Overview
Moments is a private event media platform. Hosts collect photos and videos from their guests; guests upload via a single QR code. This Privacy Policy explains what we collect, how we use it, who we share it with, and the choices you have. We aim to be straight-forward rather than legalistic — if anything is unclear, write to us at privacy@moments.app.
Who we are
- Entity: Moments Studio Yazılım A.Ş. (Istanbul, Turkey)
- Data Protection Officer: privacy@moments.app
- EU representative: contact via privacy@moments.app
What we collect
We collect only what we need to deliver Moments. The categories below are exhaustive.
- Account data: name, email, password hash, language and theme preferences.
- Event data: event name, hosts, date, location, your chosen settings and branding.
- Guest uploads: photos, videos, optional notes, and the guest name shown at upload time.
- Billing data: billing name, address, tax number for company invoices. Card numbers are never stored by Moments — they are tokenised by iyzico.
- Operational logs: IP address, browser, timestamps and request paths. Retained 24 months for abuse prevention.
- Analytics: aggregate, cookie-less pageview counts via Plausible.
How we use it
- To run your event and deliver the features of your plan,
- To bill and to send VAT-compliant invoices,
- To respond to support requests,
- To detect abuse and protect the platform,
- To improve the product (always on aggregate data),
- To send service emails (transactional). Marketing emails only with your explicit opt-in.
Lawful basis (GDPR)
- Contract: processing necessary to provide the service you purchased.
- Legal obligation: invoice retention, fraud prevention.
- Legitimate interest: platform security and aggregate product improvement.
- Consent: marketing communications and any optional analytics.
Retention
- Account data: while your account exists + 6 months,
- Invoices: 10 years (legal requirement),
- Uploaded media: full plan hosting period + 30 days, then deleted,
- Operational logs: 24 months,
- Support tickets: 24 months after closure.
Your rights
Under GDPR (and KVKK for Turkish users), you have the right to:
- Access a copy of your data,
- Correct inaccurate data,
- Delete your account and associated data,
- Object to processing based on legitimate interest,
- Withdraw consent for marketing at any time,
- Lodge a complaint with your local data protection authority.
To exercise any of these rights, email privacy@moments.app. We respond within 30 days.
Children
Moments is not directed at children under 16. If you become aware that a child has provided us with personal data without parental consent, please contact us so we can take appropriate action.
Changes to this policy
We may update this policy. When we do, we'll update the "last updated" date at the top, and for material changes we'll email every active account.