Privacy

This page explains which personal data Memuseo processes, why, on what legal basis, how long we keep it and who can access it. It concerns everyone who uses the site: people who create and give a museum, people who receive one, and visitors. We collect as little as possible.

Data controller

The data controller is the publisher of Memuseo. For any question about your data, or to exercise your rights, write to contact@memuseo.com.

1. Creating your museum

• Why: to create your museum, save it as you edit, show you the preview, deliver it after payment and let you edit it afterwards.
• Legal basis: performance of the contract and of pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• Data: what you put in the museum (the first names, the look of the two characters, the titles, dates and texts of the memories, the final message and the photos), the occasion you chose and the museum’s language. Photos are resized and re-encoded as soon as they are uploaded, which removes their hidden metadata (GPS location, camera model…). They are kept in private storage and only shown through short-lived signed links.
• Your editing key: a secret key, stored in your browser and in your private editing link, proves that the museum is yours. We only keep a one-way hash of it.
• How long: an unpaid draft that isn’t edited for 30 days is deleted automatically, with its photos. A purchased museum stays online for 2 years after the purchase, then it is deleted with its photos. A photo you remove from your museum is erased from our servers within two days. You can also delete your museum at any time from the editor: the deletion is immediate and permanent.
• Who can access it: you, from the editor; anyone you send the museum’s link to, once it is paid for; us, for support or to handle a report; and our technical providers, listed below. Museums are never listed, public or indexed by search engines.

2. Paying

• Why: to collect the payment and prevent fraud. Legal basis: performance of the contract (Art. 6(1)(b)).
• How: you pay on the secure page of Stripe, our payment provider. Memuseo never receives your card details, only the result of the payment, its amount, its currency, the offer bought (Essential, Deluxe or the move to Deluxe) and the payment’s references at Stripe.
• Proof of your agreement: when you tick the box before paying, the date of your agreement to immediate delivery, which waives your right of withdrawal, and the site’s language are recorded with the payment, at Stripe. Legal basis: our legal obligations (Art. 6(1)(c)).
• Separate controllers: Stripe also processes some data for its own purposes (fraud prevention, regulatory obligations), under its own privacy policy. So do Apple and Google if you pay with Apple Pay or Google Pay.
• How long: payment data (amount, date, offer, references) is kept as long as our accounting obligations require, in principle 10 years, even if you delete your museum. It contains neither your e-mail address nor the museum’s content.

3. The e-mail you receive

• After a purchase or a move to Deluxe, we send you a single e-mail: the museum’s link to give and your private editing link. Legal basis: performance of the contract.
• Your e-mail address, entered on Stripe’s payment page, is only used for this e-mail, sent by our provider Resend from the mail.memuseo.com domain. We don’t store it in our database, and we never send you newsletters or advertising. Stripe keeps it with the payment.

4. Receiving a museum

• When you open a museum someone gave you, we only add 1 to an anonymous daily counter (“a museum was opened”): nothing says which museum, who opened it or from where.
• During your visit, your browser keeps the list of memories you have already found, so you can pick up where you left off if the page reloads (see Cookies and local storage). None of this is sent to our servers.

5. Audience measurement

Memuseo uses no outside analytics tool. We simply count a few steps per day (for example “a preview was started” or “a payment succeeded”) as anonymous counters: no cookie, no identifier, no IP address, no name, text or photo. These counters tell us whether the service works, not who uses it. Legal basis: our legitimate interest in improving the service (Art. 6(1)(f)).

6. Security and abuse prevention

• Why: to protect the service and your data (mass requests, abuse attempts, fraud). Legal basis: our legitimate interest in securing the service (Art. 6(1)(f)).
• Data: your IP address is the key of temporary counters that limit the number of requests; they are kept in memory at our host. Our host also keeps technical logs (IP address, page requested, date and time, browser).
• How long: the counters erase themselves within an hour at most; technical logs are kept for 30 days at most.

7. Writing to us

If you write to us at contact@memuseo.com, we use your message and your address to reply (legal basis: performance of the contract if your request is about a purchase, otherwise our legitimate interest in answering the messages we receive), and we keep them as long as it takes to handle your request and follow it up. E-mails sent to this address are routed by Cloudflare (Email Routing) to a Gmail mailbox (Google), which hosts them, including in the United States.

Cookies and local storage

Memuseo sets no advertising cookie and uses no tracker that needs your consent: that’s why you don’t see a cookie banner. The only trackers are the ones that make the site work, listed below. Your browser’s local storage (localStorage and sessionStorage) plays a role similar to cookies; this information stays on your device.

• NEXT_LOCALE (cookie): remembers the language you chose with the language switcher, the language links at the bottom of the page or the language suggestion. It is only set if you make that choice. Duration: 12 months.
• memuseo:language-suggestion-dismissed (local storage): remembers that you closed the language suggestion, so it isn’t offered again. Duration: until you clear the site’s data.
• museum-of-us:draft (local storage): your draft’s identifier and its secret editing key, to find it again on this device. Duration: until you delete your draft or clear the site’s data.
• museum-of-us:backup:… (local storage): a backup copy of the draft you are working on (texts and settings, not the photos themselves), so nothing is lost if the connection drops. Same duration.
• mou:progress:… (session storage): while you visit a museum you received, the memories you have already found. Duration: erased when the tab is closed.
• Stripe: the payment page is hosted by Stripe, which may set its own cookies there to secure the payment and prevent fraud (Stripe’s policy). They only concern that payment page.

You can delete the site’s cookies and local storage in your browser settings. You will then lose the language you chose and, if you haven’t kept your private editing link, access to your draft from this device.

What Memuseo never does

Your content is never used for advertising, never sold or rented to third parties, and never sent to artificial intelligence services. Memuseo does no profiling and makes no decision based solely on automated processing.

Recipients and processors

Your data is shared with the people mentioned above and with the technical providers below, who process it on our behalf, on our instructions, under a data processing agreement. Stripe also processes some data for its own purposes (see 2).

• Vercel Inc. — Hosting of the site and its functions, and private photo storage (Vercel Blob). Location: US company; the site, its functions and the photos are hosted in the Frankfurt region (Germany, European Union). Transfers outside the European Union covered by: standard contractual clauses (EU) 2021/914 and the EU-US Data Privacy Framework. Data processing agreement
• Neon, Inc. — Database (museum content, payments, anonymous counters). Location: European Union, Frankfurt (AWS eu-central-1). Transfers outside the European Union covered by: standard contractual clauses (EU) 2021/914 and the EU-US Data Privacy Framework. Data processing agreement
• Stripe Payments Europe, Ltd — Payment (no card data goes through our site). Location: Ireland (European Union); processing may involve the United States. Transfers outside the European Union covered by: standard contractual clauses (EU) 2021/914 and the EU-US Data Privacy Framework. Data processing agreement
• Plus Five Five, Inc. (Resend) — Sending the confirmation e-mail after a purchase, from the mail.memuseo.com domain. Location: United States. Transfers outside the European Union covered by: standard contractual clauses (EU) 2021/914 and the EU-US Data Privacy Framework. Data processing agreement
• Cloudflare, Inc. — Routing of the e-mails sent to our contact address (Email Routing). Location: United States; worldwide network. Transfers outside the European Union covered by: the EU-US Data Privacy Framework and standard contractual clauses (EU) 2021/914. Data processing agreement

Transfers outside the European Union

The site, the photos and the database are hosted in the European Union, in Frankfurt. Several providers are nevertheless US companies (notably Vercel, Resend, Stripe and Cloudflare), which may process data in the United States. These transfers are covered by the safeguards shown for each one in the list above: the European Commission’s adequacy decision of 10 July 2023 (EU-US Data Privacy Framework) for certified companies, and the Commission’s standard contractual clauses (decision 2021/914). You can get a copy by writing to us.

Your rights

• Access and portability: get a copy of your data, and receive the data you gave us in a common, machine-readable format.
• Rectification and erasure: correct inaccurate data or have your data erased.
• Restriction and objection: ask us to temporarily freeze the use of your data, or object to processing based on our legitimate interest.
• Instructions after your death: decide what happens to your data after your death (Art. 85 of the French Data Protection Act).

To exercise these rights, write to contact@memuseo.com, if possible with your museum’s link or from the address you paid with, so we can check that the request really comes from you. We reply within one month, which can be extended by two months if the request is complex (we’ll tell you if so).

You can also act on your own, at any time, from the editor: fix your museum or delete it for good. The museum, its photos and its texts are then erased from our servers, with no way back. All that remains, without your e-mail address or the museum’s content: on our side, the payment record (amount, date, offer), for our accounts; at Stripe, the payment data it keeps for its own legal obligations.

If you think your rights are not respected, you can lodge a complaint with the CNIL (the French data protection authority) or with the data protection authority of your country.