Privacy Policy

Last updated: October 23, 2026

1. Data Controller

The data controller responsible for your personal data is LUKA MATIĆ PR RAČUNARSKO PROGRAMIRANJE MAHADEVA TECH RUMA, Veljka Dugoševića 134/33, 22400 Ruma, Serbia, PIB: 113651324.

Contact: tech.mahadeva@gmail.com

This policy covers hosts, who create an account and events, and guests, who open an event's page to view its gallery or add photos and videos to it. We are the controller for the data we process to run Memory Boom, including the photos and videos guests upload. Hosts decide who gets their event's link, and are responsible for what they do with the photos and videos they download.

2. Data We Collect

If you are a host, we collect:

• Account information: Your name and email address, the language you use the app in, and, if provided, how you heard about us.
• Profile picture: If you add one, or sign in with Google.
• Authentication data: Passwords and, if two-factor authentication is enabled, TOTP secrets. These are stored securely on our behalf by AWS Cognito. If you sign in with Google, we receive basic profile information (name, email address, profile picture, and Google account identifier) from Google; we do not receive or store your Google password.
• Event information: Each event's name, date, time zone, welcome message, design, guest page language and plan.
• Payment data: Billing address and payment details are collected and processed by Dodo Payments Inc. as Merchant of Record. We send Dodo Payments your name and email address, and keep the identifiers of your Dodo Payments customer record and of your payments, refunds and disputes. We do not store credit card numbers, bank account details, or billing addresses.
• Account deletion: The reason you give for deleting your account, and any feedback you add.

If you are a guest, we collect:

• Photos and videos you upload, including any information your device saved in the files, such as when and, if your device recorded it, where they were taken. They may show you and other people.
• Your display name, if you enter one, and when you uploaded each photo or video.
• A random identifier your browser creates, which we store with each of your uploads so that you can find and delete them. It is not linked to your name or your device, and it is never shown to anyone.

From everyone who uses the Service, we collect:

• Technical data: IP address, browser type, and device information, which our servers process to deliver the Service and which may appear in server logs kept for security and troubleshooting.
• Usage data: How you use our website and guest pages, through Google Analytics, with your consent where the law requires it (section 11).
• Messages you send us, such as content reports, refund requests or questions.

3. How We Use Your Data

We process your personal data for the following purposes:

• Providing the Service: host accounts, events, guest pages, shared galleries, uploads and downloads
• Showing each photo and video, with its uploader's display name and upload time, to everyone who can open the event's gallery
• Processing payments, activating and upgrading events, and handling refunds and disputes
• Sending emails about your account and events: verification and password reset codes, confirmations when an event is activated, reminders 7 days and 1 day before a gallery period ends, and notices when an event is suspended
• Ensuring security and preventing fraud, including declining payments from email addresses whose earlier payments were refunded or lost in a dispute
• Reviewing reported content and responding to legal requests
• Understanding how our website is used, to improve it
• Complying with legal obligations, such as keeping billing records

We do not sell or rent your personal data. We do not analyse photos and videos, share them with AI providers, or use them to train AI, and we only look at them when they are reported to us, when you ask us to look into a problem, or when the law requires it.

4. Legal Basis for Processing

We process your personal data based on:

• Contract performance: Processing necessary to provide the Service under our Terms of Service, which hosts accept when creating an account and guests accept when uploading.
• Legitimate interest: Sharing an event's photos and videos with its guests, including the people they show who didn't upload them, keeping the Service secure, preventing fraud and payment abuse, handling content reports, and improving the Service.
• Legal obligation: Retaining billing records as required by applicable law.
• Consent: Analytics cookies, where the law requires consent. You can withdraw it at any time (section 11).

5. Who Can See Your Data

• Galleries: Anyone with an event's link or QR code can see its name, date and welcome message, and every photo and video in its gallery with the uploader's display name and upload time. They can also download the original files, including the information saved in them (section 2). What people do with downloaded copies is outside our control.
• Hosts: A host sees everything uploaded to their events, including what they have hidden from guests, and can download all of it. Guests never see a host's name, email address or profile picture.
• Guest identifiers: Never shown to anyone, including the host.
• Profile pictures: Stored at a public web address that is not listed anywhere, so anyone with the exact address could open it.
• Search engines: Every event gets a random, hard-to-guess link, and event pages tell search engines not to list them.

6. Data Sharing

We share personal data only with:

• Amazon Web Services (AWS): Cloud infrastructure and hosting, including file storage, AWS Cognito for user authentication and identity management, and Amazon SES for emails (data processing agreement in place).
• Dodo Payments Inc.: Payment processing and billing (Merchant of Record). Dodo Payments handles payment data under its own privacy policy.
• Google LLC: Google Sign-In for single sign-on authentication (if you choose to sign in with Google); Google Analytics for usage analytics on our website and guest pages; and Google Fonts, which the host app loads from Google's servers, so that your browser sends Google its IP address. Data may be transferred to the US under Google's data processing terms.

We may also disclose personal data where the law requires it. We do not sell, rent, or trade your personal data to third parties.

7. Data Retention

• Photos and videos: Until the uploader or the host deletes them, or the host deletes the event, and at the latest until the event's gallery period ends, including while an event is suspended. They are deleted within 48 hours, together with the display names and guest identifiers stored with them.
• In your browser: Your guest identifier and display name stay in your browser until you clear its data for our website.
• Events: An event's details and payment record are kept after its photos and videos are deleted, until the host deletes the event or their account.
• Host accounts: Until you delete your account, which also deletes your profile picture, your events and all of their photos and videos.
• After account deletion: We keep a record of the deletion with the reason you gave, any feedback, and a keyed hash of your email address (a code that cannot be turned back into the address), so that a refund or dispute of an earlier payment can still be matched to it.
• Refunded or disputed payments: If a payment of yours was refunded in full, or a dispute about it was decided against us, we keep a keyed hash of your email address with the payment's identifier, so that we can decline new payments from that address, including after your account is deleted.

We keep these deletion and payment records only as long as needed to prevent payment fraud and abuse. Server logs are kept for a limited period. Billing records are retained by Dodo Payments for the period required by applicable tax laws.

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS) and at rest
• Hashed and salted password storage (via AWS Cognito)
• Two-factor authentication support
• Photos and videos kept in private storage and served only through signed links that expire within an hour
• Access controls on our systems

9. International Data Transfers

Your data is stored in the European Union (AWS eu-central-1 region, Frankfurt). Our web pages may be served from AWS locations closer to you, and Google and Dodo Payments may process data in the United States and elsewhere. Where data is transferred outside the EU/EEA, we rely on appropriate safeguards including standard contractual clauses and the data processing agreements of our service providers.

10. Your Rights

Under applicable data protection laws (including the Serbian Law on Personal Data Protection and, where applicable, the EU General Data Protection Regulation), you have the right to:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of your personal data.
• Restriction: Request restriction of processing in certain circumstances.
• Portability: Receive your data in a structured, commonly used format.
• Objection: Object to processing based on legitimate interest.
• Withdrawal of consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at tech.mahadeva@gmail.com. We will respond within 30 days. Since guests don't have accounts, guests should include the event's link and describe the photos or videos concerned. Guests can also delete their uploads themselves, from the browser they uploaded them from.

You also have the right to lodge a complaint with a data protection authority: in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection, or the authority in the country where you live.

11. Cookies and Similar Technologies

The Service uses cookies and similar technologies, including browser local storage. We categorize them as follows:

• Strictly Necessary: On our website and guest pages, a cookie that remembers your language, and browser local storage that remembers your theme, your cookie choices and, on guest pages, your guest identifier and display name. In the host app, browser local storage that keeps you signed in and remembers your theme and language, a cookie with the country you are in, which picks the app's language until you choose one, and session storage that keeps track of a checkout in progress. These cannot be disabled as the Service cannot function without them. Dodo Payments' checkout pages set their own cookies, under Dodo Payments' policies.
• Analytics Cookies: We use Google Analytics (_ga, _ga_<container>) on our website and guest pages to understand how they are used. In countries whose laws require consent, including the EU, the EEA, the UK, Switzerland and Serbia, these cookies are only set after you give consent via the cookie banner; until then, Google may receive basic, cookieless signals about page visits (Google Consent Mode). Elsewhere, they are on by default, and you can turn them off at any time. The host app uses no analytics.
• Marketing Cookies (consent required): With your consent, these may be used to deliver relevant ads and measure advertising effectiveness. No such cookies are currently set, but the option is exposed in the banner so that your choice is remembered if we introduce any in the future.
• Personalization Cookies (consent required): With your consent, these may be used to remember your preferences and tailor content. No such cookies are currently set, but the option is exposed in the banner so that your choice is remembered if we introduce any in the future.

You can manage your cookie preferences at any time via the "Cookie Settings" link in the footer of our website. Your choice applies to guest pages too. Withdrawing consent stops Google Analytics from reading or setting its cookies; you can delete the ones already set in your browser's settings. We ask for your choice again after 180 days.

12. Children

Host accounts are for adults only. Guests under 16 should ask a parent or guardian before uploading. If a photo or video of your child was uploaded to an event and you want it removed, ask the host, or contact us with the event's link.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The "Last updated" date at the top of this page indicates when the policy was last revised.

14. Contact

For questions or concerns about this Privacy Policy or our data practices, contact us at:

Email: tech.mahadeva@gmail.com

LUKA MATIĆ PR RAČUNARSKO PROGRAMIRANJE MAHADEVA TECH RUMA
Veljka Dugoševića 134/33, 22400 Ruma, Serbia