Privacy Policy

1. Who We Are

Foreva.io is operated by Grigorios Papanastasiou, a self-employed sole trader established in Malta (Sqaq Zbibu, Kappara Heights, San Gwann, Malta). He is the data controller responsible for your personal data. For privacy questions or to exercise your rights, email privacy@foreva.io.

2. What Data We Collect

• Photos you send via WhatsApp or Facebook Messenger (temporary; see retention below)
• Your delivery name and postal address
• Your payment reference (we do not store card details; handled by our payment provider)
• Your WhatsApp or Messenger identifier (for order updates only)
• Consent record and order log (no photos)

3. Why We Collect It

4. Photos of Children

If your photos include images of minors, you confirm by starting your order that you hold parental or guardian authority to share these images for the sole purpose of producing a physical printed album. Images of minors are deleted on the same retention schedule as all other photos (see Section 6) and are never retained beyond it.

5. Who We Share Your Data With

• Meta (WhatsApp and Messenger) carries your messages and photos to us.
• Infobip, our WhatsApp messaging provider, relays WhatsApp messages and photos between you and us.
• Railway hosts our servers and stores your photos while we build your album, in the EU (Amsterdam).
• Anthropic provides the AI that tidies up the text you type (your name, album title and address). It never receives your photos.
• Stripe processes your payment. We never see or store your card number.
• Gelato, our print partner, receives the print-ready album file and your delivery details to print and ship your album, and passes your name, address and phone number to the courier (usually DHL Express).
• Google Analytics measures visits to this website, only if you accept analytics cookies. It never receives your photos or order details.
• No data is sold or shared for marketing purposes. Ever.

Some of these providers are based outside the EU. Where your data leaves the EU, it is protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

6. How Long We Keep Your Data

• Your photos are deleted automatically 24 hours after your album is sent to print.
• If you don't order, your photos are deleted 48 hours after upload.
• If a paid order gets stuck (for example a printing or payment issue), we keep the photos for at most 14 days while we resolve it, then delete them.
• Your album preview is deleted 14 days after your album is printed.
• The print-ready file is deleted within 24 hours of printing.
• Your delivery address is deleted 7 days after delivery.
• Your order and consent log is retained for 3 years for legal and dispute purposes (contains no photos).
• Copies of the messages and photos you send also stay in your own WhatsApp or Messenger chat, and Meta and our messaging provider keep message copies under their own policies. You can delete the chat on your side at any time.

Exception: where we are required by law, or need to preserve information to comply with a legal obligation or to cooperate with law enforcement (for example, suspected illegal content), we will retain the relevant data for as long as necessary for that purpose, and no longer.

7. Your Rights

You have the right to access, rectify, erase, restrict, object to, and port your data. Message us on WhatsApp or Messenger with "MY DATA REQUEST", or email privacy@foreva.io. We respond within 30 days.

8. Security

Our servers and photo storage are in the EU (Amsterdam). Photos are encrypted in transit (TLS 1.3) and at rest. No one routinely accesses your photos. Limited access may occur only where strictly necessary to moderate prohibited content, prevent fraud, or comply with a legal obligation.

9. Sensitive Content

Please do not send intimate, adult, or legally sensitive images. Foreva is intended only for creating printed photo albums of personal memories. Orders that appear to contain prohibited content may be paused or cancelled.

10. Complaints

You have the right to lodge a complaint with your local data protection authority. In Malta: idpc.org.mt