Privacy Policy
Version 2026-09-15. This policy exists in English, French and Spanish; each version is binding for the readers of that language.
1. Who is responsible
The data controller is A. Alae, an individual entrepreneur established in Tangier, Morocco, trading as Pictomemo ("Pictomemo", "we"). Contact for anything about your data: contact@pictomemo.com. We process personal data under Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data and, for people in the European Economic Area, the United Kingdom and Switzerland, under the GDPR and the equivalent laws of those territories.
2. What this policy covers
It covers pictomemo.com and every part of the Service: the website, your account, the books you build, the digital and printed products you order, and the emails we send. It does not cover third-party sites we link to.
3. The data we process, and why
| Data | Where it comes from | Why we process it | Legal basis |
|---|---|---|---|
| Account data: name, email address, password (hashed), country, language, terms acceptance, sign-in method (password or Google), notification choices | You, or Google if you sign in with it | Create and secure your account, sign you in, apply the right consent rules for your country, send account emails | Contract; legal obligation for the terms record |
| Your photos and everything derived from them: resized copies, metadata read from the files (date, camera orientation, GPS location when present), quality scores, groupings, captions, the layout of your book, the names you give to people and pets | You | Build, show, edit, print and deliver your book | Contract; explicit consent for face grouping where required (section 6) |
| Order data: product, quantity, amounts, order number, payment reference (not your card number), shipping address and phone, order status, tracking | You, PayPal, Lulu | Take payment, print and ship, handle cancellations, refunds and support, keep accounting records | Contract; legal obligation (accounting, tax) |
| Messages you send us: contact form, report form, data requests, email | You | Answer you, handle reports and requests, keep a record of what was decided | Legitimate interest; legal obligation for data requests |
| Technical data: IP address (hashed in our rate-limit records), browser, device, pages viewed, errors, timestamps, cookies described in section 9 | Your browser | Keep the Service secure, prevent abuse, fix errors, understand how the Service is used | Legitimate interest; consent for analytics cookies and fingerprinting |
| Email delivery data: bounces, complaints, opens of transactional emails where the provider reports them | Amazon SES | Stop sending to addresses that bounce or complain | Legitimate interest |
We do not ask for and do not want special categories of data (health, religion, politics, sexual life). Photos may reveal such things incidentally; we process them only to make your book, never to infer or record such characteristics.
4. Automated processing and artificial intelligence
Your book is proposed by automated systems: duplicates and low-quality photos are detected on our servers; photos are grouped by date and place; a selection, chapter structure, captions and layouts are produced with the help of artificial-intelligence models operated by OpenAI (see section 8). The output is a proposal that you review and can change before you order. No decision with legal or similarly significant effect on you is made automatically. Your photos are never used to train any model, ours or a provider's; our contracts with providers forbid it.
5. Photos of other people, and of children
Your photos usually show other people. You are responsible for having the right to use them, including consent from adults and from a parent or guardian for children (see the Terms). We process those images only as your processor-like helper to make the book you ordered. If someone appears in a book without their consent, they can ask us to act through the report form. The Service is for adults; we do not knowingly hold accounts of anyone under 18.
6. Face grouping
To let you name the people and pets in a book ("Emma", "Dad", "Biscuit") so that captions can use those names, we may compute a short-lived numerical signature of each face in your photos and group similar ones within that book only. This is used solely to group your own photos; signatures are never compared with anyone else's photos, never used to identify people, never shared, and are deleted when the book is deleted or, at the latest, 90 days after your last activity. Because this may be biometric data under some laws, we ask for your explicit consent before doing it if you are in the EEA, the United Kingdom or Switzerland; elsewhere it is part of the Service and you can decline it on the same screen. Declining means the book is built without names; every caption remains editable by you.
7. How long we keep data
- Original photos: 90 days after your last order or last visit, then deleted (we email you a week before).
- Books built by a visitor without an account: 7 days after the last activity.
- Unfinished books in an account: 60 days after the last activity, with an email at day 53.
- Purchased books, their layout and their PDF: while your account exists.
- Face signatures: with the book, at most 90 days after the last activity.
- Account: until you delete it; deletion becomes final 14 days after your request, and everything in the account is then erased.
- Orders, invoices and payment references: 10 years, as required by Moroccan accounting and tax law, in a form that no longer contains your photos.
- Messages and data requests: 3 years after the last exchange.
- Server logs: 14 days. Error reports: 90 days.
- Backups of the database: 30 days; deleted data leaves backups within that period. Photos are not in database backups.
8. Who receives your data
We share data only with providers that act on our instructions under contract, and with authorities when the law requires it. We do not sell personal data and do not share it for advertising.
| Provider | Role | Data | Location |
|---|---|---|---|
| Amazon Web Services, Inc. (EC2, S3, SES) | Hosting, storage of photos and PDFs, sending our emails | Everything in the Service | United States (us-east-1) |
| OpenAI, L.L.C. | Image analysis for selection, captions and layout | Photos that pass our local quality filter, and the notes you give about the book; no account data | United States; no training on your data under our contract |
| PayPal | Payment processing | Order amount, your name and email; card data goes to PayPal, never to us | Luxembourg / United States, depending on your region |
| Lulu Press, Inc. | Printing and shipping of printed books | The print file of your book, your name, shipping address and phone | United States and its print facilities near you |
| ScoutVibe | Product analytics on our site, with your consent | Page views, device fingerprint, events such as "signed up" (no photos, no names) | United States |
| Google LLC | Sign in with Google, if you choose it | Your Google email, name and account identifier | United States |
| Functional Software, Inc. (Sentry) | Error monitoring | Technical error reports with request identifiers; no email addresses or names are sent | United States |
| Namecheap, Inc. | Forwarding of email sent to our contact addresses | Messages you send to contact@pictomemo.com | United States |
Where these providers are outside your country, the transfer relies on your contract with us (it is necessary to provide the Service), on the providers' standard contractual clauses approved by the European Commission, and, for Morocco, on the CNDP's rules on transfers. You can ask us for a copy of the safeguards.
9. Cookies and similar technologies
Essential (no consent needed): a session cookie that keeps you signed in, a "remember me" cookie for 30 days, a signed visitor cookie for books built without an account (7 days), a language cookie, and a security token against forged requests. Analytics (only with your consent, asked in the banner): ScoutVibe's tracker, which uses a device fingerprint and a cookie to recognise repeat visits and to attribute sign-ups to the page they came from. You can change your choice at any time through "Cookie preferences" in the footer. We do not use advertising cookies.
10. Security
Photos and PDFs are stored in private storage with server-side encryption and are served through short-lived signed links; passwords are hashed; connections use HTTPS; sign-ins are rate-limited and locked after repeated failures; access to production systems is limited to the people who run the Service. No system is perfectly secure: keep your own copies of your photos, and use a strong, unique password. If a breach affects your data, we tell you and the competent authority as the law requires.
11. Your rights
You can, at any time: access the data we hold about you; get a copy of it in a portable form (your account page has an "Export my data" button that prepares a ZIP with your profile, books and original photos); correct it; delete it (delete a book from "My books", or your whole account from the account page); object to processing based on our legitimate interests; restrict processing in the situations the law provides; withdraw a consent (face grouping, analytics) without affecting what was done before; and complain to a supervisory authority: the CNDP in Morocco (cndp.ma), or the authority of your country of residence in the EEA, the UK (ICO) or Switzerland (FDPIC).
For anything not covered by the self-serve buttons, use the data request form or write to contact@pictomemo.com. We answer within 30 days and may ask you to confirm your identity first. Rights requests are free unless clearly excessive.
12. Marketing
We send transactional emails you need (receipts, password resets, book ready, deletion notices). Optional emails (tips, product news) are sent only if you opt in on your account page, and every one has an unsubscribe link. We do not do third-party marketing.
13. Changes to this policy
We may update this policy. Material changes are announced on the site or by email before they take effect. The version and date at the top tell you which version applies.
14. Contact
A. Alae, trading as Pictomemo, Tangier, Morocco. contact@pictomemo.com. See also the Terms of Service and, for business customers, the Data Processing Agreement.