Last updated: July 11, 2026
LAYON is operated by AFVMEMORIES SRL, a company registered in Romania. For any privacy question or request, contact us through our contact page. AFVMEMORIES SRL is the data controller for the personal data described below.
The table below summarises the personal data we process, the purpose, our legal basis under the GDPR, and how long we keep it.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account & contact name, email |
Create and manage your account, deliver your license key, provide support | Performance of our contract | For the life of your license, plus periods required by law |
| Billing & payment metadata order email, country, transaction details from Paddle (no card data) |
Fulfil your order, issue your license, meet accounting/tax duties | Contract & legal obligation | Statutory accounting/tax retention period |
| License & device activation hashed device ID, device name, OS, app version, IP |
Activate and validate your license; prevent piracy and abuse | Contract & legitimate interest (protecting the software) | While the activation is active, then removed within a reasonable period |
| Support messages name, email, message |
Answer your questions and provide support | Legitimate interest / contract | Up to 2 years after the request is resolved |
| Proofing data album preview images; photographer & client emails |
Deliver the client-approval service you requested | Contract / legitimate interest | Previews expire after 30 days and are deleted when the album is marked printed |
| Essential cookies session, checkout |
Keep you signed in; enable the secure Paddle checkout | Strictly necessary | Session / short-lived |
All payments are processed by Paddle, acting as our Merchant of Record. Your payment details (such as card numbers) are collected and processed directly by Paddle and are not stored by LAYON or AFVMEMORIES SRL. Paddle's handling of your data is governed by Paddle's own privacy policy.
We share data only with the service providers that help us run LAYON, and only as needed. We do not sell your personal data.
Some of these providers may process data on servers outside the European Economic Area (EEA). Where that happens, the transfer is protected by appropriate safeguards recognised under the GDPR — such as the European Commission's Standard Contractual Clauses or an adequacy decision — so your data continues to receive an equivalent level of protection.
When a photographer uses the proofing feature to share album previews with their client, the photographer is the controller of those images and client details, and AFVMEMORIES SRL acts as a processor handling them only to provide the service. The photographer is responsible for having the right to upload and share the images. Previews are stored in secure cloud storage and shared through a private link with an unguessable token; anyone who has the link can view that album's previews, so the photographer controls who receives it. Previews expire after 30 days and are permanently deleted once the album is marked as sent to print.
Our website uses only essential cookies required for basic functionality (such as your account session and the secure Paddle checkout). We do not use advertising or third-party tracking cookies.
Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent where processing is based on consent. To exercise any of these rights, use our contact page. You also have the right to lodge a complaint with your local data protection authority (in Romania, the National Supervisory Authority for Personal Data Processing, ANSPDCP).
For any privacy request, use our contact page. We aim to respond within 2 business days.