Privacy Policy

The controller of personal data is:

For any questions or requests concerning personal data, please write to us at hello@grandparentalbum.com. We have not appointed a data protection officer, as the law does not require us to do so.

Account data

• name, email address and sign-in details;
• account settings and email settings.

Album data

• uploaded photos, album titles, captions and gift messages;
• chosen layouts, cropping, the cover and the recipient’s name;
• details of invited family contributors.

Order and delivery data

• the recipient’s name, delivery address and telephone number for the delivery service;
• details of the order, plan, binding and extra copies;
• dispatch and tracking details, and invoices.

Payment data

Payments are processed by the payment service provider Stripe. We do not receive or store full payment card numbers; we receive only information about the outcome of the payment and transaction identifiers.

Technical data

• IP address, browser and device information;
• information about your use of the service and the pages you visit;
• cookies and similar technologies, as described on the Cookies page.

We receive most data directly from you. Data about the album’s recipient and the people in the photos is provided to us by the purchaser or by the contributor who uploads it.

• Performance of a contract (Article 6(1)(b) UK GDPR): managing your account, creating albums, preparing the preview and print files, printing and delivery, processing payments, order notifications and customer support.
• Legal obligations (Article 6(1)(c) UK GDPR): issuing and keeping invoices and accounting records, handling complaints about defects, and responding to lawful requests from competent authorities.
• Legitimate interests (Article 6(1)(f) UK GDPR): ensuring the security of the service, preventing misuse and fraud (including checking whether a user is human), establishing, exercising and defending legal claims, reminders about unfinished albums and improving the service, including recording events about the progress of albums and orders on our server (for example, photo counts reached, a preview being ready, and a payment started or failed), without identifiers in your browser. You may object to processing on this basis at any time.
• Consent (Article 6(1)(a) UK GDPR): optional marketing emails, and analytics and advertising cookies. You may withdraw your consent at any time; this does not affect the lawfulness of processing before its withdrawal.

Providing the data needed to conclude and perform the contract is a requirement for entering into the contract; without it, we cannot make and deliver the album. We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Your family photos are private. We use them only to provide the service: the preview, preparing the print file, printing, delivery, support and the private digital album. We do not sell photos, we do not publish albums, we do not use photos in advertising without your permission, and we do not use them to train public artificial intelligence models.

The photos may also show other people, including children. The purchaser and the contributors who upload photos warrant that they have the necessary legal basis for doing so, or the consent of the people shown or of their legal representatives. A person who is identifiable in a photo may exercise their rights with us at hello@grandparentalbum.com.

Before upload, your device creates a copy of the photo without location and camera data; the original stays on your device. More on the Photo Privacy page.

Invited family members can add photos through a private link. Contributors do not see payment, billing, subscription or delivery address details, or administrative data.

We share data only to the extent necessary for each purpose. Our processors process data on our instructions under a data processing agreement:

• Vercel: website hosting and request handling;
• Supabase: sign-in, the database, and storage of photos and files;
• Resend: sending emails;
• Cloudflare Turnstile: automatic checking of whether a user is human;
• contractual printing and delivery partners: they receive the print file and the recipient’s name, address and telephone number, to the extent necessary to make and deliver the album.

Independent controllers, who process data for their own purposes under their own rules:

• Stripe: payments, recurring billing and the billing portal, as well as fraud prevention and compliance with legal obligations (Stripe Privacy Policy);
• Meta Platforms Ireland Limited: advertising measurement, if you have consented to it. For the collection of data through cookies on our website and its transmission to Meta, we and Meta are joint controllers (Article 26 UK GDPR) under Meta’s Controller Addendum; Meta carries out further processing as an independent controller (Meta Privacy Policy);
• delivery services that deliver the album to the recipient;
• our accounting service and legal and tax advisers, who are bound by confidentiality;
• competent public authorities, where the law requires it of us.

We do not sell personal data.

We are established in Slovenia, in the European Union, which the United Kingdom recognises as providing adequate protection for personal data. Some of our processors and independent controllers process data in other countries, mainly in the United States. The database and photo storage (Supabase) are in the North Virginia region in the United States; Vercel hosts the website on an international network, including in the United States; Resend sends emails from Ireland but stores account and message data in the United States; Stripe and Meta process data in the United States and other countries. Our contractual printing and delivery partners use an international network of print facilities and delivery services, so data for making and delivering the album may also be processed outside the United Kingdom; for UK orders, our printing partner normally prints in the United Kingdom.

Transfers to the United States take place on the basis of the UK Extension to the EU-U.S. Data Privacy Framework (the “UK-US data bridge”) where the recipient participates in it, and otherwise on the basis of the European Commission’s standard contractual clauses with the International Data Transfer Addendum issued by the Information Commissioner, together with supplementary measures where necessary. You may request a copy of the relevant safeguards at hello@grandparentalbum.com.

• account data: for as long as you have an account;
• unfinished albums started without an account: deleted together with their photos after 3 days of inactivity, unless you order the album or set up an account;
• photos and album layouts: for as long as necessary to work on the album and to preserve content approved for printing and albums already paid for, including after a subscription is cancelled;
• invoices and accounting records: for the periods laid down by tax and accounting rules;
• order data and correspondence with support: for as long as necessary to perform the contract and handle complaints, and thereafter until the limitation periods for any claims expire;
• email settings: until you change them or unsubscribe;
• analytics data: the identifier and first-visit data for up to 30 days, events for up to 90 days; matching data and the event queue for Meta for up to 7 days.

You can remove a photo from an album in the editor until the album is paid for. If a photo was included in an approved version of the album, we keep its file together with that version so that the album can be printed if it is ordered. Once the album has been printed or sent for printing, data already passed to the printing and delivery partners can no longer be withdrawn. When the retention period ends, we delete or anonymise the data.

Under the UK GDPR, you have the right to:

• access your personal data and obtain a copy of it;
• rectification of inaccurate data;
• erasure of data (“right to be forgotten”);
• restriction of processing;
• data portability;
• object to processing based on legitimate interests;
• withdraw your consent at any time;
• unsubscribe from marketing emails.

Send your request to hello@grandparentalbum.com, stating the account or data it concerns. We reply without undue delay and at the latest within one month, which we may extend in accordance with the UK GDPR. Where necessary, we may ask you to confirm your identity. We cannot erase certain data that we are required by law to keep before the statutory period expires.

If you believe that we process data in breach of the law, please tell us first at hello@grandparentalbum.com; we acknowledge a complaint within 30 days. You may also lodge a complaint with the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF (ico.org.uk). You may also complain to the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, Slovenia (www.ip-rs.si), where we are established.

We send you the emails needed to provide the service (account, orders, delivery, invitations to contributors, notices that a preview is ready) and reminders about unfinished albums. We send you marketing emails only with your consent. You can turn off reminders and marketing emails in your account or with the unsubscribe link in every email; we continue to send essential order emails after you unsubscribe.

We use strictly necessary cookies for sign-in, security, payment and saving drafts. We use our own in-browser analytics and advertising measurement (Meta) only with your consent, which we ask for with a banner on your first visit. The events about the progress of albums and orders that we record on the server, without storing anything in your browser, are described in section 3. Details and settings are on the Cookies page.

We honour the Global Privacy Control signal when your browser sends it. Disabling analytics removes only analytics identifiers and campaign data, not album drafts.

We use appropriate technical and organisational measures to protect data, including an encrypted connection, private photo storage and access limited to authorised persons. No online service is completely secure, so please protect your sign-in details. We notify personal data breaches in accordance with data protection law.

The service is intended for adults. Children may appear in family photos, but they may not create accounts or use the service without their parents or legal representatives.

We may update this Privacy Policy. The date of the last change is shown at the top of the page. We will inform you of material changes by email or in the app.