Privacy Policy

MEMENTA PRIVACY POLICY

Last Updated: July 2026

This Privacy Policy explains what information Mementa ("we", "us", "the Service"), available at mementa.gifts, collects, how we use it, and the choices you have. By using the Service you agree to the practices described here.

Our promise in plain language: we collect only what the Service needs to work, we never sell your personal information, and you can ask us to delete your data at any time.


1. INFORMATION WE COLLECT

1.1 ACCOUNT INFORMATION
When you create an account we collect your name, email address, and a password. Passwords are stored only in a securely hashed form; we cannot see them.

1.2 GIFT RECIPIENT INFORMATION
The Service lets you create profiles for the people you shop for. These may include a name or nickname, relationship, interests, sizes, important dates, and notes. This information is visible only to you and is used solely to organize your gifting and to generate recommendations.

1.3 QUESTIONNAIRE RESPONSES
When you share a Keepsake questionnaire link, invited respondents can submit answers. Responses are collected without requiring the respondent to create an account and are visible to the questionnaire owner. Respondents should not include sensitive personal information in their answers.

1.3a GIFT FINDER INPUTS
When you use the on-site gift finder ("Help me choose"), the preferences you enter (interests, budget, style) are processed to generate suggestions, including by our AI provider. If you are not signed in, these inputs are not linked to any account and are not used to build a profile of you.

1.4 NEWSLETTER SUBSCRIPTIONS
If you subscribe to our newsletter we collect your email address. You can unsubscribe at any time using the link included in every newsletter email.

1.5 TECHNICAL AND USAGE INFORMATION
To keep the Service secure and reliable we automatically collect limited technical data, including:
- IP address and general request information, used for rate limiting and abuse prevention
- Login activity records, such as sign-in times and failed attempts, used to protect accounts
- Browser and device information when an error occurs in the app, used to diagnose and fix bugs
- Basic usage analytics, such as which features are used, to improve the Service

1.6 COOKIES
We use a single essential cookie that keeps you signed in. It is an httpOnly session cookie, which means it cannot be read by scripts in your browser. We do not use advertising or cross-site tracking cookies.


Google Analytics also sets its own cookies (names beginning with _ga) to distinguish visitors and measure site usage; see section 3.6 for details and opt-out options.

2. HOW WE USE YOUR INFORMATION

We use the information we collect to:
- Provide, maintain, and improve the Service
- Generate AI-powered gift recommendations from questionnaire answers
- Send transactional emails such as verification links, security codes, and account notices
- Send marketing emails and the newsletter, only where you have subscribed
- Protect the Service against fraud, bots, and abuse
- Diagnose technical problems and fix errors
- Comply with legal obligations

We do NOT sell your personal information. We do NOT use your information for third-party advertising.


3. SERVICE PROVIDERS WE SHARE DATA WITH

We share limited data with a small number of service providers who help us operate the Service. Each provider receives only the data needed for its function:

3.1 AI PROVIDER (OpenAI)
Questionnaire answers and recipient preference details are sent to our AI provider to generate gift recommendations. We do not send your account credentials, and we recommend that respondents avoid including directly identifying details in free-text answers.

3.2 EMAIL DELIVERY (Resend)
Your email address and the content of emails we send you are processed by our email delivery provider in order to deliver verification links, security codes, notifications, and newsletters.

3.3 BOT PROTECTION (Cloudflare Turnstile)
When you register or submit a public questionnaire response, Cloudflare Turnstile evaluates browser signals such as your IP address and device characteristics to distinguish humans from bots. This check is governed by Cloudflare's own privacy policy.

3.4 HOSTING AND DATABASE
Your data is stored in our application database hosted on cloud infrastructure. Access is restricted and protected by the security measures described below.

3.5 THIRD-PARTY MERCHANTS
When you click a product link you leave Mementa and go to the merchant's website. Anything you do there, including purchases, is governed by that merchant's privacy policy, not ours. Some links are affiliate links, which may allow the merchant to attribute your visit to Mementa; this does not give the merchant access to your Mementa data.


3.6 WEB ANALYTICS (GOOGLE ANALYTICS)
We use Google Analytics 4 to understand how visitors use the Service (pages viewed, general location, device type, and how you found us). Google Analytics sets cookies and receives your IP address and browsing activity on our site. This data is aggregated and does not directly identify you to us. Google may process this data as described in its own privacy policy at https://policies.google.com/privacy. You can opt out of Google Analytics across all websites with the browser add-on at https://tools.google.com/dlpage/gaoptout, or by using a browser's tracking protection features.

4. HOW WE PROTECT YOUR DATA

We use administrative and technical safeguards including:
- Encryption of data in transit (HTTPS)
- Password hashing using bcrypt; plaintext passwords are never stored
- Session cookies that are httpOnly and secure
- Email verification for new accounts
- Two-factor authentication for administrative access
- Rate limiting, login lockouts, and bot protection on public endpoints
- Strict request limits on AI-powered features to prevent abuse
- Standard browser security headers (HSTS, content-type protections, frame restrictions)
- Restricted administrative access with shortened session lifetimes

No method of transmission or storage is completely secure. If we become aware of a breach affecting your personal information, we will notify affected users as required by law.


5. DATA RETENTION

- Account, recipient, and questionnaire data are retained while your account is active
- Newsletter emails are retained until you unsubscribe or request deletion
- Security and error logs are retained for a limited period and then removed
- When you delete your account, we delete your personal data within thirty (30) days, except where retention is required by law


6. YOUR RIGHTS AND CHOICES

You may at any time:
- Access and update your account information from your profile
- Unsubscribe from marketing email using the link in any marketing message
- Request a copy of the personal data we hold about you
- Request correction or deletion of your personal data
- Close your account entirely

To exercise any of these rights, email support@mementa.gifts. We will respond within thirty (30) days. If you are located in a jurisdiction that grants additional privacy rights, such as the EU/EEA (GDPR) or California (CCPA/CPRA), we will honor requests consistent with those laws, including the rights to access, portability, deletion, and non-discrimination for exercising your rights.


7. INFORMATION ABOUT OTHER PEOPLE

Because Mementa is a gifting platform, users store information about the people they shop for and may invite others to answer questionnaires. If you believe someone has stored your information on Mementa and you would like it reviewed or removed, contact us at support@mementa.gifts and we will assist you.


8. CHILDREN'S PRIVACY

Mementa is not directed at children. You must be at least 18 years old, or have parental or guardian consent, to use the Service. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it.


9. INTERNATIONAL USERS

Mementa is operated from the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction.


10. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last Updated" date above and, where appropriate, notify you by email or an in-app notice. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.


11. CONTACT US

Privacy questions or requests:
Email: support@mementa.gifts
Website: mementa.gifts
Governing state: Michigan, United States