← Back home

Privacy Policy

Last updated October 26, 2026

Overview

Memories R US (“MRU,” “we,” “us”) is a platform for creating web spaces for life events — memorials, weddings, celebrations, and more. This policy explains what we collect, why, who processes it, how long we keep it, and your rights. It covers account holders, the guests who send tributes or photos to a space, and anyone who contacts us.

We handle personal data under Nigeria’s Data Protection Act 2023 (NDPA).

What we collect

  • Account details — your email address and name. If you sign in with Google, we receive your verified email and display name from Google. If you use a password, we store only a one-way hash of it, never the password itself.
  • Two-step sign-in — if you turn it on, your authenticator app’s secret (encrypted) and one-way hashes of your recovery codes and emailed codes, used only to check that it’s you signing in.
  • Spaces and content — what you and your team add to a space you own or help run: names, text, photos, videos, audio and documents.
  • Guest submissions — when a guest sends a tribute or shares a photo or video to a space, the name they give, their message or caption, and any file they attach. The space’s owner and team decide whether it’s published; until they approve it, it isn’t shown publicly.
  • Invitations — if a space owner invites someone to help run their space, that person’s email address, until they accept or the invitation is removed.
  • Payments — the plan bought, the amount, the date and the payment reference. Card and bank details are entered on Paystack’s page and never reach us.
  • Contact enquiries — your name, email address, message and the kind of project, if you contact us.
  • Removal requests — if you ask for something to be removed from a space: your name, email address, the reason you choose, any message, and the item it’s about.
  • Security records — IP addresses, used only to limit repeated sign-in attempts and submissions; and a log of security-relevant account actions (for example, turning on two-step sign-in or granting operator access), with who did it and when.
  • Essential cookies only — a session cookie (up to 30 days), short-lived sign-in security cookies (minutes) and, only if you tick “Trust this device” at two-step sign-in, a cookie that skips the sign-in code on that browser for 30 days. You can remove it from your account's Two-step sign-in settings. No tracking or advertising cookies.

Why we collect it, and our lawful basis

  • To provide your account, your spaces and the plan you paid for — performance of our contract with you.
  • To publish guest submissions on a space — the guest’s consent, given when they submit. It can be withdrawn by asking the space owner or us to remove the submission.
  • To keep payment records — our legal obligations for accounting and tax.
  • To secure the platform — our legitimate interest in keeping accounts and spaces safe: limiting repeated attempts, two-step sign-in, error diagnostics and the security log.
  • To answer an enquiry — your request, and our legitimate interest in replying.
  • To handle a removal request — our legal obligation to answer requests to object to or erase personal data.

We don’t sell personal data, and we don’t use it for advertising.

People shown in photos

Spaces often show people who never signed up: guests at a wedding, mourners at a funeral, children at a birthday. A photo, video or tribute in which someone can be recognised is their personal data too.

  • What we hold — the image or video, and any caption, name or message shared with it.
  • Our lawful basis — the legitimate interest of the space owner and their guests in recording a shared event, balanced by your right to object and have it removed. For what a guest sends themselves, their consent. Whoever uploads a photo confirms they have permission to share it from the people clearly shown in it.
  • Children — a photo of a child should only be shared with a parent or guardian’s agreement. A removal request about a child hides the photo, video or tribute straight away, until someone has reviewed it.
  • Asking for removal — use the “Request removal” link under any photo, video or tribute, or at the end of any page of the space. No account is needed. The space’s owner and moderators decide; if they haven’t within 7 days, we step in. You’ll hear the outcome by email within a month.
  • Location data — we remove the hidden details a camera stores in a photo, such as where it was taken, before it’s uploaded through our forms.
  • Search engines — new spaces ask search engines not to list them. A space’s owner can choose to show it in search results.

If you’re outside Nigeria

If you’re in the European Union or the United Kingdom, the GDPR or the UK GDPR gives you rights over your personal data: to access it, correct it, have it erased, restrict or object to how it’s used, receive it in a portable format, and withdraw consent. You can also complain to the data protection regulator where you live.

We give everyone these same rights, wherever they live, and answer every request within one month.

When personal data moves between countries, our processors protect it with their own safeguards, including the European Commission’s standard contractual clauses and the UK addendum to them in their data-processing terms.

Who processes your data, and where

We use these processors to run the platform:

  • Neon — the database.
  • Vercel — application hosting and file storage (Vercel Blob).
  • Paystack — payments.
  • Google — sign-in, if you choose it.
  • Resend — account emails such as verification, password reset, sign-in codes and notifications.
  • Sentry — error reports: technical details of a failure and an internal account number, without names, email addresses, message content or codes.

Cross-border transfer. Except for Paystack, these processors store or handle data outside Nigeria — our database is hosted in the United Kingdom, and other services may use the European Union or the United States. We rely on each processor’s own data-protection safeguards and contractual terms for these transfers, and on the transfer grounds the Act allows.

How long we keep it

  • Account and space data — for as long as the account or space exists. Archiving a space hides it but keeps its data; permanently deleting a space removes its content and files.
  • Payment records — kept after a space or account is deleted, for accounting and tax: the plan, amount, date, payment reference, and the space name and web address it paid for. The record no longer links to the deleted account.
  • The security log — kept after deletion so security events can still be investigated. The link to a deleted account is removed, but an entry may still include an email address it recorded at the time.
  • IP-based rate limits — deleted automatically once they’re no longer needed, normally within two days.
  • Contact enquiries — until we delete them, or you ask us to.
  • Removal requests — your name, email address and message are deleted 12 months after the request is decided. The record that a request was made and what was decided is kept, without them.
  • Backups — encrypted backups let us recover from accidents; deleted data can remain in them for up to 30 days.

Your rights

Under the NDPA you can access your data, correct it, ask us to delete it, ask us to restrict how we use it, object to processing based on our legitimate interests, receive your data in a portable format, and withdraw consent where we rely on it. Some of this you can do yourself:

  • Access and portability — download everything tied to your account, as one JSON file, from My account’s “Your data” section.
  • Correction — update your name on the same My account page.
  • Deleting a space — “Delete permanently” on its card in your dashboard.
  • Objecting to, or erasing, a photo of you — the “Request removal” link on the space, whether or not you have an account. See People shown in photos.

For anything else, including deleting your whole account, contact our Data Protection Officer below. We reply within 30 days. If you’re unhappy with how we handle your data, you can complain to the Nigeria Data Protection Commission.

Data Protection Officer

Questions about this policy, or a request we haven’t made self-service yet, can be directed to our Data Protection Officer at privacy@memories-r-us.app.

Changes to this policy

If we make a material change to how we collect or use data, we’ll update this page and the “last updated” date above.