Privacy

How we handle what you give us, written to be read. The short version is in section 2, and it is the whole truth of it.

Privacy Policy

GRADUAL AXE LABS S.R.L. · Version 1.0 · Effective 14 October 2026

1Who we are

Keepsake is operated by GRADUAL AXE LABS S.R.L., a company registered in Romania.

Registered name	GRADUAL AXE LABS S.R.L.
Registered office	Strada Brașov 25L, sector 6, București, Romania
Trade register number	J2026051680004
Tax identification (CUI)	55488910
Email	[email protected]
Privacy contact	[email protected]

We are the data controller for the personal data described in this policy. Our lead supervisory authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).

2The short version

In one paragraphYou choose a photograph and a few words. Your phone turns them into the image for an Apple Wallet pass, and your original photograph never leaves it. We sign the finished pass, email it to you, and keep no copy. We keep your email address, a record of what you bought and your invoice, because accounting law requires us to. We do not sell anything to anyone and we do not analyse what is in your photograph. We advertise Keepsake on Facebook and Instagram, and with your permission we tell Meta when one of those ads led to a visit or a purchase; your photograph, your words and your email address are never part of that (§7). We also measure, without cookies, how people move through the site, so we can see where making a keepsake gets hard; that never includes your photograph or your words either (§7). There is no account to delete because there was never an account.

Everything below is the same statement in the detail the law requires. If any part of it is unclear, that is a failure on our side, write to [email protected] and we will explain it in plain words.

3What we collect, and why

In one sentenceAlmost all of it is the thing you are buying; the rest is your email address and what accounting law requires us to keep.

What	Why	Legal basis	Kept for
The finished pass image, made on your phone from your photograph (the original never reaches us)	To sign and deliver your keepsake. Nothing else.	Performance of a contract, Art. 6(1)(b)	Only while it is signed and sent; for a gift, until it is opened (§5)
The name, engraving and words on the back	They are printed on the pass, and appear in the emails we send you.	Art. 6(1)(b)	Same as the pass; the email text is also kept by our email provider for 45 days (§6)
If you add a button: the song link, and the phone number for a Call button	They go into the pass, so the buttons under it work. Nothing else.	Art. 6(1)(b)	Only inside the pass, like the words on it: not kept for a keepsake you keep for yourself; for a gift, inside the stored pass until it is opened, at most 90 days from sending (§5)
Your email address	To send you your keepsake and your receipt. With no accounts, this is the only way you ever get it.	Art. 6(1)(b); and legal obligation for the receipt, Art. 6(1)(c)	10 years (accounting law)
Your name and billing address, as you give them on the payment page	To issue the invoice the law requires for every sale. They go on the invoice and nowhere else.	Legal obligation, Art. 6(1)(c)	10 years, on the invoice, in our invoicing program (accounting law). We keep no copy of our own.
Order record, what you bought, when, how much	Romanian accounting law requires it.	Legal obligation, Art. 6(1)(c)	10 years
Your country, from your connection	To show the right price and currency, and to decline payment where we cannot sell.	Legitimate interests, Art. 6(1)(f)	Not stored: it is read on each visit. If our EU sales pass the €10,000 threshold, VAT rules will require us to keep evidence of your country, and this row will say so.
For a gift: the recipient’s name and email, and your name as the sender and your note, if you add them	To deliver the gift, tell you when it was opened, and remind you once if it wasn’t.	Art. 6(1)(b)	The email address is used once and not kept once the gift email has gone; for a gift scheduled for a later date, held sealed until that morning. The names and note are kept with the gift record, so its link can show who it is from, and deleted 90 days after sending, opened or not.
Advertising measurement, only if you allow it: that a page was visited, that a checkout was started, that a purchase was made and its amount, with your IP address, your browser details and Meta’s own cookie identifiers	To know which of our advertisements bring people to Keepsake, and to stop paying for the ones that don’t.	Your consent, Art. 6(1)(a), which you can withdraw at any time (§7)	We keep none of it. Meta keeps it under its own policy.
How the site is used, measured without cookies: which pages and making steps are opened, where the screen is tapped, how far it is scrolled, which of our advertisements (if any) led to the visit, your country, and your browser and device type. Some visits are kept as a replay of the screens, with everything you type, your photograph and your keepsake hidden.	To see where people get stuck while making a keepsake, so we can make it easier, and which of our advertisements bring people who finish.	Legitimate interests, Art. 6(1)(f)	Up to 12 months at PostHog (§6); screen replays 30 days. Your IP address is not passed on.
Basic technical logs, IP address, browser, timestamps	Keeping the service running and stopping fraudulent payments.	Legitimate interests, Art. 6(1)(f)	30 days

We do not collect: your phone number (unless you put one on a Call button, above), your date of birth, or your card details. Your name and billing address are used for your invoice only, as the table says. Card details go directly to our payment provider and never reach us.

Showing you the song’s name. When you paste a song link, we ask that music service (Spotify, YouTube or SoundCloud) for the song’s title and cover, so you can check it’s the right one. Only the link is sent, and nothing is kept.

We do not do: profiling, automated decision-making with legal effects, selling personal data, or training any machine-learning model on anything you give us. The only data shared for advertising is the measurement described in §7, and only with your permission.

One small exception, and only for buyers: the emails we send you about your order can end with a short invitation to make another keepsake or send one as a gift. That is direct marketing of our own similar products to our own customers, which the law allows without asking first, as long as you can refuse at any moment (ePrivacy Directive art. 13(2); Romanian Law 506/2004 art. 12(2)). Tap “Turn off” on the checkout screen, or use “Turn off these suggestions” in any email, and it stops for good. We keep only a coded fingerprint of your address to remember that choice. We never add this to emails sent to someone receiving a gift.

4Your photograph

In one sentenceIt never leaves your phone. Your phone crops it and builds the pass image, and only that finished image reaches us.

A photograph is different from the rest of the information here, so it gets its own section.

What we do with it

Your own browser resizes and crops it to the dimensions Apple Wallet requires. The original stays on your phone and is never uploaded; only the finished pass image is sent to us, to be signed and delivered. The crop is the one you chose; we do not adjust it for you.

What we do not do with it

We do not detect faces. No facial geometry, no face grouping, no automatic centring on a face, no biometric processing of any kind. The crop is manual because you move it yourself.
We do not analyse the content. We do not attempt to identify who or what is in the photograph, and we do not derive anything from it about health, religion, ethnicity, politics or anything else.
We do not train models on it, and we do not permit anyone else to.
We do not use it in marketing. Every photograph on our website is either licensed stock or used with a specific written permission from the person who owns it.
We do not keep it. See section 5.

Photographs of other people

When you upload a photograph of somebody else, you are asking us to process their personal data on your instruction. Our terms require you to confirm you have the right to do so. If you are in a photograph someone else has used and you want it dealt with, write to [email protected], although we never hold the original, and once a keepsake is delivered there is nothing left with us to act on. An unopened gift is the exception, and we can take it down (Terms §9).

Photographs of people who have died

Under EU data protection law, information about a person who has died is not personal data (GDPR Recital 27), and Romania has not made separate rules for it. Some countries, including Spain, France, Italy, Denmark and Portugal, give family members specific rights over a deceased person’s data. We apply the same deletion rules whether the person in the photograph is living or not, so in almost every case there is nothing held that anyone could ask us to remove. If you are next of kin and want to make a request anyway, we will treat it exactly as we treat any other request in section 9.

5How long we keep things

In one sentenceWe never receive your photograph; the order record has to stay for ten years; everything in between is measured in days.

Item	Retention	Why that long
Your original photograph	Never uploaded	It stays on your phone. We never receive it.
The finished pass, when you buy it for yourself	Not retained	It is attached to your receipt email. Your inbox holds the only copies, which is why that email matters.
The finished pass, and the preview image shown on the claim page, when you send it as a gift	Until opened, at most 90 days from sending	The recipient has not received it yet. The preview image is removed the moment the gift is opened, and the pass within 48 hours; unopened, deleted at 90 days. A gift scheduled for a later date is made at purchase, while your photo is still on your phone, and held sealed until its morning; its 90 days start when it is sent.
Your draft, while you are making it	7 days, on your own device	Held in your browser so a dropped connection does not lose your work. Never sent to us. Kept for 48 hours after purchase so a free remake can start from what you made, then cleared.
An email we could not deliver	Up to 30 days	If an email bounces or is refused, we keep that one message, pass included, so we can send it again, then delete it.
The text of the emails we send	45 days, at our email provider	Postmark keeps each message’s text (not its attachments) for 45 days for delivery and abuse checks. It cannot be switched off.
Email address, order record and your invoice (with your name and billing address)	10 years	Romanian accounting law. We cannot delete this on request, and neither can anyone else.
Your “no suggestions” choice, if you make it	For good	So the choice holds for every later email. Only a coded fingerprint of your address is kept, never the address itself.
Technical logs	30 days	Long enough to investigate a fault or a fraudulent payment.

Deleted means deleted. Files are removed from live storage immediately and from backups within 30 days as those backups rotate.

6Who else is involved

In one sentenceSeven companies help us run this, each does one job, and none of them may use your data for anything of their own. An eighth, Meta, measures our advertising, and only if you allow it.

Who	What they do	Where
Stripe Payments Europe, Ltd.	Takes the payment. Holds your card details; we never see them.	Ireland
Postmark (ActiveCampaign, LLC)	Sends your receipt with the keepsake attached, and gift emails; keeps the text of each email for 45 days.	United States
Cloudflare, Inc.	Runs the website and builds the pass file.	United States (global edge network)
Zoho	Runs our hello@ mailbox, where your emails to us arrive.	European Union (Zoho’s EU data centres)
Oblio Software S.R.L.	The invoicing program. Issues your invoice, emails it to you, and keeps it for the period the law requires.	Romania
PostHog, Inc.	Measures how the site is used, without cookies, so we can see where people get stuck (§7). It receives no IP address, no photograph and none of the words on a keepsake.	Germany (PostHog’s EU cloud, Frankfurt); PostHog, Inc. is based in the United States
Apple Inc.	Apple Wallet itself, once the pass is on your phone. Governed by Apple’s privacy policy, not ours.	United States
Meta Platforms Ireland Limited	Measures whether our advertisements on Facebook and Instagram work, if you have allowed it (§7). Meta decides with us how this data is collected and is responsible on its own for what it does with it afterwards, under its own privacy policy.	Ireland; Meta also processes data in the United States

Each of the seven is bound by a written data processing agreement under Article 28 GDPR. Meta is different: for the measurement in §7 we and Meta are joint controllers, under Meta’s Controller Addendum. We do not sell, rent or trade personal data with anybody, and apart from that measurement and PostHog’s, above, we have no advertising, analytics or marketing partners.

Where Romanian law requires it, a copy of your invoice is also reported to the Romanian tax authority (ANAF) through its e-Factura system.

We would disclose data if a court or a competent authority lawfully required it. We would tell you if we were permitted to.

7Cookies and storage

In one sentenceHow the site is used is measured without any cookie; one optional thing measures our advertising, it is off until you allow it, and you can change your mind at any time.

Advertising measurement (optional). We advertise on Facebook and Instagram. To know whether those advertisements work, the homepage and the story page can load a small tool from Meta, the Meta Pixel, and our server can tell Meta when a checkout was started and when a purchase was made.

What is shared with Meta: that the page was visited, that a checkout was started, that a purchase was made, its amount and currency, the address of our website, your IP address and browser details, and two identifiers Meta stores in cookies on your device (_fbp, and _fbc if you arrived from an ad), each kept for up to 90 days. When you arrive from one of our ads and measurement is allowed, our server also keeps a copy of that ad’s click identifier in our own cookie (ks_fbc), for up to 90 days, so a purchase can be matched to the ad. It is deleted as soon as you decline.

What is never shared: your photograph, the name and words on your keepsake, your email address (not even in coded form), your order reference, or anything about a gift’s recipient. The tool is not loaded on any screen where you choose, crop or see your photograph, and its automatic reading of pages is switched off.

Your choice. If you visit from the European Union, Norway, Iceland, Liechtenstein or Quebec, nothing is loaded and nothing is sent unless you press Accept. In the United States, Australia, New Zealand and the rest of Canada it is on unless you decline. Everywhere, if your browser sends the Global Privacy Control signal, we treat that as a no and nothing is sent. You can change your answer at any moment with “Cookie choices” at the foot of the homepage, or with the button below. Declining changes nothing about the service or the price.

How the site is used (no cookies). To see where people get stuck while making a keepsake, the homepage, the story page and the making screens measure which steps are opened, where the screen is tapped and how far it is scrolled, through PostHog (§6). Nothing is stored on your device for this: no cookie and no local storage. When you go from one of our pages to the next, the visit travels in the page address for that one step, and it ends when you close the page. It runs through our own address, which passes on no IP address. It never sees your photograph or the words on your keepsake, and a screen replay hides everything you type, wherever it appears on the screen, your photograph and your keepsake. If your browser sends the Global Privacy Control signal, none of it loads.

What we store on your device ourselves. Two things, both strictly necessary for what you asked for and therefore exempt from the consent requirement under the ePrivacy Directive:

Your answer to that question, in one cookie (ks_ad), for six months, so we don’t ask on every visit.
Your draft keepsake, the photograph, crop, colour, name, engraving and words, held in your browser’s local storage while you are making it, so a dropped connection or a closed tab does not lose your work. It never leaves your device in this form, and it clears 48 hours after purchase, kept briefly so a free remake can start from what you made.

The payment page is Stripe’s own, and any cookies there are set by Stripe under its privacy policy. You can clear what we store at any time through your browser; it loses your unfinished work and your answer above, and nothing else happens.

8Where your data goes

In one sentenceOur systems run on a global network; where a provider is outside the EEA, the transfer is covered by the safeguards the law requires.

Our systems run on Cloudflare’s global network, including the small amount of gift data we hold, so data may be processed wherever Cloudflare operates. Where a provider named in section 6 processes data outside the EEA, that transfer relies on one of:

an adequacy decision by the European Commission, including the EU–US Data Privacy Framework where the provider is certified under it; or
the European Commission’s Standard Contractual Clauses, together with an assessment of the destination country.

For customers in Australia, this section is our disclosure under Australian Privacy Principle 8. You can ask us for a copy of the safeguards in place at [email protected].

9Your rights

In one sentenceWrite to [email protected]; we answer within 30 days; there is no charge and no form to fill in.

If you are in the EU or EEA, you have the right to: access a copy of what we hold; correct anything wrong; erase data where we have no overriding reason to keep it; restrict or object to processing based on legitimate interests; receive your data in a portable format; and complain to a supervisory authority.

What you should expect in practice

Because we hold so little, most requests are quick and slightly anticlimactic. If you ask what we have about you, the honest answer for most people is: an email address and one order record. We never had the photograph.

The one thing we cannot delete is the order record, for ten years, because Romanian accounting law requires it and a request cannot override a legal obligation. Everything else, we can and will.

How to ask

Email [email protected] from the address you used to buy, or tell us the reference number from your receipt. We reply within 30 days, and if a request is genuinely complex we will tell you before that deadline rather than after it.

If we get it wrong

You can complain to the Romanian supervisory authority, ANSPDCP (dataprotection.ro), or to the authority in your own country. You do not have to come to us first, though we would rather you did.

10Country-specific rights

United States

For California, and the nineteen other states with a privacy lawWe do not sell your personal information. The advertising measurement in §7 can count as “sharing” for cross-context behavioural advertising under some state laws. You can opt out at any time with “Cookie choices” at the foot of the homepage, and we honour the Global Privacy Control signal automatically. The rights below are yours regardless.

If you live in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia or Washington, you have the right to know what we collect, to get a copy, to correct it, to delete it, and not to be discriminated against for asking. Section 3 is our notice at collection; section 9 is how to exercise any of it.

Universal opt-out signals. We honour Global Privacy Control and equivalent browser signals. Since we do not sell or share data, the signal has nothing to act on, but it is respected rather than ignored.

Biometric information. We do not collect, capture, store, transmit or use biometric identifiers or biometric information, including scans of facial geometry. This is a deliberate design choice, not an omission, and it is stated here so it can be relied upon in Illinois, Texas and Washington.

Sensitive personal information. We do not collect it, and we do not use or disclose personal information for purposes to which a right to limit would apply.

Canada

We rely on your meaningful consent, given by choosing to make a keepsake after reading this policy. Under PIPEDA you may access and correct your information and complain to the Office of the Privacy Commissioner. If you are in Quebec, you additionally have the right to data portability and the right to be informed of automated decision-making, of which we do none. Our privacy contact under Law 25 is [email protected].

Australia and New Zealand

We handle personal information in accordance with the Australian Privacy Principles and the New Zealand Privacy Act 2020. Section 8 is our APP 8 disclosure about overseas recipients. You may complain to the OAIC or to the New Zealand Privacy Commissioner.

11Children

In one sentenceKeepsake is not for children, and we do not knowingly take their data.

Keepsake is intended for people aged 16 or over. We do not knowingly collect personal data from anyone younger, and we do not direct the service at children. If you believe a child has used Keepsake, write to [email protected] and we will delete what we hold.

For the United States: Keepsake is not directed to children under 13, and we do not knowingly collect personal information from them (COPPA).

Photographs of children are a different matter. A grandparent making a keepsake of a grandchild is exactly who this is for. What matters is that the person buying it is an adult and has the right to use the photograph, which our terms require you to confirm.

12Changes to this policy

If we change anything that affects you, we will update the version and date at the top and, where the change is significant, email everyone who has bought in the previous twelve months. We will not make a change that applies retroactively to data we have already deleted, because there would be nothing to apply it to.

GRADUAL AXE LABS S.R.L. · Strada Brașov 25L, sector 6, București, Romania · [email protected]
Keepsake is an independent service, not affiliated with, endorsed by or sponsored by Apple Inc. Apple Wallet, Apple Pay and iPhone are trademarks of Apple Inc.