Legal

Privacy Policy

Last updated: September 29, 2026

This Privacy Policy explains how Momentio collects, uses and protects personal data across everything we run: the website momentio.fun, the host dashboard (admin.momentio.fun) and the guest app (app.momentio.fun, including custom event domains). It covers everyone involved: website visitors, hosts who create an event, guests who join one, and partners who recommend us.

At a glance

We never sell your data

No advertising and no data brokers. Guest photos are never used for our marketing without explicit written consent.

Events are private

An event's content is only visible to the host and to the guests who join through the event's link or QR code.

Hosted in the EU

Our servers and databases run in EU data centres. Where a provider processes data outside the EU, approved safeguards apply.

You stay in control

Guests can download or delete their data from the app. Hosts can download all photos and delete their event at any time.

Who We Are

Momentio is a sole proprietorship registered in Belgium under enterprise number 0765.792.333, based in Brussels ("Momentio", "we", "us").

We are the data controller for the personal data described in this policy, except where a professional host is the controller (see below). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Belgian data protection law.

Our Role and the Host's Role

When you visit our website, contact us, buy a plan or create an account, Momentio decides how and why your data is used, and acts as controller.

Inside an event, the host (the person or organisation that created it) decides who is invited and which features are enabled, and can view, moderate, download and delete all content shared in the event. What guests post is visible to the host and to the other guests of that event.

When a company, agency, venue or other professional uses Momentio for a business event, that organisation is the controller of its guests' data and Momentio processes it on its behalf as a processor. A data processing agreement (Article 28 GDPR) is available on request.

Hosts who add or import a guest list are responsible for being allowed to share that information with us and for letting their guests know that the event uses Momentio.

Data We Collect

What we collect depends on how you use Momentio:

Website visitors (momentio.fun)

Contact form — your name, email address, event type, expected number of guests and your message.
Waitlist — your email address.
Reviews — your name, event type, rating, review text and, if you add one, a photo. Reviews are only published after moderation and with your consent.
Spam protection — when you submit a form or sign up, Cloudflare Turnstile checks that you are human, and your email address is checked to block disposable or non-existent addresses.
Analytics — only if you accept: pages visited, clicks, scrolling and session recordings collected by Microsoft Clarity, along with device type, browser and approximate location. Clarity masks text typed into forms.
Technical data — IP address, browser and request details processed by our hosting and security providers to deliver and protect the site.

Hosts (dashboard)

Account — name, email address, password (stored only as a secure hash) and, if you add it for invoicing, your company name.
Purchases — plan, add-ons, amounts, Stripe customer and payment references, and invoices. Card details are entered directly with Stripe and never reach our servers.
Event — event name, type, date, schedule, descriptions, logo, design choices, games, quizzes and settings.
Guest list — the names, email addresses and phone numbers you add or import.
Partner code — if you signed up with an invitation code from one of our partners, the code and the partner it belongs to.
Communications — service emails we send you (confirmations, storage reminders) and your messages to support.

Guests (event app)

Profile — name, email address, password (stored only as a secure hash) and, optionally, a profile photo, short bio and phone number.
Content — photos, videos, stories, captions, comments, likes, mentions and the people you tag in photos.
Activity — game answers and scores (quizzes, bingo, photo challenges, timeline), leaderboard positions, song requests and votes, story views and notifications.
Device — your push notification subscription if you allow notifications, your language, and technical data (IP address, browser) needed to run the app securely.
Records — when you accepted the terms, and your cookie choices together with your IP address and browser, so we can demonstrate your consent.

Partners (planners, venues, vendors)

Partner details — business name, city, logo, contact email, and the invitation codes issued to you, including when each code was used.

Why We Use Your Data and on What Legal Basis

We only use personal data for the purposes below, each with a legal basis under Article 6 GDPR:

Purpose	Legal basis
Providing the platform: accounts, events, sharing photos and videos, games, leaderboards and notifications	Performance of a contract — with the host, and with guests under the app's terms
Processing payments, issuing invoices and keeping accounting records	Performance of a contract; legal obligation (accounting and tax law)
Service emails: purchase confirmations, account setup and storage-expiry reminders	Performance of a contract
Telling hosts about options related to their event (for example, a downloadable offline archive)	Legitimate interest — you can opt out at any time
Answering contact requests and providing support	Legitimate interest; steps taken at your request before a contract
Waitlist emails and publishing reviews	Consent — you can withdraw it at any time
Website analytics with Microsoft Clarity	Consent — you can withdraw it at any time
Optional AI moderation and Memory Book (see below)	Performance of the contract with the host who enables them; legitimate interest in keeping events safe
Security, fraud and spam prevention, error monitoring	Legitimate interest in protecting the service and its users
Responding to lawful requests from authorities	Legal obligation

AI Features

Some plans include optional features powered by OpenAI. They only run when the host's plan includes them and the host uses them:

AI moderation — the text of posts, captions and comments is checked by OpenAI's moderation service before it is published, to filter hateful, violent or sexual content. Text that fails the check is not published. Photos are not sent for moderation. The host can switch this feature off.
Memory Book (Prestige plan) — when the host generates a Memory Book, low-resolution copies of a selection of event photos are sent to OpenAI to set aside unusable shots, sort the photos into chapters and suggest short captions. The event's name, type and date are used to write the introduction. Guests' names are not sent.

OpenAI acts as our service provider. Under its API terms, data sent through the API is not used to train its models and is kept for up to 30 days for abuse monitoring before being deleted. These features do not make decisions with legal or similarly significant effects on anyone.

Who We Share Data With

We never sell personal data. We only share it with the service providers we need to run Momentio, who may only use it on our instructions:

Provider	What they do	Where
Hetzner	Hosting of our servers and databases	EU (Germany, Finland)
Cloudflare	DNS, content delivery, security, spam protection (Turnstile) and storage of photos and videos (R2)	Global network; US company — Data Privacy Framework and Standard Contractual Clauses
Stripe	Payments, invoices and the billing portal	EU (Ireland) and US — Data Privacy Framework
Brevo	Sending service emails and replies to contact requests	EU (France)
OpenAI	Optional AI moderation and Memory Book	US — Standard Contractual Clauses
Microsoft	Website analytics (Clarity), only with your consent	US — Data Privacy Framework
Disify	Checking whether an email address is disposable when you sign up (email address only)	Outside the EU — email address only
Push services (Google, Apple, Mozilla, Microsoft)	Delivering the push notifications you opt into, via your browser's own push service	May be outside the EU

Other people in your event — the host sees everything shared in their event, and guests see each other's names, profile photos and posts.
Partners — if you signed up with a partner's invitation code, the partner may learn that their code was used.
Authorities — when we are legally required to, for example in a criminal investigation.
A successor business — if Momentio is sold or merged, under this same policy.

Error monitoring runs on our own server (self-hosted Bugsink). Error reports can include your IP address and request details, with passwords and login tokens removed.

International Transfers

Our servers and databases are in the EU. Some providers listed above are based in, or may access data from, countries outside the European Economic Area, mainly the United States. In that case the transfer is covered by an adequacy decision (such as the EU-US Data Privacy Framework for certified companies) or by the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards.

How Long We Keep Data

We keep personal data only as long as we need it:

Event content (photos, videos, stories, comments, game data) — for the storage period of the plan: 30 days after creation for Free events, 3 months after the event date for Essential, and 5 months for Celebration and Prestige, unless the host extends it. When the period ends, guest access closes and the content is permanently deleted within 60 days. Hosts can download everything before then, and can delete their event at any time.
Guest profiles — deleted together with the event, or earlier if the guest deletes their account in the app.
Host accounts — kept while the account is open, and deleted on request together with all its events.
Billing records — 10 years, as required by Belgian accounting and tax law, even after the account is closed.
Contact messages — up to 12 months after our last exchange.
Waitlist — until you ask to be removed, and at most 24 months.
Reviews — for as long as they are published, or until you ask us to remove them.
Partner data — for the duration of the partnership, then up to 3 years.
Consent records — for as long as needed to demonstrate your choice.
Security and error logs — up to 90 days.
Analytics — Microsoft keeps Clarity data for up to 13 months.

Your Rights

Under the GDPR, you have the following rights over your personal data:

Access

Get a copy of the personal data we hold about you.

Rectification

Have inaccurate or incomplete data corrected.

Erasure

Have your data deleted when there is no longer a reason to keep it.

Restriction

Ask us to pause the use of your data in certain situations.

Portability

Receive your data in a structured, machine-readable format.

Objection

Object to uses based on legitimate interest, and to direct marketing at any time.

Withdraw consent

Withdraw consent at any time, without affecting what was done before.

Complaint

Lodge a complaint with a data protection authority.

How to exercise them

Guests — in the event app, open Settings to edit your profile, download a copy of your data or permanently delete your account and everything you posted.
Hosts — in the dashboard you can edit your event, download all photos and videos, and delete your event. To close your account or for any other request, email us.
Guests of a business event — you can also contact the organiser, who controls that data.
Everyone — email hello@momentio.fun. We may ask you to confirm your identity, and we reply within one month (extendable by two months for complex requests, in which case we will let you know).

Write to us at hello@momentio.fun. You can also lodge a complaint with the Belgian Data Protection Authority at dataprotectionauthority.be, or with the authority in the country where you live.

Children

The website and host dashboard are for adults (18+). Guests must be at least 13 to use the event app on their own; younger children may only take part with the permission of a parent or guardian. Hosts and guests should take particular care when sharing photos of children and respect parents' wishes.

Security

All traffic is encrypted with HTTPS. Passwords are stored as one-way hashes, and login sessions use secure, HTTP-only cookies. Access to personal data is limited to what is needed to run and support the service. Event pages are not indexed by search engines. Payment card data is handled exclusively by Stripe. If a data breach is likely to put your rights at risk, we will notify the authority and, where required, you.

Changes to This Policy

We may update this policy when our service or the law changes. We will update the date at the top of this page and, for significant changes, inform hosts by email.

Contact Us

For any question about this policy or your personal data:

Email: hello@momentio.fun

Address: Brussels, Belgium

Enterprise number: 0765.792.333