Privacy policy

1. Data controller

Maxime Wuillaume, sole trader trading as SENDIX, 2 bis place de la République, 55500 Ligny-en-Barrois, France, is responsible for the processing needed to operate Memolith. Contact: memolith@sendix.fr. Full publisher details are in the legal notice.

The organizer chooses event information and the people with whom the memory book is shared. A purely personal or household use may fall within the GDPR household exemption; this does not remove SENDIX’s own duties. Organizers acting outside that context must determine their duties to the people concerned.

2. Data we use and why

Your account and events

We process your name, email address, hashed password, email verification, notification preferences and event details such as its title, date, description, design, and—if you provide them—venue and address. We use this information to provide the requested service under the contract.

Guest contributions

We receive photos and voice messages you choose to send, their upload time and technical file information. Your first name is optional. Files may contain voices, images or information about other people. Processing lets us collect, convert, display and export the memories. It is based on our legitimate interest in providing the shared guestbook the organizer requested, taking contributors’ and represented people’s rights into account.

If you leave the optional name blank, your contribution is shown as anonymous. That does not make a voice or face unidentifiable and does not prevent collection of technical connection data. Microphone permission in your browser enables recording; it is not general permission to reuse your voice.

Do not upload sensitive information that is not needed, such as health details, political opinions or religious beliefs. Respect the rights of people shown or heard, and obtain parental-responsibility holders’ permission for a child. You can contribute without giving your name and ask us to remove a memory.

Invitations and service emails

When an organizer invites a co-organizer, we use the email address they provide to send and manage the invitation. This is based on our legitimate interest in enabling the requested collaboration. Verification, password recovery and new-memory notifications support the account. Notification preferences can be changed in the profile.

Visits, security and support

When an event page is visited, we record the IP address, browser information and visit time for event view statistics. Technical logs support troubleshooting, abuse prevention and security. These activities are based on our legitimate interests in understanding use of the service and protecting it. We use support messages to reply, based on the contract or our legitimate interest in responding to visitor requests.

Required form fields are marked; without them, the related action cannot be completed. You or the organizer and other participants provide content. Memolith does not make automated decisions that have legal or similarly significant effects on you.

3. Access to memories and recipients

The organizer and authorized co-organizers can view and download contributions from their accounts. Guests can submit without signing up. Anyone with the event link or QR code can open the guest page and see its presentation details. The link can be forwarded and is not individual authentication.

Design images are available at their public address. Do not include a private home address or other information you do not want to share. Files downloaded by organizers can remain in their own copies; deleting them from Memolith does not delete those copies.

Authorized SENDIX staff and technical providers responsible for hosting, email delivery and maintenance may process data needed for their work. OVH provides hosting. We may also provide data to public authorities when legally required.

4. How long we keep data

• Account: while the service is provided and until a deletion request is handled, subject to data needed for a legal duty or dispute.
• Events, memories and visit statistics: while the organizer keeps the guestbook, until the event or relevant content is deleted. Closing guest contributions does not automatically delete memories.
• Invitations: invitation links work for seven days. Expiry prevents use of the link but does not automatically delete its record, which remains linked to event management.
• Exports: downloads are available for 24 hours after generation. Expired exports are cleaned up during a later event export-management operation; expiry does not mean immediate deletion.
• Support and technical logs: as long as needed to answer a request, diagnose an incident or defend a legal claim. Data relevant to a dispute may be kept with restricted access for the applicable legal periods.

We assess deletion requests under the rules below. Residual technical backup copies may remain until those backups are rotated; they are used only for service continuity and restoration.

5. Cookies, local storage and third-party services

If you choose to leave a review from the dashboard, The Web Ratings form loads at your request. Your name and email address are sent to this service to verify your review, which will be published on its platform. This integration does not send any audio memories, photos or private event links. Leaving a review is optional.

Memolith uses cookies required for sessions, sign-in and form protection. Session inactivity timeout is 120 minutes. Your browser may also cache app resources and the choice you make about the installation prompt. You can clear these in your browser settings; doing so may sign you out.

Memolith uses Google Analytics to measure site traffic and understand service use. The Google Analytics tag loads automatically when pages open, without asking you to accept cookies first. Google signals and advertising personalization are disabled in the tag configuration.

Google may receive technical visit information and set related Analytics cookies as soon as the tag loads. See Google’s privacy policy. Event-specific view statistics are also calculated server-side from the visits described above.

Google Fonts and a JavaScript library provided by jsDelivr load from their servers. These requests share your IP address and technical connection details with those providers. Depending on their infrastructure, they may process data outside the European Economic Area. Read the policies of Google and jsDelivr.

If an organizer provides a venue, its address may be sent to Nominatim to look up geographic coordinates. Map and route providers receive the information needed to display a map or open directions. See OpenStreetMap’s privacy policy. Do not enter a private address unless it is needed for the event.

6. Exercise your rights

Under the GDPR, you may request access, correction, deletion or restriction of your data, and data portability where automated processing is based on a contract or consent. You may object to processing based on legitimate interests for reasons relating to your situation. You can withdraw consent at any time when processing is based on consent; this does not affect earlier processing.

You may also set instructions under French law about what should happen to your data after your death.

Email memolith@sendix.fr with your request and, if relevant, the event link or contribution concerned. You do not need an account. We will ask for more information or identity evidence only if we have reasonable doubts about your identity.

We generally respond within one month. If the complexity or number of requests justifies an extension, we will let you know within that month; an extension may be up to two additional months. Some rights may be limited by a legal duty or another person’s rights.

You may ask the organizer to remove a memory or contact SENDIX directly. You can also lodge a complaint with the French data protection authority, the CNIL.

7. Security and updates

The service uses measures including password hashing, access controls for management spaces and upload rate limits. Protect your sign-in details and tell us if a link or account has been used without your permission.

This policy changes as the service develops. The update date appears at the top of the page. We will use an appropriate notice for material changes to data processing.