Privacy Policy

Last updated: pending publication

Draft - pending legal reviewThis document is an internal draft and is not yet in effect. It has not been reviewed by a lawyer and must not be relied upon. Bracketed placeholders (legal entity, registered address, governing-law jurisdiction, and the DMCA designated agent) must be confirmed by counsel before this page is published.

At Nostalyia, your privacy is our top priority. We do not store your photos in our database. We only collect your email address, and are committed to protecting your personal information and ensuring your data remains secure and confidential. Nostalyia is operated by [LEGAL ENTITY NAME], and this policy explains what we collect, who helps us run the Service, how long we keep your data, and where it is processed.

Data Collection: We only collect in our database, information necessary to provide our services, such as your email address.
Data Usage: Your photos and videos are used only by you and will never be used for any purpose such as artificial intelligence training.
Data Security: All files are stored securely and backed up regularly. We use industry-standard security measures to protect your data from unauthorized access.
User Control: You have full control over your data. You can delete your account and all associated files at any time. Once deleted, we do not retain any of your personal data or files; all information is permanently removed from our systems promptly.
Selling and marketing: We will never sell your data, or give it to outside companies or individuals for marketing, advertising, or other unrelated purposes. We do rely on a small number of service providers to operate the Service, which are named in the sub-processors section below.

Sub-processors

To run the Service we rely on a small number of trusted providers (sub-processors) that process limited data on our behalf, under contract and only as needed to provide the Service. They are not permitted to use your data for their own purposes.

Stripe: payment processing. Stripe handles your billing and card details when you subscribe. We do not store your full card number.
Amazon Web Services (Amazon SES): transactional email. Amazon SES delivers account and service emails (such as sign-in links and notifications) to your email address.
InterServer: storage. Your media files are stored on storage infrastructure operated by InterServer in the United States. Your private instance runs on dedicated servers we operate in the United States.

We will keep this list current and give notice of changes to our sub-processors. If you are an EU or UK customer, we enter into a data processing agreement (covering Article 28 of the GDPR) and this list serves as our sub-processor disclosure.

Cookies and local storage

When you sign in to your dashboard, we store a cookie named Authorization that holds your login token. So that a single sign-in works across our subdomains (the marketing site, your dashboard, and the browser extension), this cookie is scoped to the parent domain of our site and is readable by JavaScript on those subdomains. It is a strictly necessary cookie that keeps you signed in (not an advertising cookie), it expires after about one day and refreshes while you use the dashboard, and signing out removes it. This cross-subdomain cookie is separate from a server-side cookie of the same name that is restricted to the dashboard, marked HttpOnly, and not readable by JavaScript. We do not use third-party advertising or cross-site tracking cookies.

Analytics

We use Umami, a privacy-friendly analytics tool that we host on our own infrastructure, to understand aggregate traffic to our site (such as page views and referrers). Umami does not build advertising profiles, does not track you across other websites, and collects only aggregate, non-identifying usage data. We may also use self-hosted error monitoring to capture technical diagnostics when something goes wrong, so we can fix it.

How long we keep your data

Your account information (such as your email address) is kept while your account is active and is removed promptly when you delete your account.
If your subscription is cancelled or lapses, your instance and its data are retained during a 30-day grace period so you can resume, and are permanently deleted after that period.
Your sign-in cookie expires after about one day. Routine backups are rotated, so backup copies of deleted data age out of the backup cycle in the normal course.

Where your data is processed

Your data is stored and processed in the United States. If you access the Service from another country, your information will be transferred to and processed there. Where required for customers in the EEA or the UK, we rely on appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses. This policy is governed by the laws of [GOVERNING-LAW JURISDICTION].

Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can delete your account and data at any time from your dashboard, and you can exercise any of these rights by contacting us at the address below.

Contact

If you have any questions or concerns about your privacy, or want to exercise your rights, please contact us at contact@nostalyia.im.