Privacy Policy

Account Registration
When you create a Mimentum account, we collect:
- Full name
- Email address
- Password (encrypted)
- Profile picture or avatar (optional)
- Billing address and payment information


Gallery and Media Information
When you create galleries and upload content, we collect:
- Gallery name, description, and slug
- Event date
- Cover images and media files
- Photos and videos uploaded by you or your guests
- Metadata associated with media (EXIF data, dimensions, timestamps)
- Captions and descriptions
- Gallery settings and configuration


Guest Information
When you invite guests to upload media, we collect:
- Guest name
- Guest email address (optional)
- Device identifiers (for tracking anonymous guest contributions)
- Guest comments and reactions to photos
- Upload activity logs


Payment Information
When you subscribe to a paid plan, we collect:
- Billing address
- Payment method details (credit card, debit card information)
- Billing history and transaction records
- Subscription preferences

Note: Payment information is processed by Stripe, our third-party payment processor. We do not store complete credit card numbers on our servers.


Communication
When you contact us, we collect:
- Email address
- Name
- Subject and content of your message
- Any attachments you provide


User Profile Information
- Customizable profile information you choose to provide
- Preferences and settings
- Support interactions and feedback


Consent Verification Data
When you provide consent for specific actions (such as changing a gallery URL, accepting terms, requesting data export, or deleting your account), we collect additional information to verify the authenticity of your consent and maintain a legally compliant audit trail:
- IP Address: To verify the geographic location and authenticity of the consent
- User Agent String: Browser type, version, operating system, and device information to identify the device used to provide consent
- Timestamp: The exact date and time consent was given
- Consent Context: Details about what you consented to (e.g., old and new values for URL changes)
- Consent Status: Whether consent was given or revoked

This information is collected under our legitimate interest in maintaining GDPR-compliant consent records and protecting both you and Mimentum from fraudulent activity. Consent records are retained for 6 years to meet legal compliance requirements for demonstrating valid consent.

You can view your consent history in your account settings. This data is used solely for legal compliance and consent verification purposes and is not used for marketing or profiling.

Usage Data
- Pages visited and time spent
- Features used and interactions with the Service
- Gallery access patterns
- Download and export activities
- Search queries
- Clicks and navigation
- Referral sources


Device Information
- Device type, model, and operating system
- Browser type and version
- IP address and geolocation (approximate)
- Unique device identifiers
- Device settings


Cookies and Similar Technologies
- Session identifiers
- Authentication tokens
- User preferences


Log Data
- Server logs containing IP addresses
- Access timestamps
- Browser type and language
- Pages accessed and referrer URLs
- Error logs and system events

- Providing, maintaining, and improving the Service
- Processing transactions and sending transaction confirmations
- Creating and managing your account
- Enabling you to create galleries and upload media
- Facilitating guest uploads and interactions
- Storing and retrieving your photos and videos

- Sending transactional emails (account confirmations, password resets)
- Responding to your inquiries and support requests
- Sending service updates and announcements
- Notifying you of changes to our policies
- Sending survey requests and feedback requests

- Customizing content and recommendations
- Remembering your preferences and settings
- Improving user experience based on your interactions
- Providing personalized features (theme selection, language preferences)

- Sending promotional emails and special offers (with your consent)
- Conducting marketing campaigns
- Analyzing marketing effectiveness
- Developing new features based on user demand

- Detecting and preventing fraud, abuse, and security incidents
- Protecting against malicious activity
- Enforcing our Terms of Service
- Protecting user rights and property
- Complying with legal obligations
- Investigating suspected violations of law

- Complying with applicable laws and regulations
- Responding to legal requests and court orders
- Protecting against legal liability
- Enforcing contractual agreements

- Service improvement and optimization
- Fraud prevention and security
- Marketing and business purposes (balanced against your rights)

- Providing the Service as contracted
- Processing payments
- Fulfilling your requests

- Marketing communications (unless based on legitimate interests)
- Non-essential cookies
- Optional features and integrations

- Compliance with tax and financial regulations
- Responding to government requests
- Protecting user safety

- Protecting your health and safety
- Preventing harm

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

With Service Providers:

See the Third-Party Services Table in Section 2.3 for a complete list of our service providers, including what data is shared and links to their privacy policies.

With Other Users:
- Gallery owners can see guest names, emails, and contribution records
- Guests invited to galleries can see uploaded media and other guests' contributions
- Team members can see shared gallery information (if team feature is enabled)

For Legal Reasons:
- When required by law, court order, or government request
- To protect against fraud or security threats
- To enforce our Terms of Service
- To protect user rights, property, and safety

Business Transfers:
- If Mimentum is acquired, merges, or undergoes bankruptcy, your information may be transferred as part of that transaction

With Your Consent:
- When you explicitly authorize data sharing
- For features that require third-party integrations

We may share aggregate, anonymized, or de-identified data that cannot reasonably be used to identify you:
- Industry benchmarks and statistics
- Usage patterns and trends
- Research and insights (for academic or industry purposes)

Account Information:
- Retained for the duration of your account
- Retained for 3 years after account deletion for legal compliance

Gallery Content (Photos/Videos):
- Retained for as long as your account is active
- Deleted within 30 days of account deletion
- You can delete specific content at any time

Payment and Billing Information:
- Retained for 7 years for tax and accounting purposes
- Credit card information deleted after transaction completion

Support Communications:
- Retained for 3 years for customer service and dispute resolution

Log Data:
- Server logs retained for 90 days
- Security logs retained for 1 year

Cookies:
- Session cookies: deleted when you close your browser
- Persistent cookies: deleted after 1 year of inactivity
- You can delete cookies at any time through browser settings

Guest Information:
- Retained for the duration of the gallery
- Deleted when gallery is deleted
- You can remove guest data at any time

Consent Records:
- Retained for 6 years from the date consent was given
- Required for GDPR compliance and demonstrating valid consent
- Includes IP address, user agent, timestamp, and consent details
- Cannot be deleted during the retention period as they serve as legal proof of consent

Upon request, we will delete your personal information except:
- When required by law
- When necessary for contractual obligations
- When necessary for dispute resolution
- When needed for security purposes
- Backup copies (deleted within 90 days)

You have the right to:
- Access the personal information we hold about you
- Receive your data in a portable format (data export)
- Request a copy of your information in common formats

To exercise: Submit a request through your account settings or contact us at privacy@mimentum.online

You have the right to:
- Correct inaccurate information
- Update outdated information
- Complete incomplete information

To exercise: Update your profile directly through account settings or contact us

You have the right to:
- Delete your account and associated data
- Request removal of specific information
- Exceptions: legally required records, dispute resolution, security

To exercise: Request deletion through account settings or contact us

You have the right to:
- Limit how we use your information
- Restrict processing for specific purposes
- Maintain data without processing it

To exercise: Contact us at privacy@mimentum.online

You have the right to object to:
- Marketing communications
- Profiling and analytics
- Automated decision-making

To exercise: Click "unsubscribe" in emails or adjust settings in your account

You can withdraw consent for:
- Marketing communications
- Non-essential cookies
- Optional features

To exercise: Update your preferences in account settings or contact us

We do not use fully automated decision-making that produces legal or similarly significant effects. However, we use:
- Fraud detection
- Spam filtering

You can request human review of these decisions.

You can:
- Opt out of promotional emails
- Adjust communication frequency
- Change notification preferences
- Customize marketing topics

You can:
- Disable cookies through browser settings
- Clear cookies manually
- Opt out of analytics cookies

Note: Some features may not function properly if you disable essential cookies

If you are a California resident:
- Right to know what personal information is collected
- Right to know whether personal information is sold or disclosed
- Right to delete personal information (with exceptions)
- Right to opt out of the "sale" of personal information
- Right to non-discrimination for exercising your rights

We do not sell your personal information in the traditional sense but may share it with service providers in ways that could be considered "sales" under CCPA. You have the right to opt out.

To exercise: Submit a request at https://mimentum.online/privacy-request

If you are a Brazilian resident:
- Right to access your personal data
- Right to correct incomplete or inaccurate data
- Right to anonymization, blocking, or deletion
- Right to data portability
- Right to delete data collected with consent
- Right to information about data sharing
- Right to revoke consent
- Right to lodge a complaint with the National Data Protection Authority (ANPD)

If you are a Canadian resident:
- Right to access your personal information
- Right to correct your information
- Right to request accuracy correction
- Right to know how your information is used
- Right to opt out of marketing
- Right to lodge a complaint with the Privacy Commissioner

If you are in the United Kingdom:
- All GDPR rights apply (see Section 7.1-7.7)
- Right to lodge a complaint with the Information Commissioner's Office (ICO)
- Right to obtain confirmation of lawfulness of processing

We implement comprehensive security measures to protect your information:

Encryption:
- All data in transit is encrypted using TLS/SSL protocols
- Sensitive data at rest is encrypted using industry-standard encryption
- Database-level encryption for stored media

Access Control:
- Role-based access control (RBAC)
- Principle of least privilege
- Multi-factor authentication (MFA) for sensitive operations

Infrastructure Security:
- Secure cloud hosting with Supabase and Vercel
- Regular security audits
- DDoS protection and rate limiting
- Web application firewall

Data Protection:
- Secure password hashing (bcrypt)
- No plain-text password storage
- Automatic session timeouts
- Secure cookie handling

Operational Security:
- Regular security training for staff
- Background checks for employees
- Confidentiality agreements
- Incident response procedures

While we use reasonable security measures, no system is completely secure. We cannot guarantee absolute security. You are responsible for:
- Maintaining the confidentiality of your password
- Protecting your login credentials
- Reporting unauthorized access
- Keeping your device and software updated

Mimentum operates primarily in the United States. Your information may be:
- Processed in the United States
- Stored on servers located in the United States
- Accessed by employees in the United States

For users in the EEA, UK, or Switzerland:
- Data is transferred under Standard Contractual Clauses (SCCs)
- Adequacy decisions may apply
- You have rights to object to transfers

By using Mimentum, you consent to the transfer of your information to countries that may have different data protection laws. Some countries may not have the same level of protection as your home country.

Your Rights:
- As outlined in Section 7.1-7.7
- Full GDPR protections apply

Our Obligations:
- Data Protection Impact Assessments (DPIA)
- Lawful basis for processing
- Data Processing Agreements available
- 30-day response timeline for requests

Legal Basis Summary:
- Contractual: Service provision and payment processing
- Consent: Marketing
- Legitimate Interests: Service improvement, fraud prevention
- Legal Obligation: Tax and regulatory compliance

Your Rights:
- All GDPR rights apply (UK GDPR)
- Data Protection Act 2018 protections
- ICO jurisdiction

Your Rights:
- Federal Data Protection Act (FADP) compliance
- Similar to GDPR protections
- Swiss data protection authority oversight

Your Rights:
- Access to your information
- Correction of information
- Opt-out of marketing
- Complaint to Privacy Commissioner

Your Rights:
- All rights in Section 7.11
- LGPD compliance
- ANPD complaint authority