Privacy Policy

1. Introduction

Welcome to Alba's App and Website (together, the "Service"). This privacy policy explains how we collect, use, store, share, and protect your personal information when you use our Service.

We are committed to handling your data responsibly and transparently. This policy is written in plain English so that it is easy to understand. If you have any questions, you can contact us using the details in Section 15 below.

The Service is operated by MXM Technologies Limited, a company registered in England and Wales under company number 16565910, with its registered office at Apartment 8 Old Printworks, 130 New Kings Road, London, England, SW6 4LZ.

Our role and the laws that apply

We comply with applicable data protection and privacy laws in the jurisdictions in which we operate, including:

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 — which apply to us as a UK-based organisation. For the purposes of these laws, we are the data controller responsible for your personal information.

The New Zealand Privacy Act 2020 and the Information Privacy Principles (IPPs) — which apply to us because we offer the Service to users in New Zealand and carry on business in New Zealand within the meaning of the Act. For the purposes of this law, we are the agency responsible for your personal information.

Where this policy refers to specific legal requirements, we indicate which law applies. Where a provision applies under both frameworks, we have drafted it to satisfy both.

2. Who This Policy Applies To

This policy applies to:

• Anyone who visits our Website
• Anyone who downloads or uses our App
• Anyone who creates an account with us
• Anyone who uploads content through our Service
• Anyone whose personal information is included in content uploaded by another user

3. What Information We Collect

We collect the following types of personal information:

3.1 Information You Give Us Directly

• Account information: your name, email address and password
• Photos and videos: any photographs or video content you choose to add through the Service
• Voice notes: audio recordings you create and submit through the App
• Text content: information you type into forms, messages, notes, or other text fields within the Service
• Documents: any files you upload to the Service, including to your vault
• Bug reports: if you report a problem, the description you write and any screenshots you choose to attach

3.2 Information We Collect Automatically

When you use our Service, we automatically collect:

• Device information — the type of device you use, your operating system, browser type, and unique device identifiers
• Usage data — how you interact with the Service, including pages visited, features used, time spent, and actions taken
• Location — if you give Alba permission, we record where a memory was captured. This comes either from the photo or video's own metadata, or from your device's location at the moment you save a memory that has no photo or video attached. We store those coordinates with the memory so that you can search your memories by place, and we send them to a mapping provider to turn them into a place name. You can grant or revoke this permission at any time in your device settings; revoking it stops Alba recording new locations. To have location data we have already stored removed, contact us using the details in Section 15.
• Log data — IP addresses, access times, error logs, and referring URLs
• Cookies and similar technologies — small files placed on your device that keep you signed in and allow the Service to work (see Section 11 below)

3.3 Information from Third Parties

We may receive information about you from:

• Sign-in providers, if you choose to sign in with Apple or Google — we receive your email address and, where the provider supplies it, your name
• Providers who help us understand how the Service is used

In accordance with NZ IPP 2 and IPP 3, we collect personal information directly from you wherever possible. Where we collect information from third parties, we do so only where it is necessary and authorised by law.

3.4 Information We Create From Your Content

To make your memories searchable, the Service creates additional information from the content you add:

• Transcripts. When you record a voice note, Alba creates a written transcript so that you can search for what you said. The transcript is saved whether or not you choose to display it. On Android, speech recognition is carried out by Google's cloud service; on iPhone and iPad it runs on your device.
• Text found in your photos. Alba reads text that is visible in your photos, on your device, so that you can search for it later. This text is saved alongside the photo and is never displayed back to you.
• Place names. Where we have a memory's location, we convert the coordinates into a place name so that you can search by place.
• Search indexes. We create mathematical representations of your content ("embeddings") so that the Service can find memories by meaning rather than only by exact words. Producing these involves sending content — including the text you type, voice transcripts, and a reduced-size copy of a photo or video frame — to a specialist provider, named in Section 8. Your search queries are also sent to that provider so they can be matched against your memories.

3.5 Diagnostic and Error Reports

When something goes wrong in the App, Alba automatically sends us a report so that we can find and fix the problem. A report contains the error, what the App was doing at the time, which screens you visited beforehand, your app version, operating system and device model, a randomly generated identifier for your device, and a one-way scrambled version of your IP address that we use to prevent abuse of the reporting system.

These reports are sent automatically, including before you have signed in, and we remove personal content from them before they are stored. There is no way to switch reporting off; it is how we learn that the App has failed for you. Section 6.2 explains how long we keep them.

4. Sensitive and Special Category Data

Some of the information we collect may be considered particularly sensitive:

• Racial or ethnic origin: which may be apparent from photographs or documents you upload
• Health information: if included in content you choose to upload
• Religious beliefs: if apparent from content you upload

Under UK law, this type of information is classified as special category data under the UK GDPR. We process special category data only where:

• You have given us your explicit consent
• It is necessary for reasons of substantial public interest
• It is needed to establish, exercise, or defend legal claims

Under NZ law, while the Privacy Act 2020 does not create a separate statutory category for sensitive data, IPP 4 requires that we take particular care to ensure sensitive information is collected fairly and in a manner that does not intrude unreasonably on your personal affairs. We comply with this requirement.

5. How We Use Your Information

We use your personal information only for the purposes set out below. For each purpose, we have identified the applicable legal basis under UK law and the relevant NZ Information Privacy Principle.

We will not use your personal information for a purpose that is materially different from the purpose for which it was collected, unless permitted under UK GDPR or an exception under NZ IPP 10 applies.

• To create and manage your account — Data used: Name, email, password. UK lawful basis: Performance of a contract (Art. 6(1)(b)). NZ IPP: IPP 1, IPP 10
• To provide the Service, including storing and displaying your content — Data used: Photos, videos, voice notes, documents, text. UK lawful basis: Performance of a contract (Art. 6(1)(b)). NZ IPP: IPP 1, IPP 10
• To let you search your memories, including by meaning, by spoken words, by text in a photo, and by place — Data used: Your content, transcripts, text found in photos, location, search indexes, search queries. UK lawful basis: Performance of a contract (Art. 6(1)(b)). NZ IPP: IPP 1, IPP 10
• To record where a memory was captured, so you can search by place: Data used: Location. UK lawful basis: Consent (Art. 6(1)(a)) — given through your device's location permission. NZ IPP: IPP 1, IPP 10
• To send you service-related communications (e.g. account confirmations, updates, album invitations) — Data used: Email address, your display name, album name. UK lawful basis: Performance of a contract (Art. 6(1)(b)). NZ IPP: IPP 1
• To allow you to share albums and collaborate with other users — Data used: Content you choose to share, account identifiers. UK lawful basis: Performance of a contract (Art. 6(1)(b)). NZ IPP: IPP 1, IPP 10
• To find and fix faults in the Service: Data used: Diagnostic and error reports (Section 3.5). UK lawful basis: Legitimate interests (Art. 6(1)(f)) — we have assessed that our interest in a working, secure Service is not overridden by your rights. NZ IPP: IPP 1
• To respond to a problem you report to us — Data used: Your description, screenshots, device information. UK lawful basis: Performance of a contract (Art. 6(1)(b)). NZ IPP: IPP 1
• To improve and develop the Service — Data used: De-identified usage data, device information. UK lawful basis: Legitimate interests (Art. 6(1)(f)). NZ IPP: IPP 1
• To keep the Service secure and prevent abuse — Data used: Log data, IP addresses, device information. UK lawful basis: Legitimate interests (Art. 6(1)(f)). NZ IPP: IPP 5
• To comply with legal obligations — Data used: As required by law. UK lawful basis: Legal obligation (Art. 6(1)(c)). NZ IPP: IPP 1
• To tell you about Alba's launch and related updates, if you joined our waitlist — Data used: Email address. UK lawful basis: Consent (Art. 6(1)(a)). NZ IPP: IPP 1, IPP 3
• To process special category data you choose to upload — Data used: Special category data as defined in Section 4. UK lawful basis: Explicit consent (Art. 9(2)(a)). NZ IPP: IPP 4

6. How We Store and Protect Your Information

6.1 Security Measures

In accordance with UK GDPR Article 32 and NZ IPP 5, we take reasonable and appropriate steps to protect your personal information from loss, unauthorised access, use, modification, or disclosure. Our measures include:

Encryption in transit. Everything you send to us, and everything we send back, travels over an encrypted connection.

Encryption at rest. The photos, videos, voice recordings and documents you add to your memories and to your vault are encrypted while stored on our systems. Each file is encrypted with its own unique key.

Access. Alba holds those encryption keys, so your content can be decrypted. It is decrypted only when something needs it — when you open it, when a feature you have used requires it (for example generating a preview, or making your content searchable), or when our engineers carry out maintenance on the Service. Access is restricted to authorised personnel, and every use of an encryption key is recorded in an audit log.

What is not encrypted in this way. Some information is deliberately stored without this additional layer of encryption, because the Service could not work if it were: the text you type, voice transcripts, text found in your photos, the names you give your files and collections, album cover images, profile pictures, and screenshots you attach to a bug report. All of it remains protected by encrypted connections, encrypted storage systems, and the access controls described above.

Access controls. Only authorised personnel can access your personal information, and only where they need to for their role.

Secure storage. Uploaded files are held in private, access-controlled storage. They are never publicly accessible, and links to them are short-lived.

6.2 Retention

In accordance with NZ IPP 9 and the data minimisation principle under UK GDPR, we do not keep your personal information for longer than is necessary for the purposes for which it may lawfully be used. Our approach is:

• Your account — If you ask us to delete your account, we keep it for 7 days so that you can change your mind, and then delete it permanently
• Content you uploaded — Deleted at the same time as your account, and the files are removed from our storage
• Memories you delete — Held in Recently Deleted for 30 days, then permanently deleted
• Diagnostic and error reports — Detail is removed after 14 days; reports are deleted within 90 days
• Usage analytics — Kept for up to 24 months. When you delete your account, these records are separated from your identity rather than deleted, so that we do not lose the overall picture of how the Service is used
• Shared content — See Section 13.2

We also keep a short summary of each fault in the Service, which may include the error message, so that we can tell whether a problem has recurred. This summary is not time-limited.

After these periods, your data is securely deleted or de-identified.

7. Artificial Intelligence and Machine Learning

We are committed to protecting your data from being used to train artificial intelligence or machine learning systems. We want to be completely clear about this:

• We do not use your personal information, uploaded content, or any other data you provide through the Service to train, develop, or improve any AI systems, machine learning models, or large language models (LLMs), whether our own or those of any third party.
• We do not permit any third-party service provider, partner, or other organisation to use your data to train their AI systems, machine learning models, or LLMs. All third parties who process data on our behalf are contractually prohibited from doing so.
• This applies to all content you upload, including photos, videos, voice notes, text, and documents, as well as any account information, usage data, or other personal information we collect.

This commitment applies regardless of whether the data is de-identified or aggregated. We do not use any form of your data, identifiable or otherwise, for AI or machine learning training purposes. If we ever change our position on this in the future, we will notify you in advance and seek your explicit consent before any such use takes place.

This does not prevent us from using automated systems to provide the Service to you — for example, creating the search indexes described in Section 3.4. Those systems process your content to make it findable; they are not trained on it.

8. Who We Share Your Information With

In accordance with UK GDPR and NZ IPP 11, we only disclose your personal information where the disclosure is lawful, proportionate, and for a purpose directly related to the purpose for which the information was collected, or where another lawful basis or exception applies.

We use the following service providers, who process personal information on our behalf:

• Supabase — Hosts our database, file storage and sign-in system
• Vercel — Hosts our website and the servers behind the App; also provides website performance measurement (Vercel Analytics and Speed Insights)
• Google Cloud — Holds the keys used to encrypt your files
• Voyage AI / MongoDB — Creates the search indexes described in Section 3.4, from your content and your search queries
• Geoapify — Converts a memory's coordinates into a place name
• PostHog: Product analytics — how the App is used
• Resend — Sends our emails, including account confirmations and album invitations
• Klaviyo — Sends waitlist and launch emails
• Slack — Where our team receives and handles feedback reports and fault alerts
• Expo, Apple and Google — Deliver push notifications and app updates, and provide sign-in with Apple and Google
• Google — Provides the fonts on our Website, and receives your IP address and browser details when a page loads. On Android, Google's speech recognition service also produces voice transcripts

We may also share your personal information with:

• IT and security service providers, who help us maintain and protect our systems
• Legal and professional advisers, where necessary for legal proceedings or regulatory compliance
• Law enforcement or regulators, where we are required to do so by law, or where disclosure is necessary to prevent or lessen a serious threat to public health, public safety, or the life or health of an individual

We do not sell your personal information to any third party.

All third parties who process data on our behalf are bound by data processing agreements (under UK GDPR) and contractual obligations (under the NZ Privacy Act 2020) to protect your information in line with this policy and applicable law. These agreements prohibit the use of your data for training AI systems, machine learning models, or LLMs.

If we add a new service provider that handles your personal information, we will update this section.

9. International Data Transfers

We are based in the United Kingdom. Our database and file storage are located in the United Kingdom, as are the keys used to encrypt your files. If you are located in New Zealand or any other country outside the UK, your data will cross international borders to reach us.

Some of our service providers process data outside the UK. In particular, the provider that creates our search indexes (Section 3.4) processes data in the United States.

9.1 For UK Users

Where we transfer data outside the UK, we ensure appropriate safeguards are in place, including:

• UK adequacy decisions — transferring data only to countries the UK has recognised as providing adequate protection
• International data transfer agreements — using contracts approved by the Information Commissioner's Office (ICO)
• Other approved mechanisms — including the UK Extension to the EU–US Data Privacy Framework, and standard contractual clauses

9.2 For New Zealand Users

In accordance with NZ IPP 12, your personal information will be transferred to the United Kingdom, where our company is based and where our primary data processing takes place. The UK has a comprehensive data protection framework (UK GDPR and Data Protection Act 2018) that provides comparable privacy protections to those under the NZ Privacy Act 2020.

Where your data is transferred to any country other than the UK, we ensure that:

• The recipient country provides comparable privacy protections; or
• The recipient is subject to binding contractual obligations that provide comparable protections; or
• You have authorised the transfer after being informed that the recipient may not be required to protect your information in a way comparable to the NZ Privacy Act 2020; or
• The transfer is otherwise permitted under an exception in IPP 12

You can contact us (see Section 15) for more information about the specific safeguards in place.

10. Your Rights

10.1 Rights of UK Users

Under the UK GDPR and Data Protection Act 2018, you have the following rights:

• Right of access — you can ask for a copy of the personal information we hold about you
• Right to rectification — you can ask us to correct any inaccurate or incomplete information
• Right to erasure — you can ask us to delete your personal information in certain circumstances (also known as the "right to be forgotten"). You can delete your account yourself in the App, under Settings
• Right to restrict processing — you can ask us to limit how we use your data in certain circumstances
• Right to data portability — you can ask us to provide your data in a structured, commonly used format
• Right to object — you can object to processing based on legitimate interests
• Right to withdraw consent — where we rely on your consent, you can withdraw it at any time (this will not affect the lawfulness of any processing before withdrawal)
• Rights relating to automated decision-making — you have the right not to be subject to decisions based solely on automated processing that have a significant effect on you

To exercise any of these rights, contact us at hello@albatheapp.com. We will respond within one month.

You also have the right to submit a data protection complaint directly to us at the same address. We will acknowledge your complaint within 30 days. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):

• Website: www.ico.org.uk
• Helpline: 0303 123 1113

10.2 Rights of New Zealand Users

Under the Privacy Act 2020, you have the following rights:

• Right of access (IPP 6) — you can request access to any personal information we hold about you. We will make the information available unless a lawful reason for refusal applies. We will respond within 20 working days.
• Right of correction (IPP 7) — you can ask us to correct any information that is inaccurate, misleading, or incomplete. If we do not agree that a correction is warranted, you have the right to ask us to attach a statement of correction to the information.
• Right to complain — you can make a complaint to us directly, and if you are not satisfied with our response, to the Office of the Privacy Commissioner.
• Right to be informed of breaches — under Part 6 of the Privacy Act 2020, we will notify you (and the Privacy Commissioner) if a privacy breach occurs that is likely to cause you serious harm.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner:

• Website: www.privacy.org.nz
• Phone: 0800 803 909
• Email: enquiries@privacy.org.nz

10.3 How to Exercise Your Rights

To exercise any of your rights under either framework, please contact us using the details in Section 15.

11. Cookies and Similar Technologies

We use only strictly necessary cookies on our Website. These keep you signed in and allow the Service to function. You cannot opt out of them, because the Website will not work without them.

We do not use advertising cookies or cross-site tracking cookies.

Our Website also uses a performance measurement service that does not set cookies (see Section 8), and loads fonts from Google, which receives your IP address and browser details as part of that request.

Our App does not use cookies.

12. Children's Privacy

Our Service is not intended for people under the age of 18, and children may not hold accounts. Parents may upload content featuring their children as subjects.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us and we will take steps to delete it.

13. Content You Upload

13.1 General

When you upload photos, videos, text, voice notes, or documents to our Service:

• You are responsible for ensuring you have the right to share that content with us
• If your content includes personal information about other people, you should make sure they are aware of this policy
• We will use the content only for the purposes described in this policy
• Your content will not be used to train any AI systems, machine learning models, or LLMs (see Section 7)
• You can delete your content at any time in the App, subject to any legal obligations that require us to keep it

13.2 Shared Albums

The Service lets you share albums with other people, and add content to albums other people own.

When you add a memory to an album — including an album someone else owns — you remain its author.

If you delete your Alba account, the memories you added are deleted everywhere, including from albums owned by other people. Other members' memories are unaffected.

If you own a shared album, ownership passes to another member of that album when your account is deleted, so that they keep access to their own content. If there are no other members, the album is deleted along with your account.

While your account is active, you can remove any memory you added, including from an album someone else owns. Album owners cannot edit or delete memories added by other members.

14. Changes to This Policy

We may update this privacy policy from time to time. When we make significant changes, we will:

• Post the updated policy on our Website and in the App
• Update the "Last updated" date at the top of this page
• Notify you by email or through the App where appropriate

We encourage you to review this policy periodically to stay informed about how we protect your information.

15. How to Contact Us

If you have any questions, concerns, or requests relating to this privacy policy or how we handle your personal information, you can contact us at:

Email: hello@albatheapp.com

16. Governing Law

This privacy policy is governed by the laws of England and Wales.

Nothing in this policy excludes or limits any rights you may have under the New Zealand Privacy Act 2020, the Consumer Guarantees Act 1993, the Fair Trading Act 1986, or any other New Zealand legislation that cannot be excluded by agreement. For New Zealand users, the jurisdiction of the New Zealand courts is not excluded.

By using our App and Website, you acknowledge that you have read and understood this privacy policy.