Skip to content
Xmemora

Privacy policy

Last updated: November 14, 2026

This policy explains what information Xmemora collects, how it is used, who it is shared with and how it is protected. The data controller is Verify Payments LTDA (60.849.119 William Wallace Basso, Brazilian tax ID CNPJ 60.849.119/0001-65).

1. Information we collect

  • Account data: e-mail and name. Phone number, if you provide it.
  • Photos you send: the face photos you upload to create the photo shoot, the name or nickname of each person, and the record of the permission (type, date and IP).
  • Generated images: the photos the AI creates for your account.
  • Purchase data: what was bought, amount, currency, date, card country and the payment identifiers at Stripe. We never receive or store your card number.
  • Access records: date and time, IP address and type of device when you sign in, open a gallery, download photos or ask for a generation.
  • Where you came from: campaign parameters (UTM) of the link that brought you here.

2. What we use it for

  • Creating and delivering the photo shoots you asked for (performance of the contract).
  • Processing payments and refunds and keeping the financial records the law requires (legal obligation).
  • Protecting the account, preventing fraud and answering payment disputes (legitimate interest).
  • Sending service e-mails: sign-in link, notice that your photos are ready and support replies.
  • Using images of people only with the permission you declare when sending the photos (consent).

We do not sell your data and we do not use your photos to train artificial intelligence models.

3. Who we share it with

We share only what the service needs to work, with these suppliers:

  • Stripe: processes card payments. It receives the card data directly from you, on its own secure page.
  • Artificial intelligence providers: receive the reference photos and the scene instructions to generate the images and to check quality and content. They handle this data under their own terms.
  • Hosting and e-mail delivery: companies that run the site's server and deliver the service e-mails.
  • Authorities: when there is a legal obligation or a court order.

These suppliers may be located outside your country and outside Brazil. In that case the transfer happens only to provide the service described here.

4. How information is disclosed

The photos you send and the generated images are private: only you, inside your account, can open them. We publish nothing in public galleries or on social networks. Data leaves our system only to the suppliers listed above, over an encrypted connection.

5. How long we keep it

  • Photos you send: deleted automatically after 30 days.
  • Generated images: stay in your account until you delete them.
  • Orders and payments: kept for the period required by tax law.
  • Access records: kept for as long as needed for security, fraud prevention and legal compliance.

6. How we protect it

  • All traffic to the site uses an encrypted connection (HTTPS).
  • Photos are kept in private storage, out of public reach, and are re-saved without the metadata of the original file (such as GPS location).
  • Passwords are stored only in scrambled form (hash), from which the original password cannot be read. You can also sign in with a single-use link sent to your e-mail.
  • Card data never passes through our servers.
  • Administrative access is restricted, and administrative actions are recorded.
  • There are automatic limits against bulk access attempts.

No system is completely immune to failures. If an incident affects your data, you and the competent authority will be notified as the law requires.

7. Cookies

We use only the cookies the site needs to work: keeping you signed in, remembering the language and protecting forms. We do not use advertising cookies.

8. Your rights

At any time you can:

  • confirm whether we process your data and ask for a copy;
  • correct incomplete or outdated data;
  • delete your photos, photo shoots and generated images, directly on the "Account" page;
  • ask for your account to be deleted and for your data to be handed to you;
  • withdraw consent and object to a use of your data.

To exercise these rights, write to suporte@xmemora.shop. We answer within 15 days. Purchase records may be kept after deletion because of legal obligations. You may also complain to the data protection authority of your country (in the European Union or the United Kingdom) or to the Brazilian authority (ANPD).

9. Children

The service is for people aged 18 or older. Photos of children may only be sent by their parents or legal guardians, who declare this when uploading.

10. Changes to this policy

We may update this policy. The date at the top of this page shows the last change.

11. Contact of the data controller

suporte@xmemora.shop · +55 16 98210 5935 · Av. Leão XIII, 3905, Ribeirânia, Ribeirão Preto - SP, 14096-180, Brasil