Privacy Policy

Moments Forever: webshop, platform and mobile app

Last updated: {{PRIVACY_UPDATED}}. The German version („Datenschutzerklärung“) is the authoritative one; this is a translation.

1. Controller

Nolix Digital GmbH
{{ADDRESS}}, {{POSTAL_CODE}} Wien, Austria
Commercial register no. {{FN_NUMBER}}, {{FN_COURT}} · VAT ID {{UID}}
Managing director(s): {{MANAGING_DIRECTORS}}
E-mail for privacy requests: [email protected]
General support: [email protected]

"Moments Forever" and "Soul Star" are products of Nolix Digital GmbH. We have not appointed a data protection officer because there is no legal obligation to do so. Please send privacy requests to the e-mail address above.

2. Overview and terms

Moments Forever is a digital memorial platform. It consists of:

• the webshop (moments.memorial), where you buy a subscription and optionally the physical QR memorial plaque "Soul Star",
• the platform (app.moments.memorial), where you create, design and share memorial pages for people who have passed away, and where visitors can leave candles and flowers, and
• the mobile app "Moments Forever" (iOS and Android) with the same functions.

Terms used in this policy:

• Owner: the person who created and manages a memorial page (account holder).
• Collaborators: people the owner invited to the memorial (viewers or editors) and guests with limited access.
• Visitors: everyone else who opens a memorial page, e.g. after scanning a Soul Star plaque.
• The deceased: the person a memorial page is dedicated to. Data of deceased persons is outside the scope of the GDPR (Recital 27); we nevertheless treat it with the same care (section 12).

We process personal data only as far as necessary to operate the platform, perform contracts, comply with legal obligations or pursue legitimate interests. We do not sell data and do not pass data to third parties for advertising.

We use no analytics or tracking tools.

Legal bases we rely on:

• Art. 6(1)(a) GDPR: your consent (e.g. newsletter, publishing the grave location).
• Art. 6(1)(b) GDPR: performance of a contract with you or pre-contractual steps (order, subscription, operation of your account and memorial pages).
• Art. 6(1)(c) GDPR: legal obligation (in particular retention duties under § 132 Federal Fiscal Code (BAO) and § 11 VAT Act (UStG), and duties under the Digital Services Act).
• Art. 6(1)(f) GDPR: legitimate interests (security of our systems, abuse prevention, operation of memorial pages in the interest of their owners, legal defence).

3. Hosting, server logs and security

All systems (webshop, platform, APIs, database, administration interface and content screening) run on a dedicated server managed by us at Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, in the Falkenstein datacenter. Hetzner has no access to content; the database is not publicly reachable. A data processing agreement under Art. 28 GDPR is in place with Hetzner.

On every request to our websites and APIs the web server automatically logs: IP address, date and time, requested address, status code, amount of data transferred, browser and operating system (user agent) and the previously visited page (referrer). Purpose: operation, troubleshooting, defence against attacks and abuse. Legal basis: Art. 6(1)(f) GDPR. Retention: 14 days, then automatic deletion. Application logs (error and event logs of our software) are kept 14 days, error logs 30 days; in individual cases they may contain e-mail addresses and IP addresses (e.g. failed login attempts).

To prevent abuse we limit the number of requests per IP address (rate limiting). For this the IP address is held briefly (at most 60 seconds) in memory.

All connections are TLS-encrypted. Passwords are stored exclusively as Argon2 hashes. Photos and videos are delivered through signed, time-limited addresses.

4. Webshop

4.1 Visiting the webshop

When you merely browse, we process only the server logs described in section 3 and the strictly necessary storage described in our Cookie Policy (language, cart). We use no analytics or marketing cookies.

4.2 Order and customer account

For an order we collect: e-mail address, first name, last name, phone number (optional), a password chosen by you, the selected products and prices, any promo or referral code, your language, the time and content of your acceptance of the terms and, only for physical products, the delivery address (street, postcode, city, country). Your Moments Forever account is created automatically with the order; guest checkout without an account is not possible because the subscription is tied to an account. If the purchase is abandoned, the provisional account is deleted after 30 days. Purpose: conclusion and performance of the contract, customer account, customer service. Legal basis: Art. 6(1)(b) GDPR; retention of invoice data under (c). Retention: for the duration of the contractual relationship; invoice data 7 years (§ 132 BAO).

4.3 Payment processing (Stripe)

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe"). When you click the order button you are redirected to a payment page operated by Stripe. We transmit to Stripe your e-mail address, the ordered items and prices, your language and internal identifiers (cart number, customer number). You enter your payment details (card number, IBAN, wallet data, name and billing address where required) directly with Stripe; they never reach our servers. From Stripe we receive a customer identifier, the payment method in abbreviated form (e.g. card brand and last four digits), the payment status and the transaction number. Stripe processes data partly as an independent controller (in particular for fraud prevention and its own legal obligations) and partly on our behalf. Stripe may transfer data to Stripe, Inc. (USA); the basis is the EU-US Data Privacy Framework, of which Stripe is a member, and standard contractual clauses. Stripe's privacy policy: https://stripe.com/privacy (otvara se u novoj kartici). The payment methods offered (e.g. card, SEPA direct debit, Apple Pay, Google Pay, Klarna) are shown on the Stripe page and may vary by country. Legal basis: Art. 6(1)(b) GDPR.

Subscriptions renew automatically; Stripe charges the stored payment method on each renewal date. You can change the payment method in the "Account" area of the platform (you will be redirected to Stripe again).

4.4 Invoices, bookkeeping and tax advice

For every payment we issue an invoice (a credit note for refunds) containing your name, address, the items, amounts, VAT and the Stripe transaction number. Invoices are sent to you by e-mail as PDF and are available in your account. To fulfil our bookkeeping and tax obligations we transmit invoices and credit notes to our tax advisers, TPA Steuerberatung GmbH, Wiedner Gürtel 13, 1100 Vienna, Austria, via their "TPA Connect" portal. Tax advisers are bound by professional secrecy. Legal basis: Art. 6(1)(c) GDPR (§ 132 BAO, § 11 UStG) and (f) (proper bookkeeping). Retention: 7 years from the end of the calendar year of the invoice.

4.5 Shipping of physical products

If you order a Soul Star plaque, we transmit your name, the delivery address and, where needed for delivery, your phone number or e-mail address to the carrier {{SHIPPING_CARRIER}}. We store the tracking number and shipping status. We ship to Austria, Germany, Slovenia, Croatia, Switzerland, Serbia, Bosnia and Herzegovina and Montenegro. For deliveries outside the EU, customs authorities and carriers receive the recipient data required for customs clearance. Legal basis: Art. 6(1)(b) GDPR. Retention: shipping data up to 12 months after delivery, invoice data 7 years.

The plaque carries a QR code with a random, non-descriptive code. The QR code itself contains no personal data. For allocation and tracking we store, per code, the status, the buyer's e-mail address, the recipient name and the tracking number.

4.6 Newsletter

During checkout you may voluntarily tick a box to receive our newsletter (news about Moments Forever, features, offers). The box is unticked by default. We first send you a confirmation e-mail; the subscription only becomes effective after you click the confirmation link (double opt-in). We store the time of your consent. You can unsubscribe at any time via the link in every e-mail or in your account settings. Legal basis: Art. 6(1)(a) GDPR, § 174 TKG 2021. Retention: until withdrawal; proof of consent is kept 3 years after withdrawal. Without a subscription we send no marketing e-mails; you only receive transactional and service e-mails (section 6).

4.7 Support requests

You can contact us via the support form in the webshop, the form on the order confirmation page or by e-mail. We process e-mail address, name (optional), phone number (optional), category, subject, message, any attachments and, for requests from the order confirmation page, the link to your order. Requests are handled in our ticket system, where our replies are recorded. Legal basis: Art. 6(1)(b) GDPR (customer service) or (f) (requests without a contract). Retention: 3 years after the request is closed.

4.8 Referral and partner codes

If you open the webshop via a link containing a referral code (e.g. of a partner), your browser remembers the code and a visit counter for that code is incremented on our server. No data about you is stored in the process. If you complete an order, the code is attributed to the order so we can calculate the partner's commission; the partner receives only the number of orders and the commission total, no data about you. Legal basis: Art. 6(1)(f) GDPR. Retention: with the order data.

Data of our partners (name, company, contact details, address, payouts) is processed to perform the partner agreement (Art. 6(1)(b) GDPR) and retained for 7 years.

4.9 Blog

When reading our blog only server logs (section 3) are processed. Comments are not possible.

5. Platform and mobile app

5.1 User account, login and sessions

Your account contains: first name, last name, e-mail address, phone number (optional), password (hashed), language, time zone, colour scheme, communication preferences, progress in the setup wizard, subscription status, Stripe customer number, storage usage and any delivery or billing addresses you enter in the platform shop.

On every login we create a session and store: time, IP address, browser/operating system, device type (web, iOS, Android) and a randomly generated device identifier (see Cookie Policy). This lets you see all active sessions in your account settings and sign out of them individually or all at once; we can detect and end suspicious sessions (e.g. login from a new device). Purpose: providing the account, security, protection against account takeover. Legal basis: Art. 6(1)(b) and (f) GDPR. Retention: account data until the account is deleted; session data 90 days after the session ends.

To reset your password we send you a one-time link valid for 1 hour. When you move from the webshop to the platform after a purchase, a handover token valid for 60 seconds is used. We do not offer login via Google, Apple or Facebook.

5.2 Memorial pages: data of the deceased

As owner you enter about the deceased person: first name, middle name, last name, dates of birth and death, quote, short biography, full biography, profile and cover picture, photos and videos, memory texts, life-story chapters (with date and place) and optionally the grave location (section 5.6). Data of deceased persons is not personal data within the meaning of the GDPR; section 12 applies to relatives.

5.3 Data of living persons on memorial pages

Memorial content often also concerns living people: family members in photos or videos, people named in biographies, authors of memories ("signed by" with name and relationship to the deceased). This data is entered by owners and collaborators, who are responsible for being allowed to share it (see Terms). We store and display the content on behalf of and in the interest of the owners. Legal basis: Art. 6(1)(b) GDPR (towards the owner) and Art. 6(1)(f) GDPR (legitimate interest of owners and relatives in remembrance; towards persons depicted or named). If you are depicted or named on a memorial page and do not agree, contact the owner or us ([email protected]); we review every report and remove content where your interests prevail (section 13). Retention: as long as the memorial page exists (section 11).

5.4 Photos, videos and slideshows

Photos are uploaded through our servers, converted into several sizes and stored and delivered by our processor bunny.net (BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia). Videos are uploaded by your browser or the app directly to bunny.net ("Bunny Stream"), where they are converted into streaming formats. Storage location of the original files: Frankfurt. bunny.net operates a worldwide network of delivery servers; on access, copies are temporarily cached on the server closest to the viewer (including outside the EU if a memorial page is opened from there). A data processing agreement including standard contractual clauses for transfers outside the EEA is in place with bunny.net. From the approved photos we automatically create a slideshow (video) per memorial page every week. When you trim a video before uploading, your browser processes the video locally (see Cookie Policy). For every file we store technical data (format, size, dimensions, checksum), the screening status (section 5.13), a description and optionally the name and relationship of the person who contributed the file. Legal basis: Art. 6(1)(b) GDPR. Retention: with the memorial page.

5.5 Life story

The "Life story" is a collection of chapters about the deceased, guided by prepared questions (e.g. about childhood, family, work). The questions are fixed texts; no content is generated or evaluated by artificial intelligence. Owners decide whether the life story is public or visible only to people with access. Chapters may also concern living persons; section 5.3 applies.

5.6 Grave location (location data)

Owners may optionally record the location of the grave as text and as coordinates. This information is not public by default and only becomes visible if the owner explicitly enables publication. We call no third-party map services; coordinates are stored only with us. Legal basis: Art. 6(1)(b) GDPR; publication based on the owner's decision (Art. 6(1)(a) or (f) GDPR).

5.7 Visibility of memorial pages and search engines

Owners choose for each memorial page:

• Public: anyone with the link or the QR code can see the page, read the life story and leave candles or flowers. Public memorial pages may be indexed by search engines unless the owner excludes this in the settings.
• Link only: like public, but not released to search engines.
• Private: only people approved by the owner see the page; everyone else sees only the name, photo and dates of the deceased ("card").

Whoever opens a memorial page sees, depending on visibility, the content from 5.2 to 5.6 and the names and relationship details of the people who left memories, candles or flowers. When a memorial page is opened via the QR code, only the page is loaded; we build no scan profiles and do not record who scanned when (beyond the server logs in section 3).

5.8 Visitors: candles and flowers (condolences)

Visitors can leave a candle, flowers or another symbol without an account and may voluntarily enter their name and relationship to the deceased. Name and relationship are shown on the memorial page. To prevent abuse (at most one condolence per memorial page and hour without an account) we also store the visitor's IP address. Legal basis: Art. 6(1)(f) GDPR (operation of the memorial page, abuse prevention). Retention: name and relationship as long as the memorial page exists or until the owner deletes the entry; the IP address is deleted after 7 days. You can request deletion of your entry at any time (section 13).

5.9 Access requests and guest access

On private memorial pages visitors can request access from the owner, providing name, e-mail address, phone number (optional) and a message. The owner sees this information and decides. If approved, you receive by e-mail a setup link valid for 24 hours for a guest access (e-mail address, name, phone number, password) that applies only to this memorial page. Without an account you can sign in with it for 1 day. Access requests are limited to two per day and IP address. Legal basis: Art. 6(1)(b) GDPR (at your request) and (f). Retention: rejected or unprocessed requests 90 days; guest accesses until deleted by the owner or with the memorial page.

5.10 Inviting collaborators

Owners can invite other people by e-mail as viewers or editors. We store the invitee's e-mail address, the role, the inviter and the status. The invitee receives an e-mail with the names of the inviter and the deceased and a link valid for 7 days; on acceptance an account (first name, last name, password) is created. Collaborators see each other's names and e-mail addresses in the memorial's collaborator overview. Legal basis: Art. 6(1)(f) GDPR (owner's interest) or (b) after acceptance. Retention: expired or declined invitations are deleted 30 days after expiry.

5.11 Notifications

The platform shows you notifications (e.g. new memory, new candle, request, invitation accepted, content-screening notice). We store per account the last 20 notifications with type, time, read status and a reference to the triggering person and memorial page. We send no push notifications to the device and no SMS. Legal basis: Art. 6(1)(b) GDPR.

5.12 Shop inside the platform

In the "Shop" area of the platform you can change your subscription, order add-on products, change the payment method and download invoices. Sections 4.2 to 4.5 apply; for cancellation and withdrawal, section 5.15.

5.13 Content screening, warnings and suspensions

Every uploaded photo and video is automatically screened for adult or otherwise rule-violating visual content. The screening is performed by an image-recognition model running on our own server; no content is sent to external providers or AI services. The software assigns a score; below the threshold the file is released immediately. Above the threshold (or if the check fails) the file is temporarily withheld and reviewed by a member of our staff, who approves or rejects it. If rejected, you receive an e-mail with the reason and a warning; after the third warning the account is suspended, the subscription cancelled and you are informed by e-mail. Suspensions can be lifted by us. Texts (biographies, memories, life story) are not screened automatically. The final decision to reject content or suspend an account is always taken by a human; there is no solely automated decision within the meaning of Art. 22 GDPR. You can contest any decision at [email protected]. For the content we store the score and result, for the account the number of warnings, the time and reason of suspension. Legal basis: Art. 6(1)(f) GDPR (protection of users and the platform) and (c) (duties as a hosting provider under Regulation (EU) 2022/2065, Digital Services Act). Retention: withheld and rejected files are deleted 90 days after the decision; warnings remain stored for the life of the account.

5.14 Mobile app

The app offers the same functions as the platform. In addition:

• Device information: with every request the app transmits device type (iOS/Android), OS version, device model and the device identifier described in the Cookie Policy. Purpose: session security, troubleshooting. Legal basis: Art. 6(1)(f) GDPR.
• Permissions: the app accesses your photo library only with your permission and only to upload photos and videos you select. Camera, microphone, location and contacts are not used. Location metadata in photos is removed during conversion.
• No analytics or crash reporting: the app contains no analytics, advertising or crash-reporting SDKs.
• App stores: when you download via the Apple App Store or Google Play, Apple Distribution International Ltd. (Ireland) and Google Ireland Ltd. process data as independent controllers under their own privacy policies. We receive no personal data about you from the stores.
• Deleting your account is possible in the app under Account → Delete account.

5.15 Cancellation, withdrawal and reminders

You can cancel a subscription via "Cancel contracts here" and withdraw from it via "Withdraw from contract here", in your account or without logging in through the form that every page of the platform and the webshop links to. We process: name, e-mail address, the contract (contract number or your description of it), the type of declaration (ordinary or extraordinary cancellation, withdrawal), a reason for cancelling if you give one, the requested date, date and time of receipt, the outcome (end of contract, refund) and the confirmation e-mail. A declaration sent without logging in is matched to your account by e-mail address and contract; if that is not unambiguous, our support reviews it. After cancelling you may tell us why you cancelled; this is voluntary. Purpose: carrying out the cancellation or withdrawal, the confirmation required by law and proof of receipt. Legal basis: Art. 6(1)(c) GDPR (§ 312k BGB, § 356a BGB, § 13a FAGG), (b) (contract) and (f) (proof in legal disputes); for the voluntary reason, (f) (improving our service). Retention: 3 years from the end of the year in which the declaration was received; refunds and credit notes like invoices for 7 years (section 4.4).

Before every automatic renewal of a subscription (30 days before for yearly subscriptions) and before a free trial ends (3 days before) you receive a reminder by e-mail with the date, the price and how to cancel. We store which reminder was sent when. Legal basis: Art. 6(1)(b) and (c) GDPR (§ 6(1)(2) KSchG).

6. E-mail communication

We send you the following e-mails: order and payment confirmation (with QR code and invoice), invoices and credit notes, confirmations of cancellations and withdrawals (with PDF), reminders before a renewal or the end of a trial, invitations, password-reset link, setup link for guest access, content-screening notices, warnings and account suspensions and, only with consent, the newsletter. Sending is done by our processor Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France). Brevo receives the e-mail address, subject and content of the message (including names, links and attachments contained in it) and stores delivery logs. A data processing agreement is in place with Brevo; processing takes place in the EU. Our e-mails contain no open- or click-tracking pixels. Legal basis: Art. 6(1)(b) GDPR (transactional and service e-mails), (a) (newsletter). Retention at Brevo: delivery logs up to 90 days.

7. Cookies and local storage

We use only strictly necessary cookies and browser storage and therefore need no consent. All details, names and lifetimes are in our Cookie Policy.

8. Recipients and processors

Within Nolix Digital GmbH only staff with an appropriate role (administration, support, content review) have access to customer data; access to withheld content is logged.

9. Transfers to third countries

Our servers are located in the EU. Transfers outside the EEA occur only in the following cases: (a) Stripe may transfer data to Stripe, Inc. in the USA, basis: EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023) and standard contractual clauses; (b) bunny.net temporarily caches copies of media files on delivery servers in the country from which a memorial page is opened, basis: standard contractual clauses (Art. 46(2)(c) GDPR) in the data processing agreement; (c) loading the video-editing component from unpkg.com/Cloudflare (USA), basis: EU-US Data Privacy Framework; (d) Apple and Google, where you use their stores. A copy of the standard contractual clauses is available on request.

10. Retention periods (overview)

11. End of subscription and account deletion

End of subscription: When your subscription ends, for example through cancellation, withdrawal or non-payment, the memorial page stays visible to visitors for 30 more days but can no longer be edited. After that, visitors can no longer open it. We keep your account and your content for 12 months from the end of the contract; during that time you can log in, view your content and resume the subscription at any time. After that we permanently delete the memorial page with all media; we remind you by e-mail beforehand. Legal basis: Art. 6(1)(b) GDPR (resuming the contract) and (f) (protection against unintended loss of the memories). Memorial pages with lifetime access (e.g. Soul Star plaques bought through partners) remain as long as we operate the service; should the service be discontinued, we will inform owners at least 6 months in advance and offer an export of all content.

Account deletion: You can delete your account at any time in the account settings (platform and app) or by e-mail to [email protected]. We then delete your account, your memorial pages, all photos, videos and slideshows at bunny.net, memories, life stories, collaborator and guest accesses, sessions and notifications within 30 days. Candles and flowers you left as a signed-in user on other people's memorial pages are anonymised. Invoice data remains stored, restricted, for 7 years for tax reasons. If you are a collaborator on other people's memorial pages, their content remains with the owner. Before deleting we recommend exporting your content (section 13, data portability).

12. Data of the deceased and rights of relatives

The GDPR does not apply to data of deceased persons. We nevertheless respect the memory of the deceased and the rights of their relatives (post-mortem personality rights, § 78 Copyright Act on protection of a person's image). Close relatives who do not agree with a memorial page or individual content can contact [email protected]. We mediate between the parties and remove content where protected interests prevail or a court or authority orders it. Details are set out in our Terms.

13. Your rights

Under the GDPR you have the following rights towards us:

• Access (Art. 15): which data we process about you, and a copy of it.
• Rectification (Art. 16): correct inaccurate data; you can change account data yourself in the settings.
• Erasure (Art. 17): see section 11; exceptions apply to invoice data that must be retained by law.
• Restriction of processing (Art. 18).
• Data portability (Art. 20): in the account settings you can request an export of your account data and all content of your memorial pages (texts as JSON, media as files); until then by e-mail.
• Objection (Art. 21): to processing based on legitimate interests, on grounds relating to your particular situation, in particular to the display of your name or image on someone else's memorial page.
• Withdrawal of consent (Art. 7(3)): at any time with effect for the future, e.g. the newsletter or publication of the grave location.

Send requests to [email protected] or by post to the address in section 1. We reply within one month. For security we may ask you to prove your identity (e.g. by writing from the e-mail address registered with us).

14. Right to lodge a complaint

If you believe we process your data unlawfully, you can complain to the Austrian Data Protection Authority: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, phone +43 1 52 152-0, e-mail [email protected], https://www.dsb.gv.at (otvara se u novoj kartici), or to the supervisory authority of your place of residence in the EU. We would appreciate it if you contacted us first.

15. Automated decisions and profiling

We take no solely automated decisions with legal or similarly significant effects and build no user profiles. The automatic pre-screening of images (section 5.13) only withholds content temporarily; every rejection and every suspension is decided by a human.

16. Data security

We take technical and organisational measures under Art. 32 GDPR, in particular: TLS encryption of all connections; Argon2 hashing of passwords; signed, time-limited addresses for media files; database and internal services not publicly reachable; role-based access rights and two-factor authentication for staff; limitation of login attempts; session management with device binding; encrypted daily backups in the EU; separation of development and production systems; logging of administrative access. In the event of a personal data breach we notify the Data Protection Authority and, in case of high risk, the affected persons in accordance with Art. 33 and 34 GDPR.

17. Minors

Our services are aimed at adults. Contracts in the webshop can only be concluded by persons with full legal capacity. Persons under 14 may not submit data to us without the consent of their legal guardians (§ 4(4) Austrian Data Protection Act). If we learn that we process a child's data without the required consent, we delete it.

18. Changes to this policy

We update this policy when our processing, the legal situation or the service providers we use change. The current version is always available at moments.memorial/privacy and in the app. In case of significant changes we inform registered users by e-mail or at the next login.