Privacy Notice — Memory Jar

This Privacy Notice explains how Bruco Group (Pty) Ltd ("we", "us", "our"), trading as Memory Jar, collects, uses and protects your personal data when you use the Memory Jar service (the "Service"). Bruco Group (Pty) Ltd is a company registered in South Africa and acts as the data controller of your personal data.

1. Personal data we collect

Account data: your name, email address, and login credentials.
Family profile data: information the family admin adds about family members, which may include names, dates of birth, relationships, ID numbers, contact details, education, employment and hobbies.
Content you upload: memories, photos, quotes, calendar events, and documents you place in your family jar.
Usage and device data: IP address, browser type, pages viewed, and basic telemetry needed to keep the Service secure and reliable.
Support data: messages and information you send us when you contact support.

2. How we use your personal data

To create and maintain your account and your family jar (contract performance).
To provide the features of the Service, including storing content and sending calendar reminders (contract performance).
To keep the Service secure, prevent fraud and abuse, and comply with law (legitimate interests / legal obligation).
To improve the Service and troubleshoot issues (legitimate interests).
To respond to your support requests (contract performance / legitimate interests).
To send service and billing communications (contract performance).

We do not use your family content for advertising and we do not sell your personal data.

3. How we share personal data

We share personal data with the following categories of recipients:

Merchant of Record: Paddle, our online reseller, for the sale of subscriptions, subscription management, payments, tax compliance and invoicing. Paddle's privacy notice is available at paddle.com/legal/privacy.
Infrastructure providers: Supabase and Cloudflare, which host our database, storage and application infrastructure.
Email delivery providers for account and transactional emails.
Professional advisers (legal, accounting) where necessary.
Authorities where we are required by law to disclose information.

4. International transfers

Some of our service providers are located outside South Africa. Where personal data is transferred internationally, we rely on appropriate safeguards such as the recipient being located in a country with adequate protection, or standard contractual clauses.

5. Retention

We keep your personal data for as long as your account is active and for a reasonable period afterwards to comply with our legal obligations, resolve disputes and enforce our agreements. When you delete your account, we delete or anonymise your personal data within a reasonable period, except where we are required to keep it by law.

6. Your rights

Subject to applicable law, you have the right to:

access the personal data we hold about you;
request correction of inaccurate personal data;
request deletion of your personal data;
object to or restrict certain processing;
request a copy of your personal data in a portable format;
withdraw consent where processing is based on consent;
lodge a complaint with the Information Regulator of South Africa or, if applicable, the supervisory authority in your country.

To exercise your rights, email us at privacy@memoryjar.app.

7. Security

We use appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls, and an additional password-protected vault for important documents. No system is completely secure, so we cannot guarantee absolute security.

8. Cookies

We use a small number of strictly necessary cookies and similar technologies to keep you signed in and to keep the Service secure. We do not use advertising cookies. Your browser lets you clear or block cookies at any time.

9. Children

Memory Jar is designed for family use. Family admins are responsible for the accounts they create for other family members, including any children in the family jar.

10. Changes

We may update this Privacy Notice from time to time. If we make material changes we will let you know within the Service or by email before they take effect.

11. Contact

For any privacy questions or requests, contact us at privacy@memoryjar.app, or write to Bruco Group (Pty) Ltd, South Africa.