Privacy Notice

1. Who is responsible for your data

Memoritie (trade name) is the controller of the personal data you entrust to us through the site memoritie.com and its applications. This notice is issued under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP).

Legal entity: NOT CONFIGURED
Registered address: NOT CONFIGURED

For anything related to your personal data you can write to us at soporte@memoritie.com.

Under article 29 of the LFPDPPP we have appointed a Data Protection Officer, who you can reach at soporte@memoritie.com. That person handles ARCO rights requests, consent withdrawals and any question about this notice.

2. What personal data we collect

Memoritie exists to keep your family’s memories. That means almost all the data we process is data you choose to upload. These are the categories:

Your account data

• Name, email address and password. The password is never stored in plain text: it is stored as a hash.
• If you choose to sign in with Google or Facebook, we receive your name, email and profile picture from that provider.
• If you enable two-step verification, we store the verification secret encrypted.
• Your profile picture (avatar), if you choose to upload one.

Your family and your memories

• Your children’s profiles: name, date of birth, gender, and the photos and videos you upload of them. Photos and videos of a person are personal data, and we treat them as such.
• Pregnancy milestones you record.
• A photo’s location, only if you choose to add it for the memory map. It is optional.
• Voice blessings recorded by invited relatives.
• Sparks: a photo, the emotion you pick and the song of the moment.
• Time capsules and the Sealed Envelope: letters, messages and memories revealed later on. The contents of the Sealed Envelope are also stored encrypted, and open when your child turns 18.
• Comments and reactions inside the family album.

Third-party data you provide to us

• The email addresses of the relatives you invite. We use them only to send your invitation and, if they accept, to create their access as relatives.

Payment data

• All charges are processed by Stripe. Memoritie does not store card numbers; we only keep your invoice history and the status of your subscription.

3. Sensitive personal data

Some of the data Memoritie processes is sensitive personal data under the LFPDPPP, and we want to be completely clear about it:

• Biometric data: the automatic facial analysis of the photos you upload (see section 6) generates data derived from the faces of the people in them, including minors.
• Health data: if you enable the pregnancy module, the milestones and pregnancy information you record are health-related data.

To process this data, article 8 of the LFPDPPP requires your express consent, and we collect it separately: you will see a dedicated checkbox when creating a child’s profile (for the facial analysis of their photos) and another one when enabling the pregnancy module (for health data). Neither is pre-checked.

You can withdraw that consent at any time from Settings. When you do, we stop any future analysis of that type of data; the photos, videos and memories already stored are neither deleted nor altered.

4. Your children’s data

Profiles, photos, videos and other data of minors are uploaded and authorised by the parent or guardian who holds the account, who gives consent on the minor’s behalf under the LFPDPPP. Only you decide what is stored and which relatives can see it.

Invited relatives (relative role) can view, comment and leave voice blessings, but they do not administer your children’s profiles.

5. What we use your data for

Primary purposes (necessary to provide the service)

• Create and maintain your account and those of invited relatives.
• Store and organise your photos, videos, capsules, sparks and other memories.
• Automatically analyse the content you upload with artificial intelligence tools in order to organise, describe and moderate it (see section 6).
• Show your content to the relatives you authorise and notify relevant activity.
• Process your subscription charges and send you the service’s transactional emails: account verification, sign-in links, billing notices, reminders before a capsule opens and notices about the end of your free trial.

Secondary purposes

• Send product emails, such as the weekly digest for invited relatives.

If you do not wish to receive emails for secondary purposes, you can ask us to stop at any time by writing to soporte@memoritie.com. That does not affect the emails strictly needed to operate your account.

6. Automated processing with artificial intelligence

Part of Memoritie’s value is that your memories organise and narrate themselves. To make that happen, an automatic analysis runs when you upload content:

• AWS Rekognition analyses the photos you upload to generate labels, detect faces and emotions, and moderate spark content.
• OpenAI generates narratives, descriptions and story arcs from your memories, and produces the voice that narrates your cinematic film.
• Spotify and AudD are used to identify and attach the music of your moments.

This analysis happens automatically on upload and its only purpose is to provide the service: to organise, describe, narrate and protect your album. It is not used for advertising or to profile you for commercial purposes.

7. Who we share data with, and transfers

We do not sell your data and we do not share it with anyone for advertising. To operate the service we rely on two kinds of provider, which the LFPDPPP distinguishes precisely:

Processors (they process data on Memoritie’s behalf)

These providers only process data following our instructions and in order to provide the service. Sharing data with them is a remission, not a transfer, under the LFPDPPP:

• AWS (Amazon Web Services): automatic image analysis with Rekognition.
• OpenAI: generation of narratives, descriptions and voice.
• Brevo: sending transactional and product emails.
• Spotify and AudD: music identification and matching.

Third parties processing data for their own purposes (transfers)

These providers also act as controllers of the data they receive, under their own privacy notices:

• Stripe: payment and subscription processing. It receives your payment data and processes it under its own privacy notice and regulatory obligations.
• Google and Facebook: only if you choose to sign in with them (OAuth). By using them, that provider knows you have a Memoritie account and processes that fact under its own policies.

By accepting this notice, you consent to the transfers described in this section. You may object at any time by writing to soporte@memoritie.com; note that some are necessary for features you contract (for example, without Stripe we cannot charge your subscription, and signing in with Google or Facebook only happens if you choose it).

These providers operate wholly or partly in the United States, so using Memoritie involves an international transfer of data to that country, necessary to provide the service you contract.

Your photos and videos are stored on an object server managed directly by Memoritie.

8. How we protect your information

• All communication between your device and our servers is encrypted (TLS).
• Passwords are stored only as a hash.
• The contents of the Sealed Envelope are additionally stored encrypted. The keys for that encryption are managed by our servers: that is how we can open it exactly when your child turns 18. It is not end-to-end encryption.
• The shareable links you create can be protected with a password and an expiry date, and you can revoke them whenever you want.

9. Security breaches

If, despite our measures, a security breach were to occur that significantly affects your economic or moral rights, we will notify you without delay, in accordance with article 19 of the LFPDPPP, so that you can take the appropriate steps.

That notice will include, as a minimum:

• What happened and when we detected it.
• Which personal data was compromised.
• What actions we recommend you take to protect your interests (for example, changing your password).
• Which corrective measures we applied immediately.
• How you can get more information.

10. Your rights and how to exercise them

You have the right to access, rectify and cancel your personal data, as well as to object to its processing (ARCO rights). You can exercise them in three ways:

• Export all your data: from Settings you can download a file with all your information. For security, this export is available once a day.
• Delete your account: also from Settings, at any time and without intermediaries (the exact steps are in section 11).
• Any other ARCO request: write to us at soporte@memoritie.com (where our Data Protection Officer will attend to you) stating your name, your account email and the right you wish to exercise.

The deadlines are the ones set by law, and we meet them: we will reply within a maximum of 20 business days from receiving your request and, if it is well founded, we will act on it within the following 15 business days (article 31 of the LFPDPPP). Exercising your ARCO rights is free of charge (article 34); only justified shipping or reproduction costs, if any, are on you.

When a request involves a minor’s data, we may ask you to prove your identity and your status as parent or guardian (article 28). This is not bureaucracy: it is how we make sure nobody else can request your child’s data.

11. How to delete your account

You can delete your Memoritie account whenever you want, from the app or from the web, with no intermediaries. If you no longer have access to the app, you can also request it by email.

From the Android app

1. Open Memoritie and sign in.
2. Tap your avatar in the top corner of Home (or go to Family and tap Your account), then Settings.
3. Scroll to the bottom and tap Delete account.
4. Type DELETE to confirm.

From the web

1. Sign in at memoritie.com and open Settings.
2. Open the Privacy & Data tab.
3. Under Danger Zone, click Delete my account.
4. Type ELIMINAR (the confirmation word is the same in every language) to confirm.

By email

Write to contact@memoritie.com from the email address you signed up with, with the subject “Delete my account”. We will confirm your identity and delete it within 20 business days at most; it is usually a matter of hours.

What is deleted, and when

Deletion is immediate and irreversible. We erase your profile, your children’s profiles, your photos, videos and audio (including the files in our storage), time capsules, Sealed Envelopes, generated films, your family’s blessings and the entire account. Family members you invited lose access. If you have an active subscription, it is cancelled before anything is deleted, so you are never charged again.

The only thing we keep afterwards is what the law requires us to keep: billing records for the applicable tax retention period (section 13). The backups we maintain to recover the service after a disaster are overwritten in their normal rotation and are never used to restore deleted accounts.

If you would rather keep a copy, export your data from Settings before deleting the account (section 10).

12. When your child turns 18

Your child’s data and memories belong to them. You administer them while they are a minor because the law recognises that representation, but ownership of their personal data has always been theirs.

On reaching adulthood, your child can directly exercise ARCO rights over their information: access it, rectify it, cancel it or object to its processing, including anything the artificial intelligence analysis has historically generated about their photos and videos. They only need to write to us at soporte@memoritie.com and prove their identity.

We are working on a mechanism to hand over control of the profile when they turn 18. To be honest: today operational control of the profile stays with whoever created the account, and this notice will be updated when that mechanism is available.

13. How long we keep your data

We keep your data for as long as your account is active: that is the purpose of the service, to keep your memories over time. If you delete your account, your information is deleted.

Sealed capsules and the Sealed Envelope persist until their opening date, or until you delete the profile they belong to. Billing data is kept for as long as applicable tax obligations require.

14. Local storage in your browser

To keep your session signed in and remember your preferences, the application stores your session tokens and your theme and language preferences in your browser (localStorage and sessionStorage).

We do not use advertising cookies or third-party trackers for marketing purposes.

15. Changes to this notice

If this notice changes, we will publish the updated version on this same page with a new update date. If the change substantially affects the processing of your data, we will let you know by email before it takes effect.

16. Data protection authority

If you believe your right to data protection has been infringed, you can turn to the Secretaría Anticorrupción y Buen Gobierno, the Mexican authority for the protection of personal data held by private parties under the Federal Law on the Protection of Personal Data Held by Private Parties (Official Gazette, March 20, 2025): gob.mx/buengobierno.