How Gabyly handles the GDPR
Last updated: 25 October 2026
This page summarises how we apply the GDPR and the Swiss Federal Act on Data Protection. The full details are in our Privacy Policy.
Who is responsible. White Memories Coniglio, Via Besso 49, 6900 Lugano, Switzerland, is the controller. Contact: privacy@gabyly.com.
Content we cannot read. Photos, videos, thumbnails and comments are encrypted on your device. We store them only in encrypted form and never receive the key.
Lawful bases. We process data to provide the service you signed up for (contract), to meet legal duties such as keeping invoices (legal obligation), and to keep the service secure and prevent abuse (legitimate interests). We ask for consent only where the law requires it.
Minimisation. We ask only for an email address and a name. We don't ask for a phone number or date of birth, and we don't buy data from third parties.
Erasure. You can delete a memory, an album or your whole account at any time. Files are deleted from our servers right away; encrypted backup copies of photos and videos are deleted within 60 days, and backups of account data within 12 months.
Your rights. Access, correction, erasure, restriction, portability and objection. You can export your data from your account or write to privacy@gabyly.com; we reply within one month.
International transfers. Photos and videos are stored in France. The application database and servers are in the United States, protected by the European Commission's Standard Contractual Clauses.
Sub-processors
- Provider
- Emergent Labs
- Purpose
- App hosting and database
- Data
- Account data, metadata, encrypted keys
- Location
- United States: application database (MongoDB Atlas) and servers (Google Cloud and/or AWS), managed by our processor Emergent under a Data Processing Agreement with EU Standard Contractual Clauses. Support staff may access from outside the EU under those clauses. Full, up-to-date sub-processor list at app.emergent.sh/subprocessors.
- Provider
- OVHcloud
- Purpose
- Storage of photos, videos and backups; email
- Data
- Encrypted files only; emails sent to our addresses
- Location
- France (EU)
- Provider
- Stripe
- Purpose
- Payments
- Data
- Email, payment details, subscription
- Location
- EU (Ireland) and United States, SCCs
- Provider
- Resend
- Purpose
- Transactional email
- Data
- Email address, message
- Location
- United States, SCCs
- Provider
- Purpose
- Sign-in with Google, only if you choose it
- Data
- Name, email, profile photo
- Location
- United States, SCCs
- Provider
- Cloudflare
- Purpose
- Network and security in front of our host
- Data
- IP address, technical request data
- Location
- Global, SCCs
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Emergent Labs | App hosting and database | Account data, metadata, encrypted keys | United States: application database (MongoDB Atlas) and servers (Google Cloud and/or AWS), managed by our processor Emergent under a Data Processing Agreement with EU Standard Contractual Clauses. Support staff may access from outside the EU under those clauses. Full, up-to-date sub-processor list at app.emergent.sh/subprocessors. |
| OVHcloud | Storage of photos, videos and backups; email | Encrypted files only; emails sent to our addresses | France (EU) |
| Stripe | Payments | Email, payment details, subscription | EU (Ireland) and United States, SCCs |
| Resend | Transactional email | Email address, message | United States, SCCs |
| Sign-in with Google, only if you choose it | Name, email, profile photo | United States, SCCs | |
| Cloudflare | Network and security in front of our host | IP address, technical request data | Global, SCCs |
Complaints. You can complain to the data protection authority of your country, or in Switzerland to the FDPIC.