Privacy policy

Last updated 18 October 2026

In short: your photos are used only to repair them for you, and are deleted after 7 days. We keep as little as we can, don't sell anything, don't track you, and don't train any AI on your photos.

Who is responsible

memories.repair is run by Martti Tõldsepp, Lelle 22, 11318 Tallinn, Estonia. Email: [email protected].

What we keep, why, and for how long

• Your photos and their repairs, with the information the camera stored in them (camera model, date taken, and location if the camera recorded it). Used only to repair and show them to you. Deleted automatically 7 days after upload, or as soon as you delete them. Photos of people are personal data; we treat them that way.
• Your account: your email address (and with Google sign-in your name and profile picture from Google), your sign-in sessions (with the IP address and browser they were made from, for your security), your API keys (stored scrambled), and the list of your photos. Kept while you have the account; write to us and we delete it. A session ends after 30 days without use.
• Your credits: purchases (date, pack, Paddle's transaction number) and which photos you downloaded. Kept as long as accounting law requires (7 years in Estonia).
• Technical data: your IP address, held in memory for about an hour to limit how many photos one visitor can upload; and the server's error logs, which are small and overwritten as new entries come in.

The legal grounds (GDPR article 6): providing the service you asked for (b), keeping accounting records (c), and protecting the service from misuse (f).

Cookies and storage in your browser

One cookie keeps you signed in. Your browser also remembers whether you have seen the viewer's guide, and the photos you uploaded before signing in, so they can be added to your account. No advertising or tracking cookies, no analytics, so there is nothing to agree to.

Who else handles data

• Paddle (Paddle.com Market Ltd, UK), our reseller and the Merchant of Record: they take the payment, so your name, address and card details go to them, not to us (Paddle's privacy policy).
• Brevo (France) sends the sign-in emails: your email address and the link.
• Cloudflare runs our domain and network connection, and forwards email sent to us; your requests pass through it.
• Google, only if you choose to sign in with Google.

Your photos and account data are stored on our own server in the EU (Estonia). Where a service above is outside the EU, it works under the EU's safeguards for such transfers.

Your rights

You can ask to see the data we have about you, to have it corrected or deleted, to get it in a portable form, and to object to or limit its use. Write to [email protected]. If you think we handle your data wrongly, please tell us first, so we can put it right. You also have the right to take the matter to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), the authority that oversees data protection.

Changes

If this policy changes, the date at the top changes too; important changes are announced on the site.