Privacy Policy — RemiStories

1. Who we are

RemiStories is a photo-book service operated by TOPCODE d.o.o. ("RemiStories", "we", "us"), Smoletova ulica 13, 1000 Ljubljana, Slovenia, VAT ID SI95789278. We are the data controller for the personal data described in this policy.

This policy explains what we collect when you use the RemiStories app or website, why we collect it, and what you can do about it. It is written to comply with the EU General Data Protection Regulation (GDPR).

2. What we collect

Account details — Your email address, display name and optional profile photo.
Content you create — Photos, stories, moments, captions, dates, locations and feelings you add.
Order details — Delivery address, book specification and order history. Payments are handled by our payment provider — we never see or store your full card number.
Usage data — Basic, aggregated information about how the app is used, so we can fix problems and improve it.
Device data — Device type, operating system and app version, used for diagnostics.

3. Why we use it

To provide the service — storing your stories, generating book layouts, printing and delivering orders. (Legal basis: performance of a contract.)
To communicate with you — order confirmations, reminders you've switched on, and replies to your messages. (Contract / consent.)
To improve RemiStories — understanding which features are used, in aggregate. (Legitimate interest.)
To keep things safe — preventing abuse, fraud and unauthorised access. (Legitimate interest / legal obligation.)

We do not use your data for profiling or targeted advertising, and we do not sell it to anyone.

4. Your photos

Your photos are stored so we can show them in your stories and lay them out in your book. They remain yours: you keep all rights to them, and uploading them to RemiStories does not give us ownership.

We do not use your photos to train machine-learning models, and we do not make them public. The layout engine that designs your book processes your photos automatically in order to produce your book — no employee browses your library.

If you delete a photo, a moment or a whole story, it is removed from our active systems and deleted from backups within 30 days. Books you have already ordered and had printed cannot be recalled, for obvious reasons.

5. Sharing & contributors

When you invite someone to a story, they can see all the moments and photos in that story and add their own. They cannot see your other stories. You can remove a contributor at any time; moments they added remain in the story unless you delete them.

If you choose to share a book link publicly, anyone with that link can view — and, if you enable it, order — that book. You can revoke a link at any time.

6. Third parties we work with

We use a small number of carefully chosen providers to run the service. They may process your data on our behalf, under contract, and only for the purpose we've engaged them for:

Cloud hosting and storage — to store your account and content, within the EU.
Payment processing — to take payment securely. We never store full card details.
Print and fulfilment partners — they receive only the finished book file and the delivery address needed to print and post your order.
Email delivery — to send transactional messages such as order confirmations.

A current list of sub-processors is available from us on request at any time.

7. How long we keep it

We keep your account and content for as long as your account is open. Photos on the free plan are an exception: they are stored for the limited period stated in the app, and we notify you before any photo is scheduled for deletion. The optional storage subscription keeps every photo for as long as it is active. If you delete your account, your stories, moments and photos are deleted within 30 days, except where we are legally required to retain certain records — for example, invoices and order records, which tax law requires us to keep for a defined period.

8. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you, and receive a copy of it.
Correct anything inaccurate.
Delete your data ("right to be forgotten").
Restrict or object to certain processing.
Export your data in a portable format.
Withdraw consent at any time, where processing is based on consent.

To exercise any of these, email remistories@topcode.si. We'll respond within 30 days. You also have the right to lodge a complaint with your national data protection authority — in Slovenia, the Information Commissioner (Informacijski pooblaščenec).

9. Children's photos

RemiStories is intended for adults. You must be 16 or older to create an account.

Many stories contain photos of children, added by their parents or guardians. If you are an organiser creating a group story for a camp, class or club, you are responsible for obtaining the appropriate consent from parents or guardians before adding photos of their children, in line with your own organisation's policy and applicable law. Only invited families can access a group story.

10. Security

Data is encrypted in transit and at rest. Access to production systems is restricted to a small number of authorised people and logged. We review our security practices regularly. No system is perfectly secure, but we take this seriously — if a breach ever affects your data, we will notify you and the relevant authority as required by law.

11. Changes to this policy

If we make a material change, we'll let you know by email or in the app before it takes effect.

12. Contact us

Questions about privacy, or want to exercise one of your rights? Email remistories@topcode.si, or write to TOPCODE d.o.o., Smoletova ulica 13, 1000 Ljubljana, Slovenia. A real person will read it.