Privacy Policy

This Privacy Policy explains how The Great Recap (“The Great Recap,” “we,” “us,” or “our”) collects, uses, discloses, and retains personal information when you use thegreatrecap.com and related services that help you create a printed recap book (the “Service”).

It should be read with our Terms of Use and AI Policy. The Terms include your warranties that you have authorization to upload photos of other people. This Policy describes our processing of that information once it is on our systems.

If you do not agree with this Policy, do not use the Service.

1. Who we are

The Great Recap operates the Service at thegreatrecap.com. For privacy requests, contact hello@thegreatrecap.com.

Depending on the feature, we typically act as a controller of account, payment-adjacent, and site-usage information, and as a controller of User Content you choose to upload so that we can generate and fulfill your book. Where a print, payment, or AI provider processes data only on our instructions, that provider is a processor or service provider. We do not control how a recipient of a physical book later uses that book.

2. Whose information this covers

This Policy applies to:

• customers who create a recap or place an order;
• guests or contributors who upload via an invitation link;
• people who contact support;
• visitors to our marketing pages.

It also describes processing of information about other people that appears in photos, names, comments, or voice notes you or a guest provide. If you upload someone else’s information, you must have the right and any required consent to do so (see the Terms of Use). We rely on you for that authorization. We generally do not have a direct relationship with every person who appears in a customer photo.

3. Information we collect

3.1 You provide

• Account and contact data — email address, name if you give it, magic-link or login identifiers.
• Recap details — title, year, occasion, people labels, places, comments, answers to prompts, and similar editorial input.
• User Content — photos and other images, optional voice recordings and transcripts, and any text you type.
• Order and shipping data — edition, quantity, shipping name, address, and phone if required by the carrier or printer.
• Support communications — messages you send us, and attachments you include.

3.2 Collected automatically

• Device and log data — IP address, browser type, approximate location derived from IP, language, referring URL, pages viewed, and diagnostic logs.
• Cookies and similar technologies — as described in Section 9.

3.3 From others

• Guests you invite — photos and comments they submit to your recap.
• Payment processors — confirmation that a charge succeeded or failed, card brand/last four if provided to us, and fraud signals. We do not store full payment-card numbers on our servers; Stripe or a successor processor does.
• Print and shipping partners — production and tracking status.

We do not require government ID to use the Service. We do not intentionally collect special-category data except to the extent a photo, voice note, or story you choose to upload reveals it (for example, a wedding, a hospital visit, or a child’s face).

4. Photos, voice, and other people’s data

When you or a guest upload User Content, you instruct us to process it to:

• store it in your recap;
• show it to you and to collaborators on that recap;
• analyze it (including with AI) to draft narrative, group moments, and generate cover artwork;
• prepare print-ready files and send them to a printer;
• provide customer support if you ask us to look at a recap.

We do not offer your photo files for sale. We do not use customer photo libraries to train our own foundation models. Our AI Policy describes how we instruct AI vendors regarding training. You remain responsible for having authorization from people depicted, including parents or guardians for children.

If you are a person who appears in someone else’s recap and you want that content removed, contact us at hello@thegreatrecap.com. We may need to verify the request and may notify the customer. We may not be able to recall books already printed or shipped. We may decline or limit a request where we cannot verify it, where the customer has a compelling legal basis to keep a copy, or where law requires us to retain data — but we will consider valid rights requests in good faith.

5. How we use information

We use personal information to:

• provide, operate, secure, and improve the Service;
• create drafts, proofs, covers, and print files;
• process payments and prevent fraud;
• ship books and communicate order status;
• send transactional email (magic links, reminders you requested, proof-ready notices);
• respond to support and legal requests;
• understand aggregate usage (for example, which steps people complete) so we can fix the product;
• send optional marketing email if you subscribe or if permitted by law — you can unsubscribe;
• establish, exercise, or defend legal claims.

We do not use your photo library to send you third-party advertising. We do not sell personal information for money.

6. Legal bases (EEA/UK and similar)

If GDPR, UK GDPR, or a similar law applies, we process personal information on these bases as relevant:

• Contract — to create your recap, take payment, and fulfill an order you requested;
• Legitimate interests — to secure the Service, prevent abuse, understand product usage in a limited way, and improve reliability, balanced against your rights;
• Consent — where we ask for it (for example, certain cookies or optional marketing), or where you upload User Content that we can only lawfully process because you obtained the depicted person’s consent and instructed us to process it;
• Legal obligation — tax, accounting, consumer, or law-enforcement requirements.

Where we rely on legitimate interests, you may object as described in Section 14. Where we rely on consent, you may withdraw it; withdrawal does not affect processing already completed (including a book already printed).

7. How we share information

We share personal information with:

• Infrastructure and database providers — currently including Supabase (hosted Postgres, auth, and file storage) to operate the app;
• Payment processors — currently Stripe, to charge your order;
• AI and media vendors — to transcribe audio, draft text, and generate cover images, as described in the AI Policy;
• Print-on-demand and logistics partners — to manufacture and deliver books (name, address, and print files);
• Email and communications providers — to send magic links and order email;
• Professional advisers — lawyers, accountants, insurers, when needed;
• Authorities — when required by law, valid legal process, or to protect rights, safety, and the integrity of the Service;
• Business transferees — if we negotiate or complete a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality.

Collaborators you invite can see User Content on that recap. Recipients of a physical book can see everything printed in it; that disclosure is inherent to the product you ordered.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising in the sense of “selling” or “sharing” under the California CPRA. If that changes, we will update this Policy and provide any required opt-out.

8. AI and subprocessors

User Content sent to an AI vendor is processed to return a result for your recap (for example, a transcript, a paragraph, or a cover image). We select vendors that contractually restrict use of customer content for their own independent model training where that control is available, as described in the AI Policy. Vendors may process data in the United States or other countries.

We may change subprocessors as the product evolves. Material changes to categories of processors will be reflected in this Policy or the AI Policy.

9. Cookies and similar technologies

We use cookies, local storage, and similar technologies to keep you signed in, remember progress on a recap, maintain security, and remember your cookie choices. Some storage is strictly necessary and always active.

Analytics (PostHog). With your consent where required, we use PostHog on our marketing site to understand aggregate traffic and product funnels. PostHog uses identified profiles only when you sign in; otherwise analytics are anonymous. You can accept or reject analytics in the cookie banner or via “Cookie settings”.

Message Kate. If you enable it, our marketing chat widget stores your conversation on this device so Kate can follow up by email when you ask. It is optional and off until you consent.

We do not use third-party advertising cookies and we do not sell or share personal information for cross-context behavioral advertising. Where your browser sends a Global Privacy Control signal, we treat that as an opt-out of non-essential cookies.

You can also control cookies through your browser. Blocking necessary cookies may break login or checkout.

10. Retention

We keep information only as long as needed for the purposes above:

• Active recaps — while you work on them and for a reasonable period afterward so you can resume or reorder;
• Paid orders — account, order, and shipping records for tax, accounting, chargeback, and consumer-warranty periods;
• Print files — long enough to manufacture, reprint a defective copy, and handle support, then deleted or archived according to our then-current schedule;
• Support tickets — as needed to finish the conversation and keep a limited record;
• Backups — for a limited rolling period, then overwritten;
• Legal holds — if we reasonably anticipate a dispute or receive a valid preservation request.

You may request deletion of a recap or account (Section 14). Printed books and carrier copies are outside our practical control once shipped. We may retain minimal records (for example, that an order occurred and was deleted) to prevent fraud or comply with law.

11. Security

We use administrative, technical, and organizational measures appropriate to the nature of photo and order data, including encryption in transit, access controls, and vendor diligence. No online service is completely secure. You are responsible for the security of devices you use and of invitation links you forward. If we become aware of a breach affecting your personal information, we will notify you and regulators as required by law.

12. International transfers

We are oriented to customers worldwide. Your information may be processed in the United States and other countries that may not provide the same legal protections as your home country. Where required, we use appropriate safeguards such as Standard Contractual Clauses or a vendor’s approved transfer mechanism. Contact us if you need more detail about transfers applicable to your data.

13. Children

The Service is for adults. We do not knowingly collect personal information directly from children under 13 (or under 16 in the EEA/UK where that higher digital-consent age applies) as account holders.

Adults may create a recap that includes photos of children. In that case, the adult customer is responsible for having parental or guardian authority and any other required consent before upload. We do not use children’s images for marketing. If you believe a child has created an account or that photos of a child were uploaded without required authority, contact hello@thegreatrecap.com and we will take appropriate steps, which may include deletion.

14. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export personal information; to restrict or object to certain processing; to withdraw consent; and to lodge a complaint with a supervisory authority. California and other U.S. state residents have additional rights described in Section 15.

To exercise a right, email hello@thegreatrecap.com from the address associated with your recap when possible, and describe the request. We may need to verify your identity. We will not discriminate against you for exercising a privacy right.

We may refuse or limit a request where an exemption applies (for example, we cannot un-print a shipped book; we may retain transaction records; we may decline a request that is unfounded, excessive, or that would violate another person’s rights).

If you are in the EEA or UK, you may also contact your local data-protection authority. We encourage you to contact us first so we can try to resolve the issue.

15. U.S. state privacy disclosures

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, or another state with a comprehensive privacy law, the following applies to “personal information” or “personal data” as those laws define it.

Categories collected (in the last 12 months, depending on how you use the Service): identifiers (email, IP, account id); commercial information (orders); internet or electronic activity (logs, cookies); geolocation at a coarse level (IP-based); audio (if you record a voice note); visual information (photos you upload); inferences we generate only as needed to draft your recap (not a marketing profile). We do not intentionally collect precise geolocation, biometric identifiers for identification, or government id numbers.

Sources, purposes, and recipients are described in Sections 3, 5, and 7.

Sale / share: we do not sell personal information and do not share it for cross-context behavioral advertising. We do not have actual knowledge of selling or sharing the personal information of consumers under 16.

Sensitive personal information: photos and voice may reveal sensitive information. We use that information only to provide the Service you requested, not to infer characteristics for advertising. We do not use or disclose sensitive personal information for purposes that require a right to limit under CPRA beyond providing the Service.

Retention is described in Section 10.

Rights: you may request know/access, delete, correct, and (where applicable) opt out of sale/share or targeted advertising — which, today, is not how we operate. Authorized agents may submit requests with proof of authority. We will respond within the time those laws require. You may appeal a denial by replying to our decision email; if you are unsatisfied, you may contact your state attorney general.

16. Changes

We may update this Policy from time to time. We will change the “Last updated” date and, for material changes, provide additional notice (for example, a site notice or email) when required. Continued use of the Service after an update means you acknowledge the revised Policy. If you need a copy of a prior version, ask us.

17. Contact

Privacy questions and requests: hello@thegreatrecap.com.

The Great Recap · thegreatrecap.com