Privacy Policy
You are trusting us with photos of someone you loved and with your family's memories. This page explains, in plain words, what we do with them. The short version: we use your photos only to make your film and card, we never use them to train AI models, we do not sell or share them for advertising, and we delete the original photos 30 days after delivery. If you choose to share the film, it plays on a private page only people with the link can open; if you also choose to keep it online for a year, we keep only the finished film, a still from it and the card — never the photos.
1. Who we are
In Memoriam Film is operated by SoundCam Productions Kft., 2364 Ócsa, Üllői utca 48., Hungary (company registration number 13-09-211186, Budapest Környéki Törvényszék Cégbírósága; VAT number 13580100-2-13). We are the controller of your personal data under the EU General Data Protection Regulation (GDPR) and the UK GDPR.
Privacy questions and requests: privacy@inmemoriamfilm.com. Everything else: support@inmemoriamfilm.com. We have not appointed a data protection officer because the law does not require one for our activity.
2. What we collect, why, and on what legal basis
| Data | Why we use it | Legal basis |
|---|---|---|
| Your name, email address, billing country and order details | To take your order, deliver the film and card, and contact you about it | Contract (GDPR Art. 6(1)(b)) |
| Photos and video clips you upload | To restore, order, gently animate and assemble them into your film and card | Contract (Art. 6(1)(b)) |
| Your answers about the person (names, dates, places, stories) | To write the short life story for the card and narration, only from what you tell us | Contract (Art. 6(1)(b)) |
| Images of other living people who appear in your photos | Only as part of your film; delivered privately to you | Legitimate interests (Art. 6(1)(f)) — making the memorial film you asked for, with strict limits (see section 4) |
| Payment details | Handled by Stripe; we never see your full card number | Contract; Stripe also acts as an independent controller for fraud prevention and its own legal duties |
| Invoices and accounting records | Required by Hungarian accounting and tax law | Legal obligation (Art. 6(1)(c)) |
| Your consent choices at checkout (with time and version) | To show what you agreed to | Legal obligation and legitimate interests (Art. 6(1)(c) and (f)) |
| E-mail addresses you enter in “Send it by e-mail for me”, your name and your message (optional) | To send the link to the film once, to the people you chose. We do not keep the addresses: they are used for the send and dropped; we keep only how many e-mails went | Contract with you (Art. 6(1)(b)); for the recipients, legitimate interests (Art. 6(1)(f)) — delivering a message the family asked us to send, once, with no follow-up |
| Your choice to share the film and keep it online | To show the film to the people you send the link to, for as long as you chose | Contract (Art. 6(1)(b)) |
| Support messages | To help you | Contract or legitimate interests |
| Technical data (IP address, browser, error logs) | To keep the service secure and working | Legitimate interests (Art. 6(1)(f)) |
We do not need, and ask you not to upload, health records, ID documents or intimate images.
3. The person who has died
The GDPR does not apply to the personal data of people who have died (Recital 27). We still treat their photos and story with the same care as everyone else's. Some national laws give close relatives rights over a deceased person's data or memory — for example, in Hungary a close relative may exercise data rights for five years after death (Infotv. § 25). If you are a close relative and object to a film about someone in your family, contact us and we will look at it promptly and sensitively.
4. Other people in the photos, including children
Family photos show other people: partners, children, grandchildren, friends. They do not deal with us directly, so this page is how we tell them what happens (GDPR Art. 14(5)(b)). Before ordering, the person uploading confirms that they have the right to use the photos and that the people shown agree, or that they are acting for the family.
- Their images are used only to make the film the family asked for.
- The film is delivered privately to the person who ordered it. We never publish it. If the family shares it, it plays on an unlisted page that only people with the link can open and that search engines are told not to index; the family can stop it at any time.
- We do not use face recognition, build face templates, identify or tag anyone, or link faces across orders.
- We do not use any photo to train AI models.
- Original photos are deleted 30 days after delivery (see section 8).
- Anyone who appears in a film can ask us to remove or blur them: write to privacy@inmemoriamfilm.com.
Photos of children are welcome as part of a family's memories. We apply the same limits, and we refuse uploads that are intimate or sexual, or that show public figures or celebrities.
5. What we never do
- Train AI models on your photos, videos, documents, voice or stories.
- Sell or “share” your personal data (in the CCPA sense) or use it for targeted advertising.
- Clone anyone's voice or create a talking avatar of the person who died.
- Make the film public, or use it as an example, unless you separately opt in (and you can withdraw that at any time).
- Make automated decisions about you that have legal or similarly significant effects (GDPR Art. 22).
6. Who processes data for us
We use the following service providers (processors) under written data processing agreements (GDPR Art. 28). They may only use your data to provide their service to us.
| Provider | What it does for us | What it sees | Where / safeguard |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, storage, database, sign-in, email | Everything you send us | Frankfurt, Germany (eu-central-1). AWS DPA with Standard Contractual Clauses; Amazon is certified under the EU-US Data Privacy Framework |
| Stripe | Payments and fraud prevention | Name, email, billing details, payment card (Stripe only) | EU and US. Stripe DPA with SCCs (incl. UK addendum); Data Privacy Framework certified |
| Google (Gemini API, Lyria) | Putting photos in date order, photo restoration, writing aids; instrumental music | Selected photos and the text you provide; music prompts contain no personal data | Paid API under Google’s processor terms; may be processed in any country Google operates in; SCCs and Data Privacy Framework. Paid-tier data is not used to improve Google’s products |
| ElevenLabs | Optional narration of the life story | The life-story text | US by default. ElevenLabs DPA with SCCs; Data Privacy Framework certified |
| xAI | Animating selected photos (video) | The selected photos | US. SCCs. xAI states it does not train on API data without permission |
| RunPod | GPU servers that run our restoration, animation and video-export software | Selected photos and the frames made from them | RunPod DPA with SCCs; we use EU data centers where available |
| Anthropic | Writing aids for the life-story text and support replies | Text you provide | US. Anthropic DPA with SCCs; no training on our data |
| KBOSS.hu Kft. (Számlázz.hu) | Issuing invoices | Name, billing address, amount | Hungary |
Some providers keep data briefly for abuse monitoring or caching (for example, Google keeps Gemini API prompts and outputs for up to 55 days for abuse monitoring; Anthropic deletes API data within 30 days; RunPod deletes job results within minutes). We choose zero-retention options where they are available to us.
7. International transfers
Our main systems are in the EU (Frankfurt). Some providers above process data in the United States. Where a provider is certified under the EU-US Data Privacy Framework (and its UK Extension) we rely on that; otherwise we use the European Commission’s Standard Contractual Clauses (2021/914) and, for the UK, the International Data Transfer Addendum. You can ask us for a copy of the relevant safeguards.
8. How long we keep things
| Data | Kept for |
|---|---|
| Original photos and video clips you upload | 30 days after we deliver your film, then deleted automatically |
| Documents you upload (a life description, a poem, an obituary draft) and the text we read from them | 30 days after delivery, then deleted automatically with the order; removing a document deletes it at once |
| Working files (restored frames, animated clips) | 30 days after delivery, with the order |
| The finished film and memorial card (downloads) | 30 days after delivery, then deleted automatically with the order |
| A film you chose to keep online for a year | A copy of the finished film, a still picture from it and the memorial card: 365 days from the day you chose it (if you change the film within the first 30 days, the year starts again from the new version, and the page shows the date), then deleted automatically. Stopping sharing deletes it at once |
| The share link’s record (who the film is in memory of, the years) | As long as the film is shared, at most 30 days after delivery — or as long as the film is kept online |
| Addresses entered in “Send it by e-mail for me” | Not kept: used for the send only |
| Order, consent and support records | For as long as claims about the order could be made (generally 5 years under Hungarian civil law) |
| Invoices and accounting records | 8 years (Hungarian Accounting Act, § 169) |
| Security logs | Up to 90 days |
You can ask us to delete your photos and film sooner, at any time. A film kept online can be deleted at once from your order page or My films.
9. Your rights
Under the GDPR and UK GDPR you can ask us for access to your data, a copy in a portable format, correction, deletion, restriction, and you can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. Write to privacy@inmemoriamfilm.com; we reply within one month.
You can complain to a data protection authority: in Hungary, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) (naih.hu); in the UK, the Information Commissioner’s Office (ico.org.uk); or the authority where you live or work. We would appreciate the chance to put things right first.
10. If you live in the United States
We do not sell personal information and do not “share” it for cross-context behavioural advertising, as those terms are used in the California Consumer Privacy Act (CCPA). We honor Global Privacy Control signals. Whatever state you live in, you can ask to know, correct or delete the personal information we hold about you, and we will not treat you differently for asking.
11. Cookies
On inmemoriamfilm.com we use only the storage needed for the site to work, unless you agree to more. Details: Cookie Policy.
12. Security
Data is encrypted in transit and at rest. Films and photos are stored privately and shared only through links that are hard to guess and that you control. Our staff and providers access them only when needed to make or support your order.
13. Changes
If we change how we use your data in a way that matters, we will update this page and tell customers with an open order by email. The version and date are at the top.
Sources we checked
- AWS Data Processing Addendum — Amazon Web Services (read October 5, 2026)
- AWS Service Terms — Amazon Web Services, October 1, 2026 (read October 5, 2026)
- Stripe Data Processing Agreement — Stripe, September 28, 2026 (read October 5, 2026)
- Gemini API Additional Terms of Service — Google (read October 5, 2026)
- Google Ads/Cloud processor terms (v10) — Google, May 7, 2026 (read October 5, 2026)
- Gemini API zero data retention — Google (read October 5, 2026)
- ElevenLabs Data Processing Addendum — ElevenLabs, April 8, 2026 (read October 5, 2026)
- xAI API security FAQ — xAI (read October 5, 2026)
- RunPod Data Processing Agreement — RunPod (read October 5, 2026)
- Anthropic Data Processing Addendum — Anthropic (read October 5, 2026)
- Anthropic commercial terms — Anthropic (read October 5, 2026)
- Data Privacy Framework list — U.S. Department of Commerce (read October 5, 2026)
- CCPA thresholds (CPI adjustment) — California Privacy Protection Agency (read October 5, 2026)
- UK GDPR and the EU: representatives — ICO (read October 5, 2026)