Memorial Card Maker

Privacy Policy

1. Data controller

The data controller within the meaning of the GDPR is:
{{FULL_NAME}}
{{STREET}}
{{POSTAL_CODE}} {{CITY}}
Email: [email protected]

2. Collection and use of personal data

We collect and process the following personal data:

  • Email address (for sign-in via magic link)
  • Images and texts uploaded by contributors
  • Card metadata (title, name of the deceased, deadlines)
  • IP address in server logs (retention: 7 days)
  • Session cookie (functional, no tracking)

3. Legal basis

  • Art. 6(1)(b) GDPR (performance of a contract) – for account data and card creation
  • Art. 6(1)(a) GDPR (consent) – for contributions by contributors
  • Art. 6(1)(f) GDPR (legitimate interest) – for server logs for security purposes

4. Data processors

We use the following service providers:

  • Resend – email delivery. A data processing agreement is in place.
  • Cloudflare (Turnstile) – spam protection for forms (anti-bot verification only, no tracking).
  • Stripe – payment processing (will be activated after the end of the beta phase on 1 May 2026).

5. Retention period

  • Active cards: until deleted by the organizer
  • Contributor submissions: until the card is deleted
  • Server logs: 7 days
  • Account data: until the account is deleted

6. Your rights

Under the GDPR, you have the following rights:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

7. Contact for privacy requests

For privacy-related requests, you can reach us at: [email protected]

8. Cookies

We use only a functional session cookie (for language selection and sign-in). No third-party tracking takes place.

9. Security

Our website uses HTTPS encryption throughout. Sign-in is passwordless via magic-link emails. Uploaded images are automatically stripped of EXIF metadata (including GPS coordinates) to protect privacy.

10. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy as needed to reflect changes in the law or to our services. The current version is always available at this URL.