Privacy policy

This policy explains how Memoira (“we”) handles personal data when you use memoira.my, related subdomains, and our digital invitation and invitation-video services. We operate from Kuala Lumpur, Malaysia.

Our Term of use describe the service itself.

Depending on how you use Memoira, we may process:

• Account data: email address, password (stored in hashed form by our auth provider), and Google account details if you sign in with Google.
• Profile data required before dashboard access: display name, full name, phone number, and date of birth.
• Invitation content you create: event details, copy, recipient lists, media you upload, gift details, and settings.
• Recipient records you add: name, phone, optional email, public slug, tags, and optional host notes.
• Guest submissions on published invitations: RSVP name, phone, email, attendance status, and pax; wish author name and message; guest photo posts, captions, and likes.
• Usage and analytics for hosts: page views, personalized opens, and counts of recipients, RSVPs, wishes, photo posts, and likes.
• Payment records: plan type, amount, currency, and transaction state from HitPay. We do not store full card numbers.
• Technical data such as browser or device information needed to keep you signed in and to operate guest RSVP or photo continuity tokens.

We use this information to:

• Create and maintain your account and show the dashboard.
• Let you build, preview, publish, and manage invitations and videos.
• Serve public invitation pages and personalized guest links.
• Accept guest RSVP, wishes, and photo posts when you enable those modules.
• Process payments and apply plan entitlements.
• Show host analytics and let you hide or restore wishes.
• Keep the service secure and meet legal obligations.

We do not sell personal data. We do not use guest submissions for advertising.

Guests do not create Memoira accounts. If you are a host, you decide which modules to enable and what you ask guests to provide. You are responsible for telling your guests why you collect their details and for using that information only for your event.

Anonymous continuity for RSVP or photo likes uses a token stored in the guest’s browser, not a Memoira login.

We share data only as needed to run Memoira:

• HitPay, to take payment and confirm transaction status.
• Infrastructure and storage providers that host the application, database, and uploaded media.
• Authorities if required by law.

Published invitation content and enabled guest submissions are visible to anyone with the public link.

We keep account and invitation data while your account is active. Published invitations remain publicly available for one year from the publish date, unless you unpublish or delete them sooner.

Soft-deleted invitations and videos are removed from host lists and public access. Payment records and some technical logs may be kept longer where needed for accounting, disputes, or security.

We use access controls, encrypted transport, and server-side checks so that host data stays on your account and public writes only succeed on published invitations with the relevant module enabled. No method of transmission or storage is completely secure.

Under Malaysia’s Personal Data Protection Act, you may ask to access, correct, or limit how we use your personal data, subject to legal exceptions. Hosts can update profile details and invitation content in the dashboard, and can hide wishes or soft-delete projects.

Guests who want a wish hidden or a photo post reviewed should contact the invitation host. The host can moderate wishes from their dashboard.

Memoira is intended for adults who are organising an event. We do not knowingly create host accounts for children. If you believe a child has provided personal data, contact us and we will review it.

We may update this policy. The “Last updated” date at the top will change when we do. Material changes will be reflected on this page.

For privacy questions, visit memoira.my.