Data Processing Agreement

Overview

Momento is operated by M/S JYOTI TRADERS (HANUMAT KRIPA) (Jyoti Traders). Momento acts as a data processor when you use the Service to collect guest photos on behalf of your clients. You remain the controller for guest data in your events. This page summarizes our subprocessor list and standard security measures. For a signed DPA, contact us before enterprise or white-label deployments.

Find me face processing

When optional gallery Find me is used, Momento may create event-scoped face descriptors from upload thumbnails and store them until each photo is deleted. Guests who run Find me send a reference selfie plus gallery thumbnails to Google Gemini for one-time matching; Momento does not retain the reference selfie after the search completes. Google processes Gemini API requests under its Privacy Policy and Gemini API Terms. Descriptor handling is described in the Privacy Policy section “How Find me face descriptors are stored.”

Controller obligations. You remain responsible for attendee notice, lawful basis, consent or permissions for people shown, biometric-law compliance, and responding to removal or opt-out requests. Momento processes on your documented instructions as set out in the Privacy Policy and Terms of Service. Host and uploader authority declarations support audit; they do not shift primary legal responsibility to Momento.

People shown in photos may request event-specific removal through admin@momento.camera. Business customers agree to indemnify Momento for controller-side claims arising from their events to the extent permitted in the Terms of Service.

Subprocessors

• Supabase

  Database and authentication; optional Find me face descriptors (event-scoped, deleted with photos)

  Location: India (Mumbai) / AWS

  supabase.com

• Cloudflare

  Event photo and video storage (R2); image previews used for optional AI features including Find me

  Location: Global

  cloudflare.com

• Vercel

  Web hosting and API; optional Find me face-descriptor indexing on upload thumbnails when enabled

  Location: Global (includes US/EU)

  vercel.com

• Razorpay

  Payment processing (paid plans)

  Location: India

  razorpay.com

• Resend

  Transactional email (receipts, event alerts, support replies)

  Location: United States

  resend.com

• Google (Gemini)

  Optional OAuth sign-in; Gemini AI for recap curation, awards, photo-challenge verification, upload moderation (when enabled), and Find me — reference selfie and event-image previews for one-time matching (selfie not retained by Momento)

  Location: Global

  google.com

• PostHog

  Product analytics and session replay (marketing/host routes only)

  Location: United States (US cloud)

  posthog.com

Media retention

Retention targets are described in our Privacy Policy and Terms of Service. For agency and corporate customers: guest camera photos and videos generally follow the event plan retention window (approximately 6 months on free plans or 1 year on paid plans after the event end date). Photographer-imported photos (bulk import add-on) are subject to a shorter target of approximately 30 days after the event end date. These are operational targets, not fixed contractual storage periods — hosts should download important media promptly.

Security measures

• TLS encryption in transit; encrypted storage at rest via Cloudflare R2 and Supabase/AWS
• Private photo bucket with time-limited signed URLs for gallery access
• Role-based host auth, guest tokens for guest mutations, CSRF and rate limits
• Events are private and excluded from search indexing
• No ad tracking or analytics SDKs on guest flows

Data subject requests

Hosts can delete events and accounts in-product. Guests delete their own photos with their guest token. Formal access, correction, or erasure requests: admin@momento.camera (48-hour target response; 30 days for formal grievances under India DPDP).

Signed DPA

Email admin@momento.camera with your company name, event volume, and jurisdiction. We provide a one-page DPA addendum for agency and corporate accounts on request.

See also Privacy Policy and Agency program.