Privacy Policy

1. Overview

MemoryVault AI ("MemoryVault", "we", "us", "our") is a private memory archive that helps you organize photos and videos, recognize the people and places in them, and build a family history you can pass down. This Privacy Policy explains what information we collect when you use our website and apps (the "Service"), how we use and share it, and the choices and rights you have. It applies to all users of the Service worldwide.

2. Information we collect

• Account data: email address, display name, password hash, profile photo, language/region.
• Media you upload or capture: photos and videos, plus their embedded metadata (capture date, GPS location, camera/EXIF details, thumbnails).
• Content you create in the product: albums, stories, tags, comments, people profiles, family relationships and tree nodes, events, places, shared-album invitations.
• AI-derived data: face embeddings (mathematical vectors), scene/event labels, location matches, duplicate/quality scores generated to organize your library.
• Subscription & billing data: plan, status, billing history, and tokenized customer ID from our payment processor. We do not store full card numbers or banking credentials.
• Device, log & usage data: IP address, browser/OS, device identifiers, request timestamps, error traces, and feature-usage events needed to operate, secure, and improve the Service.
• Cookies & similar technologies: strictly necessary cookies for authentication and session, plus a minimal set for security and reliability (see Section 12).
• Communications: messages you send to support, feedback, and survey responses.

3. How we use your information

• Provide, operate, and maintain the Service and your account.
• Run the automatic organization features you opt into: face grouping, event and location recognition, smart tagging, duplicate detection, story and album generation.
• Generate personalized memory reminders ("On this day", year-in-review, etc.).
• Process subscriptions, invoices, and refunds through our payment processor.
• Protect the Service: authentication, rate limiting, abuse and fraud prevention, audit logging, debugging.
• Comply with legal obligations and respond to lawful requests.
• Send transactional and important service messages, and — only with your consent where required — product updates.

We do not sell or rent your personal information. We do not use your photos, videos, or face embeddings to train third-party or public AI models. AI processing is performed solely to deliver features inside your own library.

4. Legal bases for processing (EEA / UK)

• Contract: processing necessary to provide the Service you signed up for.
• Legitimate interests: securing the Service, preventing abuse, improving reliability, and basic analytics — balanced against your rights.
• Consent: face recognition / biometric processing, optional marketing communications, and any cookies that are not strictly necessary. You can withdraw consent at any time.
• Legal obligation: tax, accounting, and responding to lawful requests.

5. Biometric data (face recognition)

When face recognition is enabled, the Service generates numerical face embeddings from your photos and groups recurring faces inside your library so you can label people. These embeddings are stored in your account, are never shared with other users or sold, and are not used to train third-party models. You can turn face recognition off, delete specific person profiles, or delete all face data at any time from your settings; deleting your account removes all face embeddings.

6. How we share information

We share personal information only in the limited ways described below.

• Service providers (subprocessors): cloud database and object-storage hosting, transactional email delivery, AI model providers used to power organization features, payment processing, and error/uptime monitoring. Each is bound by a data-processing agreement and may only process data on our instructions.
• People you choose: family members or guests you invite to a shared album or family tree see what you explicitly share with them.
• Legal & safety: when required by law, court order, or to protect the rights, safety, and property of users or the public.
• Business transfers: in connection with a merger, acquisition, or asset sale, with continued privacy protections.

We do not share your personal information with advertisers.

7. International data transfers

We and our subprocessors may process data in countries other than your own, including the United States and the European Union. When transferring personal data out of the EEA, UK, or Switzerland we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum), together with supplementary technical and organizational measures.

8. Data retention

• Your media and product content is retained for as long as your account is active.
• You can delete individual items, people, albums, or your entire account at any time. Deletion is processed promptly in active systems; encrypted backups are rotated and overwritten within approximately 30 days.
• Limited records (invoices, tax data, security/audit logs) may be retained for the period required by applicable law.
• Aggregated and de-identified data that can no longer be linked to you may be retained for product analytics.

9. Security

We use industry-standard safeguards: TLS/HTTPS for data in transit, encryption at rest for media and database storage, row-level security so each account can only access its own data, scoped service credentials, least-privilege access for staff, and audit logging. No system is perfectly secure; please use a strong, unique password and contact us immediately if you suspect unauthorized access to your account.

10. Your rights and choices

Regardless of where you live, you can:

• Access, correct, export, or delete your data from your account settings, or by contacting us.
• Turn off optional AI features (e.g., face recognition) and delete the data they generated.
• Withdraw consent for optional processing, including marketing emails.

EEA / UK residents (GDPR): you also have the right to restrict or object to processing, to data portability, and to lodge a complaint with your local data-protection supervisory authority.

California residents (CCPA/CPRA): you have the right to know what personal information we collect and how we use it; to request deletion or correction; and to opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information as those terms are defined under California law. We will not discriminate against you for exercising your rights.

To exercise any of these rights, email us at privacy@memoryvault.online. We will verify your identity and respond within the timeframes required by applicable law.

11. Children's privacy

The Service is not directed to children under 13 (or under 16 in the EEA/UK), and we do not knowingly collect personal information from them. Parents or guardians who believe a child has provided us personal information can contact us to have it removed. Family members may upload photos that contain images of children only with the consent of the child's parent or guardian.

12. Cookies and analytics

We use strictly necessary cookies and similar storage to keep you signed in, remember your preferences, and protect the Service from abuse. We use a minimal set of first-party analytics and error-reporting tools to keep the Service reliable. We do not use third-party advertising cookies or cross-site tracking.

13. Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or with an in-app notice before the changes take effect. The "Last updated" date at the top of this page always reflects the current version.

14. Contact us

Questions, requests, or complaints about this policy or your personal information:

• Email: privacy@memoryvault.online
• Postal: MemoryVault AI — Privacy Team, [add legal entity name and registered address before launch]

If you are in the EEA or UK and we cannot resolve your concern, you may lodge a complaint with your local supervisory authority.