Loading…
Last Updated: April 8, 2026 | Effective Date: April 8, 2026
OurMemory ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our photo-sharing platform.
This policy describes our practices with reference to the Israeli Privacy Protection Law (PPL) 1981 including Amendment 13 (2025), and to common international frameworks such as the GDPR, where relevant. It is not a legal opinion on compliance.
OurMemory
For privacy inquiries and data subject requests, use our Privacy Request portal.
For photo-specific privacy concerns, use our photo removal request page.
⚠️ Especially Sensitive Data (Israeli Amendment 13)
Photos: Full event photos and videos you upload are stored in our object storage (see below) so they can be shown in galleries. Face matching: We also derive and store numerical face descriptors (vectors), face IDs, and bounding boxes in our database for recognition features. Descriptors are not the same as storing a separate portrait photo solely for biometric enrollment, but your images may visibly depict people.
Face recognition requires your explicit consent. You can opt out at any time and delete all your facial data from your account settings.
Photos sometimes contain embedded GPS coordinates in their EXIF data. We attempt to strip EXIF from image files before storage and only keep non-sensitive fields we extract (capture time, camera model) in our database. If stripping fails for a particular file, embedded metadata may remain in the stored object.
When you upload photos to an event gallery, those photos may include other individuals who did not upload them. Event guests who appear in a photo without their consent may request removal via our photo removal page.
We process your data based on the following legal grounds:
1. Consent
You explicitly agree to AI face recognition and photo processing
2. Contract
Processing necessary to provide our photo-sharing service
3. Legitimate Interest
Fraud prevention, service improvement, and security monitoring
4. Legal Obligation
Compliance with Israeli law, tax reporting, and data breach notification
We NEVER:
Photos uploaded to an event gallery are visible to all guests who have access to that event. This is the core purpose of the Service.
We share data with trusted third-party providers who help us operate the Service:
The live (production) OurMemory service stores application data in Neon (PostgreSQL), media files in Cloudflare R2, and runs on Vercel. Development and test environments may use other databases or storage (for example SQLite or alternate providers); only the production configuration processes live customer data as described here.
We may disclose your data if required by law, such as:
If OurMemory is acquired or merged with another company, your data may be transferred to the new owner. We will notify you via email before any such transfer.
Content for an event remains until the event (or your account) is removed according to our product flows and database rules. Subscription tier affects usage limits and features—not a separate automatic deletion schedule unless we explicitly implement and disclose it.
When an event is deleted, we use a soft delete followed by permanent removal after a grace period controlled by our configuration (default 30 days, adjustable via DELETED_EVENT_RETENTION_DAYS). A scheduled job removes expired events and associated storage objects.
Facial descriptors are automatically deleted on a daily cleanup schedule, and may be deleted sooner when you withdraw consent, delete face data, or when events and related records are removed.
When you request account deletion through the Service, we process it according to our account deletion endpoint (typically in one step, without a multi-day grace period unless we state otherwise in the product).
Hosting and database providers (for example Neon, Cloudflare, Vercel) may retain backups for their own disaster recovery. Retention follows their policies and is not fully under our control.
Under Israeli and EU law, you have the following rights:
Right to Access
Download all your data via the "Download My Data" button in your account settings
Right to Correction
Edit your profile, event settings, and delete individual photos anytime
Right to Deletion (Right to be Forgotten)
Delete your account and all data via the "Delete Account" button
Right to Object
Disable face recognition and delete all facial descriptors from your account settings
Right to Data Portability
Export your data in machine-readable format (JSON)
Right to Withdraw Consent
Revoke biometric consent anytime—we'll delete all your face data immediately
To exercise your rights, visit your Privacy Settings, use our Privacy Request portal. We aim to respond without undue delay.
We implement industry-standard security measures to protect your data:
Note: No security system is 100% secure. While we implement best practices, we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials.
In production, personal data is processed using infrastructure outside Israel, including Cloudflare R2 (object storage), Neon (PostgreSQL regions as configured for our project), and Vercel (compute, regions as configured). Development setups may differ.
Adequacy Decision: Israel has an adequacy decision from the EU, meaning Israeli law provides adequate data protection for EU citizens. Data transfers between Israel and the EU are permitted without additional safeguards.
We use Sentry to catch bugs and improve reliability. Sentry may use session replay, which records user interactions in the browser (similar to a screen recording) solely to help us reproduce and fix errors. This is optional and you can decline it in the cookie banner.
You can choose your preferences in the cookie banner when you first visit, or reload the page and click "Customize preferences" in the banner. Declining non-essential cookies does not affect core functionality.
This platform operates under the Israeli Privacy Protection Law (PPL) 1981 as amended by Amendment 13 (2025). The following provisions apply to all biometric data processing:
To exercise any privacy right under Israeli law, use our Privacy Request portal or read our AI & Biometric Data Policy for an operational summary.
OurMemory is not intended for children under 13 years of age. We do not knowingly collect personal data from children under 13.
If we discover that a child under 13 has provided us with personal data, we will delete it immediately. Parents or guardians who believe their child has provided us with data should submit a request via our Privacy Request portal.
If we become aware of a personal data breach that affects you, we will take reasonable steps to investigate and mitigate, and we will provide notices and filings as required by applicable law (including timing and recipients). We may also publish a summary on our website for serious incidents.
Depending on the incident, we may:
What to do if you receive a breach notification:
We may update this Privacy Policy from time to time. When we make material changes, we will:
Your continued use of the Service after the effective date constitutes acceptance of the updated Privacy Policy. If you do not agree, you must stop using the Service and may request account deletion.
For privacy inquiries and data subject requests:
Submit privacy and legal requests through the Privacy Request portal.
For image-related requests, use the photo removal page.
OurMemory
We aim to respond to privacy inquiries without undue delay.
מדיניות הפרטיות זמינה גם בעברית. לחץ כאן לגרסה העברית
In the event of any conflict between the English and Hebrew versions, the Hebrew version shall prevail for Israeli customers; the English version governs for international users.