Your memories belong to you.
1. Who is responsible
FAMX is offered by Vicky de Groot, based at Kolmeer 39, 8604 EP Sneek, the Netherlands, referred to as "FAMX", "we" or "us".
Contact: hallo@famx.nl
Chamber of Commerce number: 81336691
2. Who this policy applies to
This policy applies to famx.nl and to the FAMX app on famx.app. Child profiles within FAMX are not standalone user accounts; the account is managed by the parent or caregiver.
3. What FAMX never does with your memories
FAMX is a private environment for families. We do not sell your data, and we do not share your private family content with advertisers or other parties for their own commercial purposes. Specifically:
- We don't sell your data.
- We don't share your private content with advertisers.
- We don't use your memories for ad profiling.
- We don't use your private content to train generative AI.
- We don't make your family content public without a deliberate action from you.
To be clear, this doesn't mean we never process data with service providers. Necessary providers that make FAMX technically possible — such as hosting, database, security, payments and email — process data solely on our instructions and for the purposes in this document, never to sell it to them or for their own marketing purposes. See "Sharing with service providers" below.
Family profiles and timelines are private by default and not intended to be indexed by search engines. Within the FAMX app, no advertising trackers such as Meta Pixel, Google Ads tracking, or TikTok Pixel are used on private family content.
4. What data we process
| Category | Examples |
|---|---|
| Account data | Name, email address, password (encrypted) |
| Profile data | Settings, language preference |
| Family data | Who's been invited, what permissions they have |
| Data about children | Name, date of birth, milestones, growth data entered by the parent/caregiver |
| Photos/uploads | Photos and videos you upload |
| Timeline content | Moments, stories and quotes you capture |
| Technical/log data | [TODO: confirm which technical logs are actually kept, e.g. for security/debugging] |
| Subscription/payment data | Chosen plan, payment status. Payment details themselves (e.g. card numbers) are processed by Stripe, not stored by FAMX. |
| Contact requests | What you email us via hallo@famx.nl |
5. Why we process this data, and on what basis
| Purpose | Legal basis |
|---|---|
| Creating an account and running FAMX | Performance of the contract |
| Capturing and displaying your family content | Performance of the contract |
| Sharing within the family per configured permissions | Performance of the contract, on your own instruction |
| Billing and subscription management | Performance of the contract / legal obligation (e.g. bookkeeping) |
| Responding to contact requests | Legitimate interest / performance of the contract |
| Security and abuse prevention | Legitimate interest |
6. Retention periods
We don't keep data longer than necessary for the purpose it was collected for. Specifically, we apply the following retention periods:
| Category | Retention period |
|---|---|
| Account and family data (profiles, child profiles, timeline content, uploads) | For as long as the account is active. |
| After account deletion | Active account, profile, family, child, timeline and upload data is deleted within 30 days at most. |
| Pending invitations | 90 days at most. |
| Incomplete registrations | 30 days at most. |
| Contact correspondence | Up to 2 years after resolution, unless a longer period is necessary for a contract, dispute, or legal obligation. |
| Technical/security logs | 90 days at most, unless a longer period is necessary to investigate fraud, abuse, security incidents, or a legal obligation. |
| Tax records, invoices, and relevant payment administration | 7 years, in line with the statutory retention obligation. |
FAMX itself does not store full payment card details; payments are processed by Stripe. Stripe may retain certain data for longer, for its own legal and contractual obligations.
Deleting your FAMX account does not mean data that FAMX is legally required to keep — such as certain invoice or transaction records — is deleted immediately. We retain that data for as long as the law requires, as described above.
Deleted data may also temporarily remain present in secure backups during the regular technical backup cycle. This data is not restored or actively processed for normal operational purposes, and is removed as backup retention expires.
7. Sharing with service providers
We only share data with parties that actually process personal data on our behalf, to the extent needed to run FAMX — never to sell it to them:
- Supabase — database and account storage.
- Vercel — hosting for the website/application.
- Stripe — payment processing. FAMX itself does not store full payment card details.
- Hostnet — domain and email services, where applicable.
GitHub is development infrastructure for our source code and is not a recipient of famx.app or famx.nl user data.
Where required, we enter into data processing agreements with these providers. See below for international transfers per provider.
8. International transfers
FAMX uses service providers that may process personal data both within and outside the European Economic Area (EEA). Where personal data is processed outside the EEA, appropriate safeguards are applied in accordance with the GDPR, such as an adequacy decision, the EU-US Data Privacy Framework where applicable, or Standard Contractual Clauses approved by the European Commission.
Specifically, to the best of our knowledge:
- Supabase processes data primarily in a selected region, but also uses international infrastructure and sub-processors.
- Vercel may process personal data in the United States and other countries.
- Stripe may transfer personal data to the United States and other countries.
- Hostnet states that most data is stored within the EU, but transfer outside the EEA can occur.
9. Security
We take appropriate technical and organisational measures to protect your data, such as password encryption and access restrictions based on family permissions. We do not make absolute security claims — no system is entirely without risk, and we work continuously to improve.
10. Your rights
You have the right to access, correct and delete your data, and to restrict or object to certain processing where applicable. Where processing is based on consent, you can withdraw it. Where applicable, you also have the right to data portability. Contact us at hallo@famx.nl.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
11. Children and minors
A standalone FAMX account is intended for users aged 16 and up. Child profiles are not standalone accounts: data about children is entered and managed by the parent or caregiver who manages the account. [TODO: work out, legally and technically, whether and how a parental-consent route is needed for users under 16.]
12. Changes
We may update this privacy policy. We'll let you know of significant changes in good time.
13. Contact
Questions about this policy: hallo@famx.nl.