Privacy policy

1. Data controller

Memry AS (company no. 937 614 667), Øvre Kråkenes 17, 5152 Bønes, is the data controller for the personal data described here. If you have questions about privacy or wish to exercise your rights, contact us at personvern@heymemry.com.

2. What data we collect

Depending on how you use the service, we may process the following categories of personal data:

• Account data: email address and password (stored encrypted) when you create an account. You can also use the service anonymously before signing up.
• Content you upload: photos and text you add to your photo books, along with project and design data.
• Order and delivery data: name, email, phone number, street address, postal code, city and country, used to produce and ship your order.
• Payment data: order total and payment status. Card/payment details themselves are handled directly by our payment provider (Stripe) – we do not store full card numbers.
• Usage and device data: events within the service, device and browser type, plus cookies and similar technologies for analytics and operations.
• Communications: the content of emails and messages you send us.

3. Purposes and legal bases

We process personal data for the following purposes, with the corresponding legal basis under GDPR Article 6:

• Providing and managing your account and the service, including creating and shipping photo books – necessary to perform our contract with you (Art. 6(1)(b)).
• Processing payments and preventing fraud – performance of a contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)).
• Meeting bookkeeping and accounting obligations – legal obligation (Art. 6(1)(c)).
• Improving, securing and developing the service through analytics – legitimate interest (Art. 6(1)(f)), or your consent where required for cookies (Art. 6(1)(a)).
• Measuring which ads on Facebook and Instagram lead to purchases, and showing the ads to people who may benefit from them – your consent (Art. 6(1)(a)). Without a yes in the banner, nothing about you is sent to Meta.
• Responding to enquiries and providing customer support – legitimate interest (Art. 6(1)(f)).

4. Processors and third parties

We share personal data with providers that process data on our behalf (processors) under data processing agreements, or as independent controllers where necessary to deliver the service. We never sell your personal data. Our key recipients are:

5. Transfers outside the EEA

Some of our providers may process personal data outside the EU/EEA. When that happens, we ensure a lawful transfer mechanism – such as the European Commission's Standard Contractual Clauses (SCCs), the EU–US Data Privacy Framework, or a valid adequacy decision – so that your data remains protected in line with the GDPR.

6. Retention

• Account data and uploaded content are kept for as long as you have an active account. You can request deletion at any time.
• Photo books you started but never ordered are deleted automatically: drafts in progress after 7 days without changes, and finished generated books after 60 days. Books with an order are never deleted.
• If you use the service without signing up, an anonymous account tied to your browser is created. It is deleted automatically after 30 days of inactivity, provided no order or photo book is attached to it.
• Order and transaction data subject to bookkeeping requirements are retained for as long as the Norwegian Bookkeeping Act requires (up to five years after the end of the financial year).
• Analytics and usage data are kept for a limited period and, as far as possible, in aggregated or pseudonymised form.
• Enquiries are deleted once they are no longer needed to follow up your request.

7. Your rights

Under data protection law you have the right to:

• request access to the data we hold about you,
• have inaccurate data corrected,
• request erasure of your data (the "right to be forgotten"),
• request restriction of processing,
• object to processing based on legitimate interest,
• request data portability (receive your data in a machine-readable format),
• withdraw a consent you have given, without affecting processing carried out before the withdrawal.

To exercise your rights, contact us at personvern@heymemry.com. We normally respond within 30 days.

8. Cookies

We use necessary cookies and local storage so that sign-in, your language choice and your draft work. They cannot be turned off. Analytics (PostHog) stores nothing on your device until you say yes: without consent we only count page views for the session, without cookies and without recognising you next time. If you say yes, you are remembered between visits, the Meta pixel is loaded to measure our ads (the _fbp and _fbc cookies, up to 90 days), and the ad you came from is remembered for 30 days. You can change your choice at any time with “Cookies” at the bottom of the page, or block cookies in your browser.

9. Security

We use technical and organisational measures to protect your personal data, including encrypted transfer (HTTPS), access controls and storage with reputable, security-focused providers. No transmission or storage is entirely risk-free, but we work continuously to protect your data.

10. Children

The service is not directed at children, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with data, contact us and we will delete it.

11. Changes to this policy

We may update this privacy policy when the service or the law changes. For significant changes we will notify you in an appropriate way. The current version is always available here, with an updated date.

12. Complaints and contact

For privacy questions, contact us at personvern@heymemry.com (or hei@heymemry.com for general help). You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) if you believe we process personal data unlawfully. See datatilsynet.no for more information.