Privacy Policy
Memories Drop is a service provided by Stateless d.o.o. (“we”, “our”, or the “Company”). This policy explains how we process personal data, our legal basis for doing so, and how we protect your privacy.
1. Data We Collect and Why (Legal Basis)
We process your personal data for specific purposes under the following legal bases:
- To provide the service: we process your email address, event metadata (title, subtitle, slug), and uploaded media (photos, videos, audio) to create, host, and deliver the event-sharing functionality requested by the organiser and used by guests. Depending on your role, this processing is based on contractual necessity or our legitimate interest in providing the service. Guests upload media without creating an account and without providing any personal details.
- Operational & technical data (legitimate interest): we process technical data such as IP addresses, user agents, upload timestamps, and file metadata such as file size and file type to ensure site security, troubleshoot issues, prevent abuse, and maintain service reliability.
- Aggregate analytics (legitimate interest): we use Cloudflare Web Analytics, which is cookieless and does not track visitors across websites, to understand general usage trends and improve the service.
- Purchase attribution (legitimate interest): when an organiser purchases an event, we record the website that referred them to us (for example a search engine), any campaign tags contained in the link they followed, the first page they visited on our site, and their country as determined from their IP address. We use this only to understand how customers find Memories Drop. We do not set cookies for this purpose and do not share this data with advertising networks.
- Legal obligations: we may process certain data, such as transaction records via our payment partner, to comply with tax, accounting, or other legal obligations.
2. Event Organiser and Guest Responsibilities
We provide the technical platform for media sharing, but the content is user-generated.
- Control of access: for event media, the organiser controls who receives the event link and is responsible for sharing it only with appropriate guests.
- Content nature: uploaded media may contain personal data about people appearing in it. Please do not upload media that is sensitive, unlawful, harmful, or shared without permission.
- Permissions: organisers and guests are responsible for ensuring they have appropriate permission to upload and share media, especially where it involves minors or sensitive situations.
- Reporting: if you believe media has been uploaded without permission or violates your privacy, contact us at support@memoriesdrop.com for review.
3. Payments (Merchant of Record)
Payments are handled by Lemon Squeezy. As Merchant of Record, Lemon Squeezy handles payment processing, invoices, and applicable tax compliance. We do not see or store your credit card details. Your payment data is governed by Lemon Squeezy’s privacy policy.
4. Service Providers and Data Transfers
To operate our service, we use third-party infrastructure. Where data is transferred outside the EU/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs), the EU-U.S. Data Privacy Framework, or equivalent lawful transfer mechanisms.
- Hosting & database: Railway.
- Storage: Cloudflare R2. Uploaded media is stored in the EU region.
- Email delivery: Resend.
- Analytics: Cloudflare Web Analytics, which is cookieless and does not track visitors across websites.
5. Retention and Deletion
- Active events: we retain the event and all uploaded media for the retention period purchased with the event — 3, 6, or 12 months — counted from the date of the first upload. Events purchased before 22 July 2026 keep the 6-month retention period that applied at the time of purchase.
- Empty events: events with no media may be retained for up to 2 years for administrative purposes.
- Operational logs: technical logs, including IP addresses and timestamps, are generally retained for up to 90 days unless needed longer for security investigations.
- Post-retention: after these periods, we delete or anonymise the data unless we are legally required to retain it. Please note that deleted data may remain in backups for a limited period before being permanently overwritten.
You can request earlier deletion at any time by emailing support@memoriesdrop.com from the address you used at checkout. If we discontinue the service, we will give reasonable notice and offer a way to export your media before deletion.
6. Security, Cookies, and Private Links
We use HTTPS and restricted access controls to protect your data.
Cookies: we do not use tracking cookies, advertising identifiers, or fingerprinting.
Private links: event links and manage links are private but accessible to anyone who possesses the URL. Organisers should share event links only with appropriate guests and keep manage links secure.
7. Reporting Content
If you believe media has been uploaded without permission or violates your privacy, please email support@memoriesdrop.com. Your report should include:
- the specific event link;
- a description of the content in question;
- the reason for your request;
- your contact email.
8. Your Rights
Depending on where you live, such as the EU/EEA, UK, or certain US states, you may have the following rights. As a general practice, we aim to honour reasonable privacy requests from all users:
- Access and portability: request a copy of your data.
- Correction and erasure: update inaccurate data or request deletion of your personal data, event, or relevant media where applicable.
- Restriction and objection: request that we limit or stop processing your data.
- Verification: we may need additional information to verify your identity and locate the relevant event or media before processing a request.
- Non-discrimination: we will not penalise you for exercising your privacy rights.
EU users: you also have the right to lodge a complaint with your local data protection authority. To exercise rights with us, email support@memoriesdrop.com. We will respond within 30 days.
9. Children’s Privacy
We do not knowingly allow children to create events. Age thresholds vary by jurisdiction, including under 13 in the US and up to 16 in parts of the EU.
Where media includes minors, the event organiser and uploader are responsible for ensuring they have parental or guardian permission or another lawful basis to share that media. If media of a minor has been uploaded without permission, please contact us using the reporting instructions in Section 7.
10. US-Specific Disclosures
Where applicable, we do not “sell” personal information or “share” it for cross-context behavioural advertising. We do not intentionally collect sensitive personal information, but uploaded media may incidentally contain sensitive information depending on what users upload. We do not use or disclose sensitive personal information for purposes other than performing the service.
11. Changes to This Policy
If we make material changes to this policy, we will update the “Last updated” date above and notify event organisers by email where appropriate.
12. Contact
Data controller:
Stateless d.o.o.
Šibenska 10, 21000 Split, Croatia
Registered at the Commercial Court in Split (Trgovački sud u Splitu)
OIB: 20435902737
Share capital: €2,500.00, paid in full
Email: support@memoriesdrop.com