Privacy Policy · MakeAlbum

MakeAlbum (operated from Lisbon, Portugal) builds custom photo albums. To do that we have to receive your photographs and a few basic personal details. This page explains what we do with them — and, just as important, what we don’t.

What we collect

Photographs you upload to your album, plus the technical metadata they contain (EXIF: camera, time, GPS if you didn’t strip it).
Account details: your email and display name. If you sign in with Google, we receive your email + basic profile from Google’s OAuth API (no Drive, no calendar, no contacts).
Order details: shipping address, the price you paid, and a Stripe payment reference. We never see or store your card number — Stripe handles that.
Basic usage: how often you log in, when you last edited the album. We don’t use third-party trackers, ad pixels, or session-replay tools.

Where it lives

Photographs and rendered PDFs sit in private Cloudflare R2 buckets in the EU. The application database (Postgres) and our queue workers run on a server in Germany. Payments flow through Stripe (EU entity). Printing is performed by Saal Digital in Germany, who receives only the print-ready PDF and the shipping address — not your photo pool.

What we never do

We never sell or share your photographs with anyone.
We never use your photographs to train AI models — ours or anyone else’s. The model that curates your album was trained on a separate licensed photography corpus.
We don’t embed advertising trackers or fingerprinting scripts. The marketing site uses no analytics that identify individuals.

How long we keep things

Photographs you upload are kept while your album is in progress and for 90 days after it ships, so we can reprint if there’s a defect. After that they’re deleted from R2. You can ask us to delete sooner (or to keep longer) by writing to [email protected].

Account details and order records are retained for as long as the account exists, plus 6 years for tax/accounting purposes (Portuguese law).

Your rights

Under GDPR (and equivalent regimes elsewhere) you can ask us at any time to:

Tell you what we hold about you.
Correct anything inaccurate.
Delete your account and all associated data.
Export your data in a portable format.

Write to [email protected] and we’ll get back to you within five working days.

Contact