Privacy policy in 40 pages, actually on one page.in 40 pageson one page.

1.Who is responsible for your data

The data controller is Hangovers happenings d.o.o., Kučerina 62, 10000 Zagreb, Croatia, OIB (Croatian tax number) 53493374150. For anything about your data, email [email protected].

2.What data we collect

• When you make a magnet: your story and the rest of the form (place, dates, title, names and descriptions of people, text for speech bubbles and signs, props), any fix note and the photos you add for likeness. Plus a random visit ID we use to count free tries. If you upload a finished image of your own instead of an AI drawing, it goes only into your cart and order; we don’t send it to an AI service.
• When you order: name, e-mail, mobile number, HP Box parcel locker, a billing address if you enter one, the chosen design and quantity. If you tick them, also your consent to publication with a short story, and your interest in NFC.
• When you create an account: name, e-mail and password. We don’t store your password as text but as a one-way cryptographic hash (scrypt, salted), so even we can’t read it. We e-mail you a link to confirm your address; until you confirm it, the account can’t draw.
• When you pay: you enter your card details directly with Stripe. We never see or store them; Stripe only tells us whether the payment went through.
• When you email us: your e-mail address and the content of your message.
• Technical data: your IP address and browser details are processed by our service providers (hosting and Cloudflare) for security and to run the site. Our app doesn’t store the IP address itself. With each drawing we store only a one-way fingerprint of it (HMAC), to limit free drawings without an account to 5 a day from the same network and to prevent abuse. The fingerprint is deleted together with the other personal data of the drawing after 30 days. The legal basis is our legitimate interest in preventing abuse, point (f).
• If you allow analytics or ads: which pages you open and which steps you take (for example the magnet maker, the cart and a purchase with its amount and order number), technical device and browser data, and the traffic source, meaning the ad or site you came from. See cookies and traffic source.

3.Your story and photos go to an AI service

The illustration is drawn by an AI service, not by us. So we send the text from the form (your story, names and descriptions of people, the text for the magnet and any fix note) and the photos you add to OpenAI, and to Google when we draw with its Gemini model. The service draws the picture and sends it back to us.

We don’t store your likeness photos. We send them only to the AI service for that drawing; on your side they stay in your browser until you close the page.

We store the finished images and the assembled prompt text on our server, so we can make the magnet you order and help if something goes wrong. Generations that don’t end up in an order are deleted automatically after 30 days.

Pictures by email: if you ask us to “Email me the pictures”, we store your email address, small watermarked copies of your pictures and the magnet description, so we can send the email and the link in it can bring you back to your pictures. The basis is your request. We send one reminder after 24 hours only if you tick that separate box (consent, point (a)); we also store when you ticked it. We don’t send newsletters. All of it is deleted after 30 days.

Reminder about an unfinished order: if you tick “If I don’t finish paying, send me one reminder” when ordering and then don’t finish paying, we send one email after 24 hours with a small watermarked picture of your magnet, a link to finish the order and a one-tap survey. The basis is your consent, point (a); we also store when you gave it. We don’t send it if you pay in the meantime. You withdraw your consent with the “Don’t email me again” link in the email or by writing to [email protected]; for that we keep only an encrypted fingerprint of your address, not the address itself.

If you stop at payment: when you come back from Stripe you can tell us in one tap what stopped you. We store the answer without personal data, like the other survey answers.

“Why haven’t you ordered?” survey: we store your answer (the reason and optional text) without your email, name or IP address, only with the mood, number of drawings and visit source. So the 3-drawing reward is given only once, we separately keep the session ID, an encrypted network fingerprint, or your account or an encrypted email fingerprint, for up to 30 days.

AI services process the data under their terms for business customers. Please don’t send photos of people who haven’t agreed, or anything you don’t want to share, such as health information.

4.Why we use it, and on what legal basis

• Making the preview and the magnet, your order, delivery and support: performance of a contract and steps you ask for before entering into one (Article 6(1)(b) of the General Data Protection Regulation, GDPR).
• Your account (login, order list, password reset): performance of a contract, point (b).
• Invoices and bookkeeping: legal obligation, point (c).
• Preventing abuse (bot check, the free-try limit, security logs): our legitimate interest, point (f). AI drawing costs us money, so bots shouldn’t be able to use it up.
• Publishing your magnet as an example: your consent, point (a), only if you tick the box when ordering.
• Telling you about NFC: your consent, point (a), only if you tick that you’re interested.
• One reminder about an unfinished order: your consent, point (a), only if you tick that box when ordering.
• Visit statistics (Google Analytics): your consent, point (a), only if you switch on analytics. It tells us how many people visit and which pages they open.
• Measuring ads and building ad audiences (Meta pixel): your consent, point (a), only if you switch on ads. It tells us which ads on Facebook and Instagram bring visits and purchases, and lets us show our ads there to people who have already been to memonir.com.
• Traffic source with drawings and orders: your consent, point (a), only if you switch on analytics or ads.

We don’t sell your data or use it for automated decision-making. We don’t send you marketing e-mails without your consent.

5.Who we share it with

We share data only with the service providers the site can’t run without, and only what they need. Analytics and ads are the exception: those services only get data if you switch them on in the cookie settings.

• OpenAI: the text from the form and the photos you add, to draw the illustration.
• Google (Gemini): the same, when we draw with Google’s model.
• Stripe: payments. Receives your e-mail, the amount and the order number; you enter your card details directly with Stripe.
• Resend: sending e-mails. Receives your address and the content of the message (order confirmation, a reminder about an unfinished order if you ask for one, password reset link); it also carries the notice of your order to us.
• Cloudflare: bot protection (Turnstile) before drawing, and protecting and delivering the site. Processes your IP address and technical browser data.
• Railway: the server that runs the site and stores orders, user accounts and generated images.
• Google (Gmail): the [email protected] mailbox where your messages arrive.
• Google Analytics (Google Ireland Limited), only if you switch on analytics: which pages you open and the steps towards an order (for example the magnet maker, the cart and a purchase with its amount, order number and the magnet’s title), device and browser type, approximate location and which site you came from.
• Meta (Meta Platforms Ireland Limited, the company behind Facebook and Instagram), only if you switch on ads: the Meta pixel sends which pages you open and the steps towards an order (for example adding to the cart and a purchase with its amount, number of magnets and order number), technical device and browser data, your IP address and the _fbp and _fbc cookies. We don’t send your name, e-mail, mobile number, story or magnet images with these events. If you use Facebook or Instagram in the same browser, Meta may link this data to your profile. We also report a purchase to Meta directly from our server (Conversions API), again only if ads are switched on: the amount, number of magnets, order number, the _fbp and _fbc cookies and browser data, without your IP address, name, e-mail or mobile number. That way the purchase is measured even when the browser blocks the pixel.
• Croatian Post (HP Box): for delivery, your name, mobile number and the chosen parcel locker.
• Print shop: only the print file of your magnet, without your contact details.

Meta and we are joint controllers for collecting data with the Meta pixel on our site and transmitting it to Meta. Meta processes it further as an independent controller, under its own privacy policy.

Where the law requires it, invoice data also goes to our accountant or the competent authorities.

6.Transfers outside the EU

OpenAI, Google, Meta, Stripe, Resend, Cloudflare and Railway are US companies or use servers outside the European Economic Area, so data may also be processed in the United States. As these providers state, such transfers rely on the European Commission’s adequacy decision (the EU–US Data Privacy Framework) or on the European Commission’s standard contractual clauses.

Data from Google Analytics and the Meta pixel is received by Google Ireland Limited and Meta Platforms Ireland Limited, which may transfer it to their parent companies in the United States (Google LLC and Meta Platforms, Inc.) with the same safeguards.

7.How long we keep it

• Generations you don’t order (images and prompt text): deleted automatically after 30 days. Only a record without personal data remains: how many images were drawn, when, what it cost and which source the visit came from.
• Likeness photos: not stored. They stay only in your browser until you close the page.
• Pictures by email (email, small pictures, description, reminder consent): 30 days.
• Survey: answers without personal data are kept for statistics; reward markers 30 days.
• Reminder about an unfinished order: the consent and its time stay with the order as long as the order; the sending record (order number, encrypted address fingerprint and time) 30 days; the small pictures for the email 8 days; the address fingerprint on the “Don’t email me again” list for as long as we need it to respect your withdrawal.
• Orders (delivery details, the magnet image and description): until we’ve made and delivered the magnet and the period for complaints has passed. Data needed for invoices is kept as long as accounting and tax law requires.
• Your account: until you ask us to delete it. A password reset link is valid for 1 hour.
• A published example: until you withdraw your consent.
• E-mails: until your question is resolved, or as long as the order if they concern one.
• Technical logs of the server and Cloudflare: briefly, according to those providers’ settings.
• Traffic source: with an order, as long as the order. With a generation, 30 days; after that only a part without personal data remains, see traffic source.
• Your cookie choice: 180 days in your browser, then we ask again.
• Google Analytics: according to the data retention settings in Google Analytics.
• Meta pixel: the _fbp and _fbc cookies last up to 90 days. Meta keeps the data it has received under its own rules.

8.Cookies and browser storage

We group cookies and similar technologies (your browser’s local storage and session storage) into three categories. Necessary ones always work; analytics and ads are switched on only if you agree, with “Accept all” or under “Settings”. Until you decide, and if you choose “Necessary only”, the analytics and ad code isn’t loaded at all.

Necessary (always on; the site doesn’t work without them):

• Login cookie (mm_auth): set only when you sign up or log in, valid for up to 30 days or until you log out. Scripts on the page can’t read it.
• Cart (local storage): the magnets you chose (image, title and description) and their quantities. It stays in your browser and reaches us only when you order.
• Visit data (session storage): a random visit ID, the number of tries used and the story you’re writing. Cleared when you close the tab.
• Cloudflare Turnstile: checks you’re not a bot before drawing. Cloudflare processes technical browser data to do so.
• Your cookie choice (mm_consent, in local storage and as a cookie): which categories you allow and when you chose. It lasts 180 days, then we ask again; earlier only if we change the cookie categories. It stays in your browser; we don’t store it on our server.

Analytics (only with your consent):

• Google Analytics 4 (Google Ireland Limited; _ga and _ga_… cookies, which Google sets for up to 2 years): visit statistics, meaning how many people visit, which pages they open and how many get as far as an order. We use Google Consent Mode v2: everything is denied by default, and we only load Google’s code once you switch on analytics. If you also switch on ads, we tell Google it may use advertising cookies and data as well.

Ads (only with your consent):

• Meta pixel (Meta Platforms Ireland Limited; _fbp and _fbc cookies, up to 90 days): measures which ads on Facebook and Instagram bring visits and purchases, and lets us show our ads there to people who have already been to memonir.com and find people similar to them. What exactly Meta receives is described under Who we share it with.

With analytics or ads we also store in your browser:

• Traffic source (mm_src, session storage): cleared when you close the tab; see the next section.
• Orders already counted (mm_tracked, local storage): the numbers of up to 100 recent orders we have already counted, so the same purchase isn’t counted twice.

Changing or withdrawing your consent: click “Cookie settings” at the bottom of any page, switch analytics and ads on or off and click “Save choices”. You can withdraw your consent at any time. Sending then stops straight away, without reloading the page, and we delete the cookies of the switched-off category (_ga, _gid, _fbp and _fbc) from memonir.com. Withdrawal doesn’t affect what was sent before it; the providers keep that data under their own rules.

Stripe’s payment page has its own cookies and its own privacy policy.

You can delete cookies and stored data in your browser settings. You’ll then be logged out, your cart will be emptied and the site will ask about cookies again.

9.Where you came from (traffic source)

To know which ad or post really brings orders, and to stop paying for ads that don’t work, we record the source of your visit. We only do this if you switch on analytics or ads in the cookie settings. The record is made on the first page you open and contains:

• campaign tags from the link in the ad or post (utm_source, utm_medium, utm_campaign, utm_content, utm_term)
• the ad click ID from Facebook or Instagram (fbclid) or from Google (gclid)
• the site you came from, if it’s another site (only its address, without parameters)
• the first page of your visit to memonir.com and the time

Each value is cut to at most 200 characters. The record is kept in your browser’s session storage until you close the tab, and when you start a drawing or an order we send it along and store it on our server.

Only we use it, to see which sources bring drawings and orders. With an order we keep it as long as the order, with a generation for 30 days. After that, only a part without personal data stays with the generation: the campaign tags, the domain of the site the visit came from, the first page of the visit and whether there was a click ID, but not the ID itself. If you switch off both analytics and ads, we delete the record from your browser and stop sending it.

10.Publishing your magnet as an example

When ordering you can tick that we may publish your magnet as an example on memonir.com and our social media, together with a short story you write. Without that tick we don’t publish your magnet.

Once such an order is paid, the magnet appears on the Examples page: the image, the title and your short story. We never publish your name, e-mail, mobile number or any other order details.

Before you tick the box, check that everyone on the magnet is happy for it to be published. You can withdraw your consent at any time by emailing [email protected]. We then remove the magnet from the site and from our profiles.

11.Your rights

You have the right to:

• confirmation of whether we process your data, and a copy of it (access)
• have inaccurate data corrected
• have your data erased, except data we must keep by law (for example for invoices)
• restrict processing
• object to processing based on our legitimate interest
• receive the data you gave us in a machine-readable format (portability)
• withdraw your consent at any time, which doesn’t affect processing before the withdrawal.

To use any of these, email [email protected], ideally from the address you use with us, so we know it’s you. We reply within one month at the latest. For now we delete user accounts on request by e-mail.

The easiest way to change or withdraw your consent to analytics and ads is the “Cookie settings” link at the bottom of the page; see cookies.

12.Complaining to the supervisory authority

If you think we process your data unlawfully, you can lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), azop.hr, or with the supervisory authority in the country where you live. We’d appreciate it if you let us know first, so we can try to sort it out together.

13.Children

Only adults (18+) may order. The service isn’t aimed at children and we don’t knowingly collect their data. If you put a child on a magnet (a name, a description or a photo), you may do so only as their parent or guardian or with their consent.

14.Security

The site runs over an encrypted connection (HTTPS). Passwords are stored as hashes, the admin area is password-protected, and the order confirmation page doesn’t show your name or full e-mail address.

15.Changes

When we change how we work, for example by adding a new service provider, we will update this policy. The date of the last update is shown at the top of this page.