Privacy Policy
You are trusting us with photos of someone you loved and with your family's memories. This page explains, in plain words, what we do with them. The short version: we use your photos only to make your film and card, we never use them to train AI models, we do not sell or share them for advertising, and we delete the original photos 30 days after delivery.
1. Who we are
In Memoriam Film is operated by SoundCam Productions Kft., 2364 Ócsa, Üllői utca 48., Hungary (company registration number 13-09-211186, Budapest Környéki Törvényszék Cégbírósága; VAT number 13580100-2-13). We are the controller of your personal data under the EU General Data Protection Regulation (GDPR) and the UK GDPR.
Privacy questions and requests: privacy@inmemoriamfilm.com. Everything else: support@inmemoriamfilm.com. We have not appointed a data protection officer because the law does not require one for our activity.
2. What we collect, why, and on what legal basis
| Data | Why we use it | Legal basis |
|---|---|---|
| Your name, email address, billing country and order details | To take your order, deliver the film and card, and contact you about it | Contract (GDPR Art. 6(1)(b)) |
| Photos and video clips you upload | To restore, order, gently animate and assemble them into your film and card | Contract (Art. 6(1)(b)) |
| Your answers about the person (names, dates, places, stories) | To write the short life story for the card and narration, only from what you tell us | Contract (Art. 6(1)(b)) |
| Images of other living people who appear in your photos | Only as part of your film; delivered privately to you | Legitimate interests (Art. 6(1)(f)) — making the memorial film you asked for, with strict limits (see section 4) |
| Payment details | Handled by Stripe; we never see your full card number | Contract; Stripe also acts as an independent controller for fraud prevention and its own legal duties |
| Invoices and accounting records | Required by Hungarian accounting and tax law | Legal obligation (Art. 6(1)(c)) |
| Your consent choices at checkout (with time and version) | To show what you agreed to | Legal obligation and legitimate interests (Art. 6(1)(c) and (f)) |
| Support messages | To help you | Contract or legitimate interests |
| Technical data (IP address, browser, error logs) | To keep the service secure and working | Legitimate interests (Art. 6(1)(f)) |
We do not need, and ask you not to upload, health records, ID documents or intimate images.
3. The person who has died
The GDPR does not apply to the personal data of people who have died (Recital 27). We still treat their photos and story with the same care as everyone else's. Some national laws give close relatives rights over a deceased person's data or memory — for example, in Hungary a close relative may exercise data rights for five years after death (Infotv. § 25). If you are a close relative and object to a film about someone in your family, contact us and we will look at it promptly and sensitively.
4. Other people in the photos, including children
Family photos show other people: partners, children, grandchildren, friends. They do not deal with us directly, so this page is how we tell them what happens (GDPR Art. 14(5)(b)). Before ordering, the person uploading confirms that they have the right to use the photos and that the people shown agree, or that they are acting for the family.
- Their images are used only to make the film the family asked for.
- The film is delivered privately to the person who ordered it. We never publish it.
- We do not use face recognition, build face templates, identify or tag anyone, or link faces across orders.
- We do not use any photo to train AI models.
- Original photos are deleted 30 days after delivery (see section 8).
- Anyone who appears in a film can ask us to remove or blur them: write to privacy@inmemoriamfilm.com.
Photos of children are welcome as part of a family's memories. We apply the same limits, and we refuse uploads that are intimate or sexual, or that show public figures or celebrities.
5. What we never do
- Train AI models on your photos, videos, voice or stories.
- Sell or “share” your personal data (in the CCPA sense) or use it for targeted advertising.
- Clone anyone's voice or create a talking avatar of the person who died.
- Make the film public, or use it as an example, unless you separately opt in (and you can withdraw that at any time).
- Make automated decisions about you that have legal or similarly significant effects (GDPR Art. 22).
6. Who processes data for us
We use the following service providers (processors) under written data processing agreements (GDPR Art. 28). They may only use your data to provide their service to us.
| Provider | What it does for us | What it sees | Where / safeguard |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, storage, database, sign-in, email | Everything you send us | Frankfurt, Germany (eu-central-1). AWS DPA with Standard Contractual Clauses; Amazon is certified under the EU-US Data Privacy Framework |
| Stripe | Payments and fraud prevention | Name, email, billing details, payment card (Stripe only) | EU and US. Stripe DPA with SCCs (incl. UK addendum); Data Privacy Framework certified |
| Google (Gemini API, Lyria) | Putting photos in date order, photo restoration, writing aids; instrumental music | Selected photos and the text you provide; music prompts contain no personal data | Paid API under Google’s processor terms; may be processed in any country Google operates in; SCCs and Data Privacy Framework. Paid-tier data is not used to improve Google’s products |
| ElevenLabs | Optional narration of the life story | The life-story text | US by default. ElevenLabs DPA with SCCs; Data Privacy Framework certified |
| xAI | Animating selected photos (video) | The selected photos | US. SCCs. xAI states it does not train on API data without permission |
| RunPod | GPU servers that run our restoration, animation and video-export software | Selected photos and the frames made from them | RunPod DPA with SCCs; we use EU data centres where available |
| Anthropic | Writing aids for the life-story text and support replies | Text you provide | US. Anthropic DPA with SCCs; no training on our data |
| KBOSS.hu Kft. (Számlázz.hu) | Issuing invoices | Name, billing address, amount | Hungary |
Some providers keep data briefly for abuse monitoring or caching (for example, Google keeps Gemini API prompts and outputs for up to 55 days for abuse monitoring; Anthropic deletes API data within 30 days; RunPod deletes job results within minutes). We choose zero-retention options where they are available to us.
7. International transfers
Our main systems are in the EU (Frankfurt). Some providers above process data in the United States. Where a provider is certified under the EU-US Data Privacy Framework (and its UK Extension) we rely on that; otherwise we use the European Commission’s Standard Contractual Clauses (2021/914) and, for the UK, the International Data Transfer Addendum. You can ask us for a copy of the relevant safeguards.
8. How long we keep things
| Data | Kept for |
|---|---|
| Original photos and video clips you upload | 30 days after we deliver your film, then deleted automatically |
| Working files (restored frames, animated clips) | 7 days after delivery |
| The finished film and memorial card | 12 months, so you can download them again, or until you ask us to delete them |
| Order, consent and support records | For as long as claims about the order could be made (generally 5 years under Hungarian civil law) |
| Invoices and accounting records | 8 years (Hungarian Accounting Act, § 169) |
| Security logs | Up to 90 days |
You can ask us to delete your photos and film sooner, at any time.
9. Your rights
Under the GDPR and UK GDPR you can ask us for access to your data, a copy in a portable format, correction, deletion, restriction, and you can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. Write to privacy@inmemoriamfilm.com; we reply within one month.
You can complain to a data protection authority: in Hungary, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) (naih.hu); in the UK, the Information Commissioner’s Office (ico.org.uk); or the authority where you live or work. We would appreciate the chance to put things right first.
10. If you live in the United States
We do not sell personal information and do not “share” it for cross-context behavioural advertising, as those terms are used in the California Consumer Privacy Act (CCPA). We honour Global Privacy Control signals. Whatever state you live in, you can ask to know, correct or delete the personal information we hold about you, and we will not treat you differently for asking.
11. Cookies
On inmemoriamfilm.com we use only the storage needed for the site to work, unless you agree to more. Details: Cookie Policy.
12. Security
Data is encrypted in transit and at rest. Films and photos are stored privately and shared only through links that are hard to guess and that you control. Our staff and providers access them only when needed to make or support your order.
13. Changes
If we change how we use your data in a way that matters, we will update this page and tell customers with an open order by email. The version and date are at the top.
Sources we checked
- AWS Data Processing Addendum — Amazon Web Services (read 2026-10-05)
- AWS Service Terms — Amazon Web Services, 2026-10-01 (read 2026-10-05)
- Stripe Data Processing Agreement — Stripe, 2026-09-28 (read 2026-10-05)
- Gemini API Additional Terms of Service — Google (read 2026-10-05)
- Google Ads/Cloud processor terms (v10) — Google, 2026-05-07 (read 2026-10-05)
- Gemini API zero data retention — Google (read 2026-10-05)
- ElevenLabs Data Processing Addendum — ElevenLabs, 2026-04-08 (read 2026-10-05)
- xAI API security FAQ — xAI (read 2026-10-05)
- RunPod Data Processing Agreement — RunPod (read 2026-10-05)
- Anthropic Data Processing Addendum — Anthropic (read 2026-10-05)
- Anthropic commercial terms — Anthropic (read 2026-10-05)
- Data Privacy Framework list — U.S. Department of Commerce (read 2026-10-05)
- CCPA thresholds (CPI adjustment) — California Privacy Protection Agency (read 2026-10-05)
- UK GDPR and the EU: representatives — ICO (read 2026-10-05)