Privacy Notice

Last updated: 9 October 2026

Memnos Studios is operated by Sofoklis Olymbios, who is the data controller. Privacy contact: hello@memnosstudios.com.

This Notice covers the whole website and all services, including Photo Restoration (see section 5).

1. What we keep ourselves

Contact form. Your name, email, topic and message are sent to our email inbox. The website does not keep the message in its own database. It stays in our mailbox only as long as needed to answer you and handle any follow-up. Phone and social handle are optional.

Photo Restoration requests and orders. We keep: your name and email, your phone and social handle if you gave them, your message, the notes you wrote for each photo, and the photos themselves, including any personal information visible in them (see section 5 for when photos are deleted). For each order we also keep the review result for each photo, the proposal we sent (services, price, expected delivery), the Terms version you agreed to, when and how you agreed, whether you asked us to start during the withdrawal period, and the order's status.

Order records stay after the photos are deleted. When the photo files are deleted, the order record (name, email, phone and social if given, message, scope, price, status) stays. We keep it for accounting and tax purposes, to answer questions or complaints, and to show what was agreed if there is a dispute.

Withdrawal requests. If you use the online withdrawal form we keep your name, email, order reference, your statement and the date and time we received it. This is the legal record of your request.

Admin notifications. The Admin shows short notices (for example "new contact message from [name]"). They are deleted after 90 days.

2. When you pay

Payments and invoices go through Stripe. You enter card details only on Stripe's pages. We never see or store your full card number or security code.

What we keep, and why:

The Stripe customer, invoice and payment references, the amount, the invoice status, the date it was paid, and any refund amount. Why: to link the payment to your order, to handle refunds and withdrawals, and for accounting.
A saved copy of the invoice (PDF) and a link to the receipt. Why: tax and accounting duties. These are kept as long as the law requires and are not removed when photos are deleted.

What Stripe keeps is described in Stripe's own privacy notice (section 4).

3. What we do not keep or do

No card numbers or security codes.
No customer accounts, no passwords, no login portal for customers.
No customer database apart from the order records and invoices described above.
No IP addresses in our own database.
No analytics, no advertising or marketing cookies, no tracking pixels, no profiling.
No selling or sharing your data for marketing.
No marketing emails. We only email you about your enquiry, your order, your invoice, a refund or a withdrawal.
No use of your photos as examples (website, social media, portfolio) without your separate written permission. You can withdraw it at any time. We then stop future public use under our control. Use that was lawful before you withdrew is not affected.

4. Services we use, and where to read their privacy notices

We do not repeat what these companies collect. They each process data under their own notices:

Cloudflare: hosting, file storage for uploaded photos, database, email routing and security checks (Turnstile). Privacy notice
Stripe: payments, invoices, refunds. Privacy notice
SMTP2GO: sends the emails the website sends (receipts of your request, proposals, invoices, refunds). Privacy notice
Google (Gmail, and Google Drive when used for delivery): the mailbox where we receive and answer your messages. Privacy notice
SwissTransfer: only when files are too large to send by email at delivery. How SwissTransfer protects data (SwissTransfer is run by Infomaniak). Files are processed in Switzerland, which the European Commission recognises as having data-protection laws that meet EU standards.
Social platforms (for example Instagram): only if you contact us there. They apply their own rules (for example Instagram).

Some of these companies process data outside the EEA. They rely on safeguards such as an adequacy decision, the EU-US Data Privacy Framework or Standard Contractual Clauses. Contact us if you want details.

5. Photos and when they are deleted

Photos uploaded through the website are stored in Cloudflare storage and used only to review your request and do the work. Only the photo files are deleted. The order record stays (section 1).

Unfinished upload: deleted within 24 hours. The draft's name and email are removed 7 days after that.
No answer from you to our review: photos deleted 7 days after we ask for your answer. A request left under review is closed and its photos deleted after 30 days (with a warning at 21 days).
Request rejected or declined: photos deleted when the request is closed.
You agreed but no invoice was issued: deleted after 7 days (with a warning at 3 days).
Invoice not paid: deleted 7 days after the invoice.
Paid order: original website uploads kept 7 days after payment, then deleted.
Copies Memnos holds outside the website (working files, email attachments, files sent by email or social media): deleted no later than 30 days after final delivery, or when a review closes without an order.

6. Cookies

Memnos sets no cookies and uses no analytics. Two things outside our code can use technical storage: Cloudflare Turnstile (the security check on our forms) and Stripe's pages when you pay. We name them here. Our fonts are served from our own hosting, not from Google.

7. Why we use data (legal bases)

To answer you and prepare an offer (steps at your request before a contract); to do the agreed work and handle payment, delivery, withdrawal and refunds (contract); to keep accounting and legal records (legal obligation); to keep the site secure and defend against claims (legitimate interests).

If you do not give information we need for an order, we may not be able to provide the service.

8. Your rights

You can ask for access, correction, deletion, restriction, objection and a copy of your data (data portability, where it applies) by emailing hello@memnosstudios.com. Some records must be kept by law (for example invoices), so deletion is not always possible. You can complain to the Office of the Commissioner for Personal Data Protection of Cyprus or another competent authority.

9. Changes

We update this Notice when our services or tools change. The date at the top shows the latest version.