Skip to content

Privacy Policy

You are trusting us with photos of someone you loved and with your family's memories. This page explains, in plain words, what we do with them. The short version: we use your photos only to make your film and card, we never use them to train AI models, we do not sell or share them for advertising, and we delete the original photos 30 days after delivery.

1. Who we are

In Memoriam Film is operated by SoundCam Productions Kft., 2364 Ócsa, Üllői utca 48., Hungary (company registration number 13-09-211186, Budapest Környéki Törvényszék Cégbírósága; VAT number 13580100-2-13). We are the controller of your personal data under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

Privacy questions and requests: privacy@inmemoriamfilm.com. Everything else: support@inmemoriamfilm.com. We have not appointed a data protection officer because the law does not require one for our activity.

2. What we collect, why, and on what legal basis

DataWhy we use itLegal basis
Your name, email address, billing country and order detailsTo take your order, deliver the film and card, and contact you about itContract (GDPR Art. 6(1)(b))
Photos and video clips you uploadTo restore, order, gently animate and assemble them into your film and cardContract (Art. 6(1)(b))
Your answers about the person (names, dates, places, stories)To write the short life story for the card and narration, only from what you tell usContract (Art. 6(1)(b))
Images of other living people who appear in your photosOnly as part of your film; delivered privately to youLegitimate interests (Art. 6(1)(f)) — making the memorial film you asked for, with strict limits (see section 4)
Payment detailsHandled by Stripe; we never see your full card numberContract; Stripe also acts as an independent controller for fraud prevention and its own legal duties
Invoices and accounting recordsRequired by Hungarian accounting and tax lawLegal obligation (Art. 6(1)(c))
Your consent choices at checkout (with time and version)To show what you agreed toLegal obligation and legitimate interests (Art. 6(1)(c) and (f))
Support messagesTo help youContract or legitimate interests
Technical data (IP address, browser, error logs)To keep the service secure and workingLegitimate interests (Art. 6(1)(f))

We do not need, and ask you not to upload, health records, ID documents or intimate images.

3. The person who has died

The GDPR does not apply to the personal data of people who have died (Recital 27). We still treat their photos and story with the same care as everyone else's. Some national laws give close relatives rights over a deceased person's data or memory — for example, in Hungary a close relative may exercise data rights for five years after death (Infotv. § 25). If you are a close relative and object to a film about someone in your family, contact us and we will look at it promptly and sensitively.

4. Other people in the photos, including children

Family photos show other people: partners, children, grandchildren, friends. They do not deal with us directly, so this page is how we tell them what happens (GDPR Art. 14(5)(b)). Before ordering, the person uploading confirms that they have the right to use the photos and that the people shown agree, or that they are acting for the family.

  • Their images are used only to make the film the family asked for.
  • The film is delivered privately to the person who ordered it. We never publish it.
  • We do not use face recognition, build face templates, identify or tag anyone, or link faces across orders.
  • We do not use any photo to train AI models.
  • Original photos are deleted 30 days after delivery (see section 8).
  • Anyone who appears in a film can ask us to remove or blur them: write to privacy@inmemoriamfilm.com.

Photos of children are welcome as part of a family's memories. We apply the same limits, and we refuse uploads that are intimate or sexual, or that show public figures or celebrities.

5. What we never do

  • Train AI models on your photos, videos, voice or stories.
  • Sell or “share” your personal data (in the CCPA sense) or use it for targeted advertising.
  • Clone anyone's voice or create a talking avatar of the person who died.
  • Make the film public, or use it as an example, unless you separately opt in (and you can withdraw that at any time).
  • Make automated decisions about you that have legal or similarly significant effects (GDPR Art. 22).

6. Who processes data for us

We use the following service providers (processors) under written data processing agreements (GDPR Art. 28). They may only use your data to provide their service to us.

ProviderWhat it does for usWhat it seesWhere / safeguard
Amazon Web Services (AWS)Hosting, storage, database, sign-in, emailEverything you send usFrankfurt, Germany (eu-central-1). AWS DPA with Standard Contractual Clauses; Amazon is certified under the EU-US Data Privacy Framework
StripePayments and fraud preventionName, email, billing details, payment card (Stripe only)EU and US. Stripe DPA with SCCs (incl. UK addendum); Data Privacy Framework certified
Google (Gemini API, Lyria)Putting photos in date order, photo restoration, writing aids; instrumental musicSelected photos and the text you provide; music prompts contain no personal dataPaid API under Google’s processor terms; may be processed in any country Google operates in; SCCs and Data Privacy Framework. Paid-tier data is not used to improve Google’s products
ElevenLabsOptional narration of the life storyThe life-story textUS by default. ElevenLabs DPA with SCCs; Data Privacy Framework certified
xAIAnimating selected photos (video)The selected photosUS. SCCs. xAI states it does not train on API data without permission
RunPodGPU servers that run our restoration, animation and video-export softwareSelected photos and the frames made from themRunPod DPA with SCCs; we use EU data centres where available
AnthropicWriting aids for the life-story text and support repliesText you provideUS. Anthropic DPA with SCCs; no training on our data
KBOSS.hu Kft. (Számlázz.hu)Issuing invoicesName, billing address, amountHungary

Some providers keep data briefly for abuse monitoring or caching (for example, Google keeps Gemini API prompts and outputs for up to 55 days for abuse monitoring; Anthropic deletes API data within 30 days; RunPod deletes job results within minutes). We choose zero-retention options where they are available to us.

7. International transfers

Our main systems are in the EU (Frankfurt). Some providers above process data in the United States. Where a provider is certified under the EU-US Data Privacy Framework (and its UK Extension) we rely on that; otherwise we use the European Commission’s Standard Contractual Clauses (2021/914) and, for the UK, the International Data Transfer Addendum. You can ask us for a copy of the relevant safeguards.

8. How long we keep things

DataKept for
Original photos and video clips you upload30 days after we deliver your film, then deleted automatically
Working files (restored frames, animated clips)7 days after delivery
The finished film and memorial card12 months, so you can download them again, or until you ask us to delete them
Order, consent and support recordsFor as long as claims about the order could be made (generally 5 years under Hungarian civil law)
Invoices and accounting records8 years (Hungarian Accounting Act, § 169)
Security logsUp to 90 days

You can ask us to delete your photos and film sooner, at any time.

9. Your rights

Under the GDPR and UK GDPR you can ask us for access to your data, a copy in a portable format, correction, deletion, restriction, and you can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. Write to privacy@inmemoriamfilm.com; we reply within one month.

You can complain to a data protection authority: in Hungary, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) (naih.hu); in the UK, the Information Commissioner’s Office (ico.org.uk); or the authority where you live or work. We would appreciate the chance to put things right first.

10. If you live in the United States

We do not sell personal information and do not “share” it for cross-context behavioural advertising, as those terms are used in the California Consumer Privacy Act (CCPA). We honour Global Privacy Control signals. Whatever state you live in, you can ask to know, correct or delete the personal information we hold about you, and we will not treat you differently for asking.

11. Cookies

On inmemoriamfilm.com we use only the storage needed for the site to work, unless you agree to more. Details: Cookie Policy.

12. Security

Data is encrypted in transit and at rest. Films and photos are stored privately and shared only through links that are hard to guess and that you control. Our staff and providers access them only when needed to make or support your order.

13. Changes

If we change how we use your data in a way that matters, we will update this page and tell customers with an open order by email. The version and date are at the top.

Sources we checked

  1. AWS Data Processing Addendum — Amazon Web Services (read 2026-10-05)
  2. AWS Service Terms — Amazon Web Services, 2026-10-01 (read 2026-10-05)
  3. Stripe Data Processing Agreement — Stripe, 2026-09-28 (read 2026-10-05)
  4. Gemini API Additional Terms of Service — Google (read 2026-10-05)
  5. Google Ads/Cloud processor terms (v10) — Google, 2026-05-07 (read 2026-10-05)
  6. Gemini API zero data retention — Google (read 2026-10-05)
  7. ElevenLabs Data Processing Addendum — ElevenLabs, 2026-04-08 (read 2026-10-05)
  8. xAI API security FAQ — xAI (read 2026-10-05)
  9. RunPod Data Processing Agreement — RunPod (read 2026-10-05)
  10. Anthropic Data Processing Addendum — Anthropic (read 2026-10-05)
  11. Anthropic commercial terms — Anthropic (read 2026-10-05)
  12. Data Privacy Framework list — U.S. Department of Commerce (read 2026-10-05)
  13. CCPA thresholds (CPI adjustment) — California Privacy Protection Agency (read 2026-10-05)
  14. UK GDPR and the EU: representatives — ICO (read 2026-10-05)