Privacy Policy

Last Updated: October 23, 2026

1. Overview & Scope

This Privacy Policy ("Policy") describes how CodeCr8 LLC, a California limited liability company operating the MemoryDrop.io platform ("we," "us," "our," or "Company"), collects, uses, stores, shares, and protects personal information about:

• Account holders — individuals who register and manage an account on MemoryDrop.io;
• Organization members — users invited to manage events within an organization;
• Event guests — individuals who visit a public event page, submit an RSVP, or upload a photo;
• Website visitors — anyone who visits the memorydrop.io website.

This Policy applies to personal information collected through our website at https://memorydrop.io, our web application, and any related services (collectively, the "Service"). By using the Service, you agree to the practices described in this Policy.

2. Data Controller

For the purposes of applicable data protection laws, the data controller is:

CodeCr8 LLC
Operating as MemoryDrop.io
State of California, United States
Email: [email protected]

Where Event Owners collect personal information from their guests through RSVP forms, seating charts, or guest lists, the Event Owner acts as a data controller for that guest data. CodeCr8 LLC acts as a data processor on behalf of the Event Owner for such guest data. Event Owners are solely responsible for ensuring they have a lawful basis to collect and process their guests' personal information.

3. Information We Collect

3.1 Information You Provide Directly

Category	Examples	Who Provides It
Account information	Name, email address, password, profile photo	Account holders
Organization information	Organization name, brand name, logo, billing address	Organization owners
Payment information	Credit/debit card number, billing address (processed by our payment processor; we do not store full card numbers)	Subscribers
Event information	Event title, date, location, description, customization settings	Event Owners
RSVP data	Guest name, email address, phone number, dietary restrictions, attending status, custom form responses	Event guests
Seating data	Guest name, table assignment, seat number	Event Owners (imported) or automatically from RSVPs
Photos & media	Images uploaded to event galleries	Event Owners and event guests
Communications	Emails or messages sent to our support team	Any user
Uploader metadata	Uploader name, optional message attached to photo uploads	Event guests

3.2 Information Collected Automatically

When you visit or use the Service, we automatically collect certain technical information, including:

• Log data: IP address, browser type and version, operating system, referring URL, pages viewed, time and date of access, and other standard server log information;
• Device information: Device type, screen resolution, and hardware model;
• Usage data: Features used, events created, photos uploaded, clicks, and navigation patterns within the Service;
• Cookies and similar technologies: See Section 8 for details.

3.3 Information from Third Parties

• Google OAuth: If you choose to sign in using Google, we receive your name, email address, and profile photo from Google. We do not receive your Google password;
• Payment processors: We receive confirmation of successful payments and transaction identifiers from our payment processor. We do not receive or store your full payment card number;
• Affiliate networks: We may receive anonymized conversion data from affiliate networks when guests click Event Links from your event page (see Section 7).

4. How We Use Your Information

We use the information we collect for the following purposes:

• To provide the Service: Creating and managing accounts, hosting event pages, storing photos, processing RSVPs, generating seating charts, and displaying Event Links;
• To process payments: Billing your account for subscription fees and managing subscription status;
• To communicate with you: Sending transactional emails (account confirmation, password resets, billing receipts, storage expiry warnings), responding to support requests, and sending product updates where you have opted in;
• To improve the Service: Analyzing usage patterns, diagnosing technical issues, and developing new features;
• For security: Detecting, investigating, and preventing fraudulent, abusive, or illegal activity;
• For legal compliance: Complying with applicable laws, regulations, legal processes, and governmental requests;
• For affiliate tracking: Appending affiliate identifiers to Event Links and processing commission reports (see Section 7);
• To enforce our Terms: Investigating and acting on violations of our Terms of Service.

We do not sell your personal information to third parties. We do not use your personal information to send you unsolicited marketing emails from third parties.

5. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): Processing necessary to provide the Service, including account management, event hosting, and payment processing;
• Legitimate interests (Art. 6(1)(f) GDPR): Processing for security, fraud prevention, product improvement, and Service analytics, where these interests are not overridden by your rights;
• Legal obligation (Art. 6(1)(c) GDPR): Processing required to comply with applicable laws;
• Consent (Art. 6(1)(a) GDPR): Where we ask for your consent (e.g., optional marketing emails or cookie consent), you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

6. How We Share Information

We do not sell, rent, or trade your personal information. We may share information in the following limited circumstances:

6.1 Service Providers

We share data with trusted third-party service providers who assist us in operating the Service, subject to confidentiality obligations and data processing agreements:

• Amazon Web Services (AWS): Cloud infrastructure and S3 file storage. Photos and files uploaded to the Service are stored on AWS servers;
• Payment processors: To process subscription payments. Our payment processor receives your payment card information directly;
• Email service providers: To send transactional emails;
• Analytics providers: To analyze Service usage (using anonymized or aggregated data where possible).

6.2 Event Owners and Guests

RSVP responses, seating data, and uploaded photos submitted by guests on an event page are visible to the Event Owner and their authorized team members. Guests acknowledge that their submitted information will be shared with the Event Owner when they submit an RSVP or upload content.

6.3 Public Event Pages

Photos uploaded to a public gallery and displayed on a public event page are accessible to anyone who visits that event page URL. Event Owners are responsible for the privacy implications of making their event pages and galleries public.

6.4 Legal Requirements

We may disclose your information if required by law, court order, subpoena, or other governmental authority, or if we believe in good faith that such disclosure is necessary to: (a) comply with a legal obligation; (b) protect and defend our rights or property; (c) prevent or investigate possible wrongdoing; (d) protect the personal safety of users or the public; or (e) protect against legal liability.

6.5 Business Transfers

In the event of a merger, acquisition, sale of assets, bankruptcy, or other corporate transaction involving CodeCr8 LLC, your information may be transferred as part of that transaction. We will provide notice of any such change in control via the Service or email.

6.6 With Your Consent

We may share your information in other ways not described above with your explicit prior consent.

7. Affiliate Tracking & Third-Party Links

MemoryDrop.io may append affiliate tracking parameters or referral codes to Event Links (such as registry links added by Event Owners) displayed on event pages. This means:

• When a guest clicks an Event Link, a cookie or URL parameter may be set by the third-party retailer or affiliate network to track whether a purchase is subsequently made;
• If a qualifying purchase is made, CodeCr8 LLC may receive a commission from the third-party retailer;
• The affiliate tracking process involves the third-party retailer or affiliate network receiving your IP address and a cookie identifier when you click the link. This is subject to that retailer's privacy policy, not ours;
• This tracking does not result in CodeCr8 LLC receiving your name, payment information, or purchase details from the retailer;
• The prices you pay on any third-party website are not affected by affiliate tracking.

We are disclosing this practice in compliance with FTC guidelines on affiliate marketing and endorsements (16 C.F.R. Part 255). By using Event Links on the Service, Event Owners consent to this practice as further described in our Terms of Service.

8. Cookies & Tracking Technologies

8.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. We use cookies and similar technologies (local storage, session tokens) to operate and improve the Service.

8.2 Types of Cookies We Use

• Strictly necessary cookies: Required for the Service to function (e.g., session cookies that keep you logged in, CSRF protection tokens). You cannot opt out of these;
• Functional cookies: Remember your preferences and settings (e.g., password-unlock status for a protected event page);
• Analytics cookies: Help us understand how the Service is used so we can improve it. We use aggregated and anonymized data where possible;
• Third-party cookies: Set by our service providers (e.g., payment processors, analytics platforms). These are subject to those providers' privacy policies.

8.3 Your Cookie Choices

You can control and delete cookies through your browser settings. Disabling strictly necessary cookies will impair the functionality of the Service. For more information about managing cookies, visit allaboutcookies.org.

For users in the EEA/UK, we will display a cookie consent notice and will not place non-essential cookies without your consent.

9. Data Storage & Security

Your data, including uploaded photos, is stored on servers operated by Amazon Web Services (AWS). AWS maintains SOC 2 Type II and ISO 27001 certifications. Data is stored with access controlled through AWS IAM policies. Photos are stored in private S3 buckets and are accessible only via time-limited, cryptographically signed URLs.

We implement reasonable and appropriate technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction, including:

• Encryption of data in transit using TLS/HTTPS;
• Hashed passwords (never stored in plaintext);
• Role-based access controls within the Service;
• Periodic security reviews.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially reasonable security practices, we cannot guarantee absolute security of your information. You use the Service at your own risk. If you believe your account has been compromised, please contact us immediately at [email protected].

10. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required by law.

• Account data: Retained for the duration of your account. If you delete your account, we will delete your personal data within 90 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention, legal disputes);
• Event data & photos (free plan): Deleted 7 days after the event date;
• Event data & photos (paid plans): Deleted per the retention period specified in your plan (e.g., 6 months or 1 year after the event date);
• RSVP and guest data: Deleted alongside event data at expiry, or upon account deletion;
• Payment records: Retained for up to 7 years as required by U.S. tax and financial regulations;
• Server logs: Typically retained for 90 days for security and debugging purposes;
• Backup copies: May persist in encrypted backups for up to 90 days after deletion from active systems.

11. International Data Transfers

CodeCr8 LLC is based in the United States. If you are accessing the Service from outside the United States, your personal information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

For users in the EEA, UK, or Switzerland, we rely on the following safeguards for international transfers:

• Standard Contractual Clauses (SCCs) approved by the European Commission, incorporated into our agreements with service providers where applicable;
• AWS's data processing addendum, which includes SCCs for transfers to the United States.

By using the Service, you consent to the transfer of your information to the United States.

12. Children's Privacy

The Service is not directed to children under the age of 13 (or under the age of 16 in the EEA/UK). We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us at [email protected] and we will take steps to delete such information.

Event Owners must not use the RSVP or guest collection features to collect personal data from children under 13 (or the applicable age in their jurisdiction) without verifiable parental consent. The Event Owner is solely responsible for compliance with children's privacy laws (including COPPA) in their jurisdiction.

13. Guest & User-Uploaded Content

Photos and content uploaded to the Service may contain personal data, including images of individuals. You acknowledge and agree that:

• Event Owners are solely responsible for obtaining all necessary consents from individuals whose images or personal data are uploaded to or displayed through the Service;
• Photos uploaded to public event galleries may be viewable by any person who accesses the event page URL;
• We do not apply facial recognition or biometric processing to uploaded photos;
• We do not claim ownership of photos you upload. You retain all rights in your photos, subject to the license granted to us in our Terms of Service;
• If you are a guest who uploaded a photo and wishes to have it removed, please contact the Event Owner directly. You may also contact us at [email protected] if the Event Owner is unresponsive.

14. Your Rights

Depending on your location, you may have certain rights regarding your personal information. We will respond to verified requests within 30 days (or as required by applicable law).

• Access: You may request a copy of the personal information we hold about you;
• Correction: You may request that we correct inaccurate or incomplete information;
• Deletion: You may request that we delete your personal information, subject to legal retention obligations;
• Portability: You may request a machine-readable copy of the personal information you provided to us;
• Restriction: You may request that we restrict processing of your information in certain circumstances;
• Objection: You may object to processing based on legitimate interests;
• Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at [email protected]. We may require you to verify your identity before fulfilling your request. We will not discriminate against you for exercising your privacy rights.

15. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with the following additional rights:

15.1 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA: Identifiers (name, email, IP address); Commercial information (subscription and payment records); Internet or network activity (usage data, log data); Inferences drawn from usage to understand preferences; Visual information (uploaded photos); Geolocation data (approximate location from IP address).

15.2 Sources and Purposes

Personal information is collected directly from you, automatically through your use of the Service, and from third-party service providers as described in Section 3. We use it for the business and commercial purposes described in Section 4.

15.3 Disclosure and Sale

We do not sell personal information as defined under the CCPA/CPRA. We do not share personal information with third parties for cross-context behavioral advertising without your consent. We may disclose personal information to our service providers as described in Section 6.

15.4 Your CCPA Rights

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you;
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions;
• Right to Correct: You may request correction of inaccurate personal information;
• Right to Opt-Out of Sale or Sharing: As we do not sell or share personal information for targeted advertising, this right is not currently applicable;
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond those permitted by the CPRA;
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, contact us at [email protected] or by mail. We will verify your identity and respond within 45 days (extendable by an additional 45 days with notice).

California residents may also designate an authorized agent to make requests on their behalf. Authorized agents must provide written authorization from the consumer.

15.5 "Shine the Light" Law

Under California Civil Code Section 1798.83, California residents may request information about disclosures of their personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes without your consent.

16. European & UK Users (GDPR / UK GDPR)

If you are located in the EEA, UK, or Switzerland, in addition to the rights described in Section 14, you have the right to:

• Lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or your national Data Protection Authority in the EEA);
• Not be subject to solely automated decision-making that produces significant legal effects;
• Request information about the safeguards used for international data transfers.

Our legal bases for processing are described in Section 5. Our Data Protection contact is [email protected].

Note on Guest Data: Where Event Owners collect personal data from EEA/UK guests through RSVP forms, the Event Owner acts as data controller and is responsible for providing appropriate privacy notices to guests and obtaining a lawful basis for processing. CodeCr8 LLC acts as data processor and processes such data only on the Event Owner's documented instructions.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will update the "Last Updated" date at the top of this page and, where required by law or where changes are material, provide you with additional notice (such as by email or a notice on the Service). Your continued use of the Service after such changes constitutes your acceptance of the updated Policy.

18. Contact & Data Requests

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or wish to file a complaint, please contact us:

CodeCr8 LLC — Privacy Team
Operating as MemoryDrop.io
State of California, United States
Email: [email protected]
Website: https://memorydrop.io

For security-related concerns: [email protected]

We aim to respond to all privacy-related inquiries within 30 days. California residents and EEA/UK residents may have rights to receive a response within shorter timeframes as required by applicable law.

---

This Privacy Policy was last updated on October 23, 2026. Previous versions are available upon request. This document does not constitute legal advice. If you require specific legal guidance, please consult a licensed attorney.

Terms of Service  ·  Back to Home