Privacy Policy

Memoirbox is a digital event photo/video sharing platform operated at memoirbox.app. Data processing described in this policy is carried out by Efecan Bozdemir, who operates Memoirbox. You can reach us at support@memoirbox.app.

When you create an account: your name and email address.

When you create an event: the event name, date, and guest list if provided (name, email, phone).

When guests upload photos/videos to an event: the uploaded media files, an optional name and message, and a one-way (non-reversible) hash of the uploading device's IP address.

During payment: payment is processed entirely by licensed payment providers (iyzico for Turkey, Paddle.com Market Limited internationally) — your card details never reach us.

To provide the service (building the event gallery, storing media, moderation, notification emails), to prevent abuse (rate limiting via the IP hash), to meet legal obligations, and to improve the service.

To operate the service, data is shared only with the following sub-processors, limited to what each needs: Supabase Inc. (database and authentication), Cloudflare Inc. (photo/video storage and video delivery), Resend Inc. (transactional email), Google LLC and Anthropic PBC (AI-powered moderation and background-image generation, only while the relevant media is being processed), Upstash Inc. (abuse-prevention rate limiting), iyzico Ödeme Hizmetleri A.Ş. (payment processing in Turkey), and Paddle.com Market Limited (international payment processing, acting as Merchant of Record).

We never sell your data or share it with third parties for advertising purposes.

Some of the service providers we rely on (notably Supabase, Cloudflare, Resend, Google, Anthropic, Upstash, and Paddle) operate outside Turkey, mostly in the United States.

These transfers are assessed under Article 9 of Turkey's Law No. 6698 and the rules set by Turkey's Personal Data Protection Board; we are in the process of putting the required safeguards in place. Contact support@memoirbox.app for the current status.

Event media (photos and videos) is kept on our servers for the retention period of the plan you purchased (3 to 120 days depending on the plan, shown on the plan page). We send reminder emails to the organizer 30 and 7 days before that period ends; once it ends, the media is automatically and permanently deleted. Your account information is kept until you delete your account or request its deletion.

Our site uses only essential cookies — to keep you signed in and to remember a guest's language preference. We do not use third-party advertising or tracking cookies.

Under Turkey's Law No. 6698 (and, where applicable, the GDPR), you have the right to learn whether your data is being processed and to request information about it.

You have the right to learn the purpose of processing and whether your data is used accordingly, and to know which third parties — domestic or international — your data has been shared with.

You have the right to request correction of inaccurate or incomplete data and deletion or destruction where the legal conditions are met, and to have those changes communicated to any third parties your data was shared with.

You have the right to object to a decision based solely on automated processing that has a legal or similarly significant effect on you, and to seek compensation if you suffer damage from unlawful processing.

To exercise these rights, contact us at support@memoirbox.app.

Your data is transmitted over encrypted connections (HTTPS/TLS), and access is restricted to authorized systems only.

We may update this policy from time to time; we will notify you by email or on the site for material changes.