Book Studio Privacy

The book studio uses your email address and protected account credentials to identify your account and save your work. Your uploaded photos, book settings, and generated paintings are associated with your account.

When you choose Paint, your selected photo is sent to our image-generation provider to produce the painting. Browsing the public sample does not generate a painting.

Personal photos and books require authenticated access. The book studio does not publish your uploads in a public gallery. The shared-pool invitation service is a separate experience.

In Paint My Photo, the optional capture-information setting lets us retain an embedded photo capture date/time and approximate GPS coordinates for private administrator review. The setting is shown before upload and can be unchecked. Coordinates are rounded to 0.01 degrees before storage. We do not retain other camera or identity tags for this feature. Image files are stripped of location and camera metadata before painting and download; the selected fields are stored separately while the source photo is retained and removed when it is purged. These fields are not website analytics. Opening a map from the private review area sends only the approximate coordinates to the map provider.

Service records include processing status and model usage needed to operate the studio. The digital book studio does not collect card details or shipping addresses, and it does not place print orders.

Website analytics uses a random browser identifier stored for up to 90 days and a visit identifier renewed after 30 minutes of inactivity. We measure page views, campaign names, sample engagement, video plays, and creation actions. The administrator-only activity log shows event times, page categories, referral domains, coarse browser/device information, and the browser's reported time-zone setting. It does not collect account identity or physical location. We do not store names, emails, photographs, book contents, full referral URLs, GPS coordinates, or raw IP addresses in analytics. Browser analytics is disabled when your browser sends Do Not Track or Global Privacy Control. Successful service operations are counted separately. Only administrators can view reports and detailed activity.

You can remove a book from your library. Removing a book from the library does not mean that every retained file or backup is immediately erased.

When you contact MomentsEver support, your email address, selected topic, optional order number and message are sent to our configured support mailbox so our team can respond. Support messages are kept in our support mailbox, not website analytics. Do not include passwords, verification codes, payment details or private photo links. Use the Help Center for our current contact email and questions about your support information.

AI Product Help

AI chat is optional and does not require a name, email, or account. Before sending, you are shown a storage notice. We filter common sensitive details from questions, then send the filtered question, current public canvas selection, approved policies, and recent topic codes to our AI provider, OpenAI. We do not send photos, private gallery links, browser IDs, or the full conversation history to the model. Filtering is not perfect: do not include personal or sensitive information.

Filtered questions, approved answers, selection context, and internal review notes are stored in a protected database for up to 90 days from the start of the chat. Authorized administrators and support staff can review, curate, and delete these records. Chat text is not stored in general website analytics. Model usage and estimated cost are recorded separately from the text.

Where browser analytics is enabled, we use a pseudonymous client ID to group repeat conversations from the same browser. This does not identify a verified person. Do Not Track and Global Privacy Control prevent that browser linkage, but a temporary chat access token is still needed to provide the conversation. Clearing storage or using another browser creates a separate identity.

A chat ends when you choose End chat or after 30 minutes of inactivity. Our support mailbox receives a reference and a protected admin link, not the transcript. A notification is not a guarantee that a human has reviewed your chat, and it does not change or cancel an order. Contact us by email for a reply or to request deletion; we may need to verify access. Database backups and previously delivered notification emails may remain under their separate retention schedules.