Legal
Last updated: October 29, 2026
LAYON is operated by AFVMEMORIES SRL, a company registered in Romania. For any privacy question or request, contact us through our contact page. AFVMEMORIES SRL is the data controller for the personal data described below.
The table below summarises the personal data we process, the purpose, our legal basis under the GDPR, and how long we keep it.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account & contact name, email |
Create and manage your account, deliver your license key, provide support | Performance of our contract | For the life of your license, plus periods required by law |
| Sign-in and free albums email, the one-time sign-in code (kept only in a form that cannot be read back), hashed device ID, IP address |
Sign you in to LAYON with a code sent to your email, and give the free albums once per computer and per email | Contract | The code: 10 minutes. The rest: for the life of your account, plus periods required by law |
| Earlier free trial downloads email, IP address, the page and link that brought you here, and your optional answer to “How did you hear about us?” |
Collected until October 2026, when LAYON 1.x was downloaded through a form: send the trial, email twice about it, and understand which channels bring photographers to LAYON | Contract & legitimate interest (the trial emails can be stopped with the unsubscribe link in them) | Until you ask us to delete it |
| Website analytics page visited, referring site, browser, screen size, country — no cookies, no account, nothing stored on your device |
Count visits and see which pages and channels work | Legitimate interest (see section 7 — you can switch it off in one click) | Aggregated statistics only |
| Billing & payment metadata order email, country, transaction details from Paddle (no card data) |
Fulfil your order, issue your license, meet accounting/tax duties | Contract & legal obligation | Statutory accounting/tax retention period |
| License & device activation hashed device ID, device name, OS, app version, IP |
Activate and validate your license; prevent piracy and abuse, including noticing a license used from many places in one day | Contract & legitimate interest (protecting the software) | While the activation is active, then removed within a reasonable period; the daily record of where a license was used: 30 days |
| Albums let out an album's ID, its number of collages and a small fingerprint of each placed photo (computed from a thumbnail, from which the photo cannot be rebuilt) |
Count an album credit once per album, so the same album with your client's changes does not take a second one | Contract | For the life of your account |
| LAYON ART store designs taken or bought; categories opened, presentations viewed, designs used and searches made in the store, with a one-way hash of your license key, the app version, system and language |
Keep your collection on every computer you sign in on; learn which designs photographers use and look for | Contract (your collection) & legitimate interest (store statistics) | Your collection: for the life of your account. Store events: kept for statistics |
| Support messages name, email, message |
Answer your questions and provide support | Legitimate interest / contract | Up to 2 years after the request is resolved |
| Proofing data album preview images; photographer & client emails |
Deliver the client-approval service you requested | Contract / legitimate interest | Previews expire after 30 days and are deleted when the album is marked printed |
| Essential cookies session, checkout |
Keep you signed in; enable the secure Paddle checkout | Strictly necessary | Session / short-lived |
All payments are processed by Paddle, acting as our Merchant of Record. Your payment details (such as card numbers) are collected and processed directly by Paddle and are not stored by LAYON or AFVMEMORIES SRL. Paddle's handling of your data is governed by Paddle's own privacy policy.
We share data only with the service providers that help us run LAYON, and only as needed. We do not sell your personal data.
Some of these providers may process data on servers outside the European Economic Area (EEA). Where that happens, the transfer is protected by appropriate safeguards recognised under the GDPR — such as the European Commission's Standard Contractual Clauses or an adequacy decision — so your data continues to receive an equivalent level of protection.
When a photographer uses the proofing feature to share album previews with their client, the photographer is the controller of those images and client details, and AFVMEMORIES SRL acts as a processor handling them only to provide the service. The photographer is responsible for having the right to upload and share the images. Previews are stored in secure cloud storage and shared through a private link with an unguessable token; anyone who has the link can view that album's previews, so the photographer controls who receives it. Previews expire after 30 days and are permanently deleted once the album is marked as sent to print.
Our website uses essential cookies required for basic functionality (such as your account session and the secure Paddle checkout). These need no consent.
Google Ads (only if you accept). We advertise LAYON on Google. If you press Accept in the cookie banner, our pages load the Google tag, which sets Google Ads cookies so we can see which ads led to a purchase. Google Ireland Ltd. processes this data under its own privacy policy. If you press Decline, or make no choice, nothing is loaded from Google. You can change your mind at any time:
To count visits we run our own analytics on our own server (GoatCounter). It sets no cookies, stores nothing on your device, does not follow you to other websites, and does not keep your IP address — it is read once to derive a country and then discarded. Nothing is shared with anyone else, which is why it does not depend on your cookie choice.
The installation video on our homepage is hosted on YouTube. Nothing is loaded from YouTube until you press play; the video then plays in YouTube's privacy-enhanced mode (youtube-nocookie.com), and Google's own privacy policy applies to it.
If you would rather not be counted at all, one click is enough. It is remembered by your browser, so repeat it on each browser or device you use.
Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent where processing is based on consent. To exercise any of these rights, use our contact page. You also have the right to lodge a complaint with your local data protection authority (in Romania, the National Supervisory Authority for Personal Data Processing, ANSPDCP).
For any privacy request, use our contact page. We aim to respond within 2 business days.