Privacy Notice

Last updated 15 October 2026

Who is responsible

MaDare unipessoal LDA (NIF PT518470695), Madeira, Portugal, trading as My Album, is the data controller for personal data processed through myalbumapp.com. Contact: support@myalbumapp.com.

What we collect and why

• Account details (email address, encrypted password): to create and secure your account — performance of our contract with you.
• Your photos, captions and album settings: to store and display your albums and the links you share — performance of contract. Photos are resized and camera and location data (EXIF/GPS) is removed in your browser before upload.
• Subscription and purchase status: to unlock the plan you bought — performance of contract.
• Technical data (IP address, browser and device information, basic logs): to keep the service secure and prevent abuse — our legitimate interests.
• Support messages: to answer your questions — legitimate interests.

We don't sell your data, and we don't use your photos for advertising or to train AI models.

Who we share it with

• Service providers who host our app, database and photo storage and send account emails, under data-processing agreements.
• Paddle, our Merchant of Record, which handles the sale of our products, subscription management, payments, tax compliance and invoicing. Paddle processes payment details under its own privacy policy; we never see your card number.
• Professional advisers (legal, accounting) where needed.
• Authorities where required by law.
• People you share an album with: anyone with a share link (and password, if set) can view that album until you stop sharing or the link expires.

International transfers

Some providers may process data outside the EEA. Where they do, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses.

How long we keep it

We keep your account and albums while your account is active. When you delete an album or your account, the photos and data are deleted from our storage, with backups cleared within 30 days. Purchase records are kept as long as tax law requires.

Your rights

Under the GDPR you have the right to access, correct, delete, restrict or object to processing of your data, to data portability, and to withdraw consent at any time. You can delete your account yourself from My albums, or email us. We reply within one month. You can also complain to the Portuguese data protection authority, CNPD (cnpd.pt).

Security

Data is encrypted in transit and at rest. Photos are stored privately and only shown through short-lived signed links to you and the people you share with. Access to systems is restricted.

Cookies

We only use essential browser storage to keep you signed in and remember your album. We don't use advertising or tracking cookies. Paddle's checkout may set its own essential cookies to process payments.