we process your data, please contact us at the email address above.

2. What Data We Collect

From album owners (couples)

• Names of the couple (as you choose to display them)
• Email address
• Event date (optional)
• Album settings and preferences
• Payment information (processed by Stripe — see Section 7)

From guests

• Display name (optional, as you choose)
• Greeting text, photos, and videos you upload
• Guest PIN (used for authentication only, stored as a one-way hash)

Automatically collected

• Browser type and version
• Device type (mobile, tablet, desktop)
• Anonymized IP address (used for spam prevention and rate limiting)
• Page views and basic usage analytics
• Cookies necessary for site functionality (see Section 8)

3. Legal Basis for Processing

We process your personal data on the following legal grounds under GDPR (Regulation (EU) 2016/679):

• Performance of a contract (Art. 6(1)(b) GDPR): to provide the album service you purchased
• Consent (Art. 6(1)(a) GDPR): for marketing emails and optional features (you may withdraw consent at any time)
• Legitimate interest (Art. 6(1)(f) GDPR): for fraud prevention, security, and service improvement
• Legal obligation (Art. 6(1)(c) GDPR): for tax records, VAT invoices, and accounting

4. How We Use Your Data

We use your data to:

• Create and display your wedding album
• Send transactional emails (welcome, reminders, payment confirmations)
• Send marketing communications (only with your consent)
• Prevent spam and abuse through PIN verification and rate limiting
• Issue VAT invoices and comply with Polish tax law
• Improve our service through anonymized analytics

5. Data Sharing — Our Processors

We do not sell your data. We use the following trusted service providers (data processors):

All processors are bound by data processing agreements (DPAs) and process data only on our instructions.

6. International Data Transfers

Some of our processors (Cloudflare R2, Stripe, Google) may transfer data outside the European Economic Area (EEA), primarily to the United States. These transfers are protected by:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• The EU-US Data Privacy Framework, where applicable

7. Data Retention

• Active albums: stored for the duration of your subscription and any renewals
• Inactive albums: retained for 12 months after the event date, then deleted
• Payment records: retained for 5 years as required by Polish tax law
• Marketing data: retained until you withdraw consent
• Account deletion: you may request deletion at any time (see Section 9)

8. Cookies

We use the following types of cookies:

• Strictly necessary: session management, security, payment processing (no consent required)
• Analytics: Google Analytics (anonymized, with your consent)
• Marketing: Google Ads conversion tracking (with your consent)

You can manage your cookie preferences through our cookie banner or your browser settings.

9. Your Rights Under GDPR

You have the right to:

• Access your personal data and receive a copy
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten")
• Restrict processing in certain circumstances
• Portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interest or for marketing
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the Polish Data Protection Authority (Prezes Urzędu Ochrony Danych Osobowych — PUODO, ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl)

To exercise your rights, contact us at [email protected]. We respond within 30 days.

10. Data Security

We protect your data through:

• TLS/HTTPS encryption for all data in transit
• Encryption at rest for media files
• One-way hashing (bcrypt) for PINs and passwords
• Access controls and audit logs
• Regular security reviews

No system is 100% secure, but we follow industry best practices.

11. Children

MemoryBook.wedding is not intended for users under 16. We do not knowingly collect data from children. If you believe we have collected such data, contact us for immediate deletion.

12. Changes to This Policy

We may update this Privacy Policy. Material changes will be notified by email at least 14 days before they take effect. The "Last updated" date at the top shows the current version.

13. Contact

For all privacy-related questions:

• Email: [email protected]
• Postal: Technopark Pomerania, Cyfrowa 6, 71-441 Szczecin, Poland

← Back to Home