keeparoo Privacy Notice

Last updated: 13 November 2026

keeparoo lets people collect messages, photos, voice notes and videos into a private keepsake. This notice explains how we use personal information.

Who we are

keeparoo is operated by Mave Social Limited. We are responsible for the personal information described in this notice.

For privacy questions, requests or concerns, email joey@keeparoo.app or write to 97, Prince of Wales Mansions, London SW11 4BL.

Who uses keeparoo

Organisers must declare that they are 18 or over. We ask them to invite adults they know directly, rather than post contribution links publicly. Contributors and recipients do not need accounts. We do not independently check contributors’ ages, so a link may still reach a child. Children may also appear in memories submitted by adults.

Information we use

For organisers, we use information from Google sign-in, including account ID, name, email address and profile picture. We also use the celebration details they enter and their decisions about contributions.

For contributors, we use the name and relationship they provide, their message and caption, any photo, voice note or video they submit, the submission time, and a record of their sharing declaration. We do not ask contributors for an email address or account.

For recipients, opening a keepsake does not require an account. The viewing link gives access. Our hosting providers process basic request and device information to deliver and secure the site.

A memory may contain information about people who did not use keeparoo themselves. A privacy or safety request may include your name, email address, details of your concern and a link to the relevant celebration.

Visitor analytics and click tracking are switched off. keeparoo does not use advertising cookies or send memories to an AI model.

Why we use information

• Organiser service — contract: We use the organiser’s account and necessary celebration details to provide the service they request. The organiser’s contract is not our basis for processing information about everyone who contributes or appears in a memory.
• Contributions, people in memories and private delivery — legitimate interests: We use this information to help invited people create a keepsake, allow the organiser to review contributions, and show approved memories to people with the viewing link. Our interest is in providing this private, collaborative service. We balance it against the privacy and reasonable expectations of those affected, giving particular weight to children’s interests.
• Security and misuse prevention — legitimate interests: We use limited technical and report information to check files, control access, prevent abuse and investigate concerns.
• Privacy-rights requests — legal obligation where applicable: We use information needed to respond to requests under data-protection law. We handle other safety concerns under our legitimate interest in protecting people and the service.

The contributor checkbox records a sharing declaration and acknowledgement of this notice. It is not treated as GDPR consent or as proof that everyone pictured or recorded has given permission.

You may object to our use of your information based on legitimate interests by emailing us. We will consider the circumstances and explain our response.

Who can see memories

The organiser can see contributions to their celebration. A contribution does not appear in the finished keepsake until the organiser approves it.

Anyone with the private viewing link can see approved memories. Links can be forwarded, and viewers may save or share what they see. Keepsakes are not listed publicly. Files are held in private storage and delivered through temporary file links lasting up to one hour. Switching off a celebration stops new access and new file links, but an already-issued file link may work for the rest of its lifetime. We cannot recall content someone has already downloaded or saved.

Service providers and overseas processing

We use Lovable and Lovable Cloud to run keeparoo, Cloudflare to deliver the website, and Google for organiser sign-in. Built-in music may load from SoundHelix; example content may load from external media hosts. Those external requests can disclose a visitor’s network address and request details to the relevant provider. We do not sell memories or share them for advertising.

Some processing may take place outside the UK. Where we are responsible for a restricted international transfer, we use an applicable UK adequacy arrangement or contractual safeguards under the relevant provider agreement. Lovable’s published Data Processing Agreement describes use of the UK Addendum to the EU Standard Contractual Clauses for covered UK transfers. Email us if you would like information about the safeguards relevant to your data. We do not promise that all processing takes place in the UK or EEA.

How long we keep information

A keepsake remains available online for 30 days after the organiser first publishes it. Republishing does not restart the period. The organiser can download an offline keepsake and a supported video file during those 30 days.

At the end of that period, invitation and viewing links stop granting access. A daily process removes expired celebration records and queues their stored memories, cover and music files for deletion. Failures are recorded and retried, so removal of files may take longer during an outage or backlog.

We review unpublished drafts after 90 days without organiser activity and delete those no longer needed, unless there is a recorded reason to retain them. We keep organiser profile information while the account is active and delete it on request, subject to an identified legal duty or unresolved matter. We keep closed privacy and safety reports and their action history for 12 months after closure. If an active matter requires longer, we record the reason and review date.

Unsubmitted uploads are normally cleared after they become eligible at 24 hours and the next daily cleanup runs; delays can occur if a job fails or has a backlog. Providers may retain backups, security logs or cached copies under their own schedules. Copies downloaded or saved by other people are outside our control.

Children and sensitive information

keeparoo is intended to be organised by adults and shared with adult contributors. We do not independently verify guest ages. Please take particular care before sharing a child’s image, voice or personal details. Do not submit intimate material, medical records, financial account details or identity documents. An adult organiser is not necessarily a child’s parent, and organiser approval alone does not establish permission from everyone shown.

A parent, guardian, young person or anyone pictured or recorded can contact us to raise a concern or request removal, even if they did not submit the memory.

Your rights and concerns

Depending on the circumstances, you may ask to access, correct or delete your information, restrict its use, object to its use, or receive a portable copy. Email joey@keeparoo.app or use keeparoo’s Report a concern or request removal page. We will review your request and explain what action we take.

You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

We will update this notice when our practices change.