Privacy Policy

Keepsakes operates the website at https://keepsakes.photos and the Keepsakes photo-book application. For data-protection purposes we are the data controller.

Contact: privacy@keepsakes.photos

• Authenticate you and maintain your account (legal basis: contract performance).
• Store your photos, trips, and layouts while you design your book (contract performance).
• Pass photo and order details to our printing partner to fulfil your physical book order (contract performance).
• Generate story suggestions, captions, and layouts with Claude AI (Anthropic) from your inputs (contract performance / legitimate interest).
• Group similar faces so you can tag people — processed on your device, no biometric data stored on our servers (legitimate interest).
• Turn photo GPS coordinates into place names via Nominatim (legitimate interest).
• Send you transactional emails about your order status (contract performance).
• Improve and debug the service using aggregated, anonymised usage analytics (legitimate interest).

We do not sell your personal data, use it for advertising, or share it with any party other than those listed in Section 5.

When you choose to import from Google Photos, we request the following OAuth scope:

• photospicker.mediaitems.readonly — receives only the photos you select in Google's own picker.
• openid email profile — your name and email, to create and identify your account.

We do not:

• Write to, modify, or delete any content in your Google Photos library.
• Share your Google Photos content with third parties other than the printing partner solely to fulfil your book order.
• Use Google user data to train AI or machine-learning models.
• Store Google Photos beyond what is needed for your active project (see Section 6 for retention).

• Active projects: Your photos and project data are stored for as long as your project is active. All photos and draft books are automatically deleted 90 days after your last access.
• After delivery: Photo files and layouts are permanently deleted from our storage exactly 7 days after your book order is marked delivered.
• Account deletion: When you delete your account, all associated photos, trips, and personal data are permanently deleted within 30 days.
• Order records: Basic order records (amount, date, delivery country) are retained for 7 years to comply with financial regulations.
• Backups: Data may persist in encrypted backups for up to 30 additional days after deletion before being fully purged.

If you are in the European Economic Area, UK, or another jurisdiction with equivalent data-protection laws, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate data.
• Erasure ("right to be forgotten"): Ask us to delete your data. You can do this directly from your dashboard or by emailing us.
• Portability: Receive your data in a machine-readable format.
• Objection / Restriction: Object to or restrict processing based on legitimate interests.
• Withdraw consent: Where we rely on consent, you may withdraw it at any time by disconnecting Google Photos or deleting your account.
• Lodge a complaint: You have the right to complain to your local data-protection authority.

To exercise any right, email privacy@keepsakes.photos. We will respond within 30 days.

We use essential cookies only — primarily a session cookie to keep you signed in. We do not use advertising cookies, third-party trackers, or analytics cookies that identify you personally.

Keepsakes is not directed at children under 13 (or 16 in the EEA). We do not knowingly collect data from children. If you believe a child has submitted data to us, contact us and we will delete it promptly.

We use industry-standard safeguards: TLS in transit, AES-256 at rest, row-level access controls, and least-privilege policies. No system is completely secure; if a breach affects your rights, we will notify you and the relevant authorities as required by law.

We may update this policy. If the changes are material, we will notify you by email or by a prominent notice on the site before the change takes effect. The current effective date is always shown at the top of this page.