Mi Album Privacy Policy

This site collects some personal data from its users

Mi Album is a photo lab: we print and manufacture products using the photos you give us. This policy explains what data we collect, what we use it for, how long we keep it and who we share it with. The rules for using the site and placing orders are in our terms and conditions of use.

1. Your photos

The photos you upload to Mi Album are used for a single purpose: producing the order you place with us (prints, framed pictures, albums and the other products in our catalog). We do not sell them, we do not use them for advertising, we do not use them to train artificial intelligence models and we do not publish them anywhere.

We keep them for as long as they are needed to process, produce and deliver your order: our storage automatically deletes any photo 100 days after it was uploaded. You may also ask us to delete them sooner, at any time, using the contact details in this policy.

2. Google user data

Mi Album uses Google APIs for two optional features: bringing in your photos from Google Photos or Google Drive so you do not have to download them first, and signing in with your Google account. Neither happens unless you choose it and grant your consent on Google's own screen.

2.1 What Google user data we access

When bringing in photos from Google Photos or Google Drive we request only the https://www.googleapis.com/auth/photospicker.mediaitems.readonly and https://www.googleapis.com/auth/drive.file scopes. Through them we access:

• The content of the photos you individually select in the picker displayed by Google itself.
• The basic file information of those same photos: identifier, name, file type and size.

When you sign in with Google ("Continue with Google" button) we receive, through the openid, .../auth/userinfo.email and .../auth/userinfo.profile scopes: your name, your email address, your profile picture and your Google account identifier.

What we do not access. We do not read or browse the rest of your Google Photos library or the other files in your Google Drive: the scopes we request only reach what you pick in Google's own selector. We do not access your contacts, your calendar, your email or any other Google service, and we do not obtain long-lived access (we do not request refresh tokens).

2.2 How we use Google user data

• The photos you select: solely so that you can place them in the product you are building (a print, a framed picture, an album or any other product in our catalog) and so that we can manufacture and deliver that order.
• Your Google profile data: solely to create your Mi Album account, identify you when you sign in, and communicate with you about your orders.

We do not use Google user data for any other purpose. Specifically: we do not sell it, we do not use it for advertising or for building marketing profiles, we do not use it to train artificial intelligence models and we do not publish it anywhere. No one at Mi Album reads your photos except where it is strictly necessary to produce your order or to handle a support request you made.

Limited Use. Mi Album's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2.3 Who we share, transfer or disclose Google user data with

We do not sell, rent or transfer Google user data to third parties for advertising purposes, and we do not share it with data brokers or advertisers. The only third parties that receive it are the service providers we need in order to deliver the service to you, and only for that purpose:

• Amazon Web Services (AWS): our storage and computing provider. The photos you bring in from Google are stored on our servers hosted with AWS, in the Mexico region, so that we can process and print them.
• The provider of our product editor: when you create your account with "Continue with Google", your name and email address are also registered in the editor system we use to build the products.
• Our manufacturing and shipping providers: they receive what is strictly necessary to produce your order and deliver it to your address.

We may also disclose data when a competent authority requires it under the law.

2.4 How we protect Google user data

We treat your photos as sensitive data and apply, among others, the following safeguards:

• Encryption in transit: the entire site and every call to the Google APIs travel encrypted over HTTPS (TLS).
• Encryption at rest: photos are stored encrypted with AES-256 in AWS storage.
• We do not store your Google credentials: the permission you grant in Google's picker produces a temporary token that lives only in your browser, expires after roughly one hour and is used only to download the photos you selected. We do not store it in our databases, we do not request long-lived tokens, and we never see your Google password.
• Random file names: every photo is stored under a randomly generated, non-guessable name that reveals neither your identity nor the content.
• Validation of what we receive: we verify the actual content of every file before accepting it, and we only accept images.
• Restricted access: access to our infrastructure uses individual credentials with least-privilege permissions; accounts are not shared.

2.5 How long we retain Google user data and how it is deleted

• Photos brought in from Google Photos or Google Drive: they are automatically deleted 100 days after being uploaded. We keep no copies beyond that period.
• Photos that never become part of an order: if you bring in photos and abandon the process, they are deleted from our servers within approximately 24 hours.
• Your Google profile data (name, email, picture and identifier): kept for as long as your Mi Album account exists, and deleted when you ask us to close it.
• Deletion on request: you may ask us to delete your photos or your account at any time by writing to privacy@mi-album.com. We respond within 30 days at most. The step-by-step procedure is on our data deletion page.
• Revoking access: you may withdraw Mi Album's permission at any time from your Google account permissions page. Once you do, we can no longer bring in new photos from your account.

Facebook data. If you choose Facebook as the source of your photos, we obtain your name, your contact email and only the photos you select, for the same purpose (producing your order) and with the same protection, retention and deletion measures described above.

3. Your account and order data

First name, last name, email address, phone number, country and delivery address. We use them to create your account, process your order, deliver it and keep you posted on its status.

4. Analytics and advertising

Google Analytics, the Facebook pixel (conversion measurement and remarketing), Google remarketing and Microsoft Clarity (heatmaps and session recording).
Personal data processed: cookies and usage data.

5. Communicating with you

Mailing list or newsletter, and messaging with our support team (ActiveCampaign).
Personal data processed: country, email address, first name, last name, mobile phone number, delivery address and usage data.

6. Payments

Card payments are processed through our payment processor and the corresponding banking institutions (Banamex, American Express). Mi Album does not store full card numbers.

7. Children

The service is not directed to children under 13. Minors may use Mi Album only with the assistance of a parent or guardian. If you learn that a child under 13 has used our service without supervision, please contact us.

8. Deleting your data and ARCO rights

You may request at any time access to, rectification of, cancellation of, or objection to the processing of your personal data (ARCO rights under Mexican law), as well as the deletion of the photos you have given us. Users, competent authorities and Facebook/Meta may all request the deletion of personal data.

To do so, contact our support team at +52 55 5521 7000 or write to privacy@mi-album.com. We are at your service for any question. The step-by-step procedure is on our data deletion page.

9. Changes to this policy

We may update this privacy policy. When we do, we will publish the new version on this same page and update the "Last updated" date shown above.