Who we are
Bound Memories is the trading name used for this personalised memory-book service. We decide how and why personal information is processed when you use the website, create a project or place an order.
Information we collect
- Account details such as your name, email address and authentication identifiers.
- Uploaded photographs, PDFs, approved cover files, written messages and book-page content.
- Names and comments extracted from screenshots after you review and choose to add them.
- Meta connection identifiers, managed Facebook Page details, linked Instagram professional-account details and comments you choose to add through the optional Meta importer.
- Book configuration, project history, approval records and cart information.
- Delivery address, shipping choice, order reference and fulfilment status.
- Payment status and transaction references. Full card details are handled by Stripe and are not stored by Bound Memories.
- Technical and security information such as browser details, diagnostic logs and relevant IP-address records.
Why we use your information and our lawful bases
- Contract: to create previews, save projects, process orders, arrange printing and delivery, and provide order support.
- Legitimate interests: to secure, maintain and improve the service, prevent fraud, diagnose faults and respond to support enquiries.
- Legal obligation: to retain records needed for accounting, taxation, disputes and consumer-law compliance.
- Consent: where required for non-essential analytics, marketing communications or optional third-party connections. Consent can be withdrawn at any time.
Screenshot processing
When you choose screenshot import, selected screenshots are sent securely to OpenAI through Bound Memories for visual extraction of visible author names, comments and emojis. Bound Memories does not save the original screenshot to your project or account; only names and messages that you review and choose to add are saved with the project. If the visual reader is unavailable or its fair-use allowance is reached, the service can fall back to text recognition in your browser. To prevent abuse, Bound Memories records hashed, non-readable identifiers and basic AI-usage metadata (such as time, model and success/failure); this metering record does not contain the screenshot image, author name or comment text. You are responsible for ensuring that you have permission to use the content and for removing anything that should not be printed.
Optional Facebook and Instagram connection
When you choose to connect Meta, Bound Memories stores the access token and account identifiers needed to show Facebook Pages and linked Instagram professional accounts that you manage. Access tokens are used only by the server and are not exposed in the browser.
Recent posts and comments are requested from Meta when you use the importer. Comments are displayed for review in your browser and are not added to a book project until you select them. You can disconnect Meta from the Create Book page, remove the integration through your Meta settings or request deletion through the Data Deletion page.
Children and other people in your content
A memory book may contain information or images relating to children, relatives, friends or other individuals. The account holder must have an appropriate basis and any permissions required to submit and print that material. The service is not intended for children to create accounts independently.
Who we share information with
Information is shared only where needed to provide and protect the service. Providers may include Supabase for authentication, database and storage services; Stripe for payments; Vercel for website hosting; Resend for transactional email; Lulu for print production, shipping quotations and fulfilment; Meta when you choose to connect Facebook or Instagram; and analytics providers where permitted by your consent choices.
Delivery and production providers receive the book files, contact details and delivery information necessary to fulfil the order. We do not sell personal information to advertisers.
International transfers
Some service providers may process information outside the United Kingdom. Where this happens, Bound Memories relies on the provider's applicable contractual safeguards, recognised adequacy arrangements or another lawful transfer mechanism.
How long we keep information
- Draft projects are retained while your account remains active or until you delete them or request deletion.
- Paid order, payment and fulfilment records may be retained for up to seven years where needed for legal, tax and accounting purposes.
- Production files and customer-uploaded content are retained only as long as reasonably necessary to fulfil, support or reproduce the order, unless you ask for earlier deletion where permitted.
- Security and diagnostic logs are normally retained for a shorter operational period unless required to investigate an incident.
Security
We use access controls, authenticated customer and administrator actions, encrypted connections, restricted service credentials and provider security controls. No internet service can guarantee absolute security, but access is limited to what is required to operate, support and fulfil the service.
Your rights
Depending on the circumstances, you may have rights to:
- request access to your personal information;
- correct inaccurate or incomplete information;
- request deletion or restriction of processing;
- object to processing based on legitimate interests;
- receive certain information in a portable format;
- withdraw consent where processing relies on consent; and
- complain to the UK Information Commissioner's Office.
Data deletion requests
Full instructions are available on the Data Deletion page. Some order information may need to be retained where required by law or for the establishment, exercise or defence of legal claims.
Contact us
Email: boundmemories@outlook.com
Please include “Privacy request” in the subject line for data-protection enquiries.