Privacy policy

1. Data controller

Jonathan França de Souza, NIF 316017540, address Rua Capitão José Pacheco, 6, 2910-573 Setúbal, Portugal, Portugal. Data protection contact: privacy@memotakes.com.

2. Applicable law

Processing is governed by the General Data Protection Regulation (EU) 2016/679, by Portuguese Law 58/2019 which implements it in the country where the operator is established, and by Spanish data protection rules where the user resides in Spain.

3. What data we process

Only what is needed to provide the service:

• The photo you upload, which contains your facial image.
• The images generated from it.
• Your email address, when you make a purchase.
• The minimum transaction data returned by the payment processor: amount, currency, last digits and outcome. We never receive the full card number.
• A random identifier stored in a technical cookie, linking your credits to your browser.
• Basic technical connection data needed for the service to work and to prevent abuse.

4. About the photos

The image of a face is personal data. We do not use it to uniquely identify any person, we do not run facial recognition and we do not build biometric templates. It is used solely as input to the model that restores your photograph.

5. Purposes and legal bases

Each processing activity has a specific legal basis:

• Restoring the photographs you upload: performance of the contract, plus your express consent regarding the photo you upload.
• Handling payment and issuing the receipt: performance of the contract and legal obligation.
• Letting you recover your credits on another device: performance of the contract.
• Providing support and handling complaints: performance of the contract and legitimate interest.
• Preventing fraud and abuse of the service: legitimate interest.
• Meeting tax and accounting obligations: legal obligation.

6. We do not train models on your images

Your photographs, both the originals and the restored versions, are not used to train or fine tune artificial intelligence models, neither by the operator nor, under the applicable contractual terms, by the processing providers used.

7. Retention periods

We keep each piece of data only as long as strictly necessary:

• The original photograph and the restored one are deleted from our servers after 30 days. You can also delete them earlier, at any time, from the studio.
• Download the high resolution file and keep it on your own device: after that period we cannot recover it.
• Your email and transaction data are kept for 10 years, for tax and accounting obligations.
• The record of your cookie decision is kept for one year.

8. Who we share data with

We work with providers acting as processors that only handle data on our instructions:

• Stripe Payments Europe, to process payment.
• Vercel Inc., for hosting and site delivery.
• The image generation model provider, which receives the photo only for as long as needed to produce the result.
• The database and storage provider, to keep your balance and your photographs.
• The email delivery provider, for the balance recovery link.

9. We do not sell data

We do not sell, rent or transfer personal data to third parties for advertising. We do not send marketing messages without prior and separate consent.

10. International transfers

The operator is established in Portugal, inside the European Economic Area, and data hosting is contracted in facilities located in the European Union. Some providers process data in the United States, so international transfers do take place. They rely on the standard contractual clauses approved by the European Commission and, where the provider is certified, on the European Union and United States Data Privacy Framework.

11. Security

Communications are encrypted in transit. Access to generated images is restricted to the session that created them and files are stored in private repositories. No system is infallible: if a security breach creates a risk to your rights, the competent authority and the affected people will be notified within statutory deadlines.

12. Minors

The service is not aimed at people under 18 and uploading images of minors is not allowed. If we detect a minor data, it is deleted immediately.

13. Your rights

You may exercise the following rights at any time, free of charge:

• Access to the data we process about you.
• Rectification of inaccurate data.
• Erasure of your data and your images.
• Restriction of and objection to processing.
• Portability of the data you provided to us.
• Withdrawal of consent at any time, without affecting the lawfulness of prior processing.
• Information about who your data is shared with and about the consequences of withholding consent.

14. How to exercise them

Write to privacy@memotakes.com from the address linked to your purchase, or from any address providing enough information to verify your identity. We respond within thirty days at most.

15. Complaints

If you believe the processing does not comply with the law, you can complain to the competent supervisory authority: the Comissão Nacional de Proteção de Dados in Portugal, the lead authority as the country where the operator is established, the Agencia Española de Protección de Datos in Spain, or the authority of the country where you live. Before that you can write to privacy@memotakes.com: if the problem can be fixed, that is the fastest way.

16. Cookies

Cookie use is described in the cookie policy, which forms part of this privacy policy.

17. Changes

This policy may be updated. The date of the last revision appears at the top of the page. Substantial changes will be communicated visibly.