ADDMOMENTS PLATFORM PRIVACY POLICY
01.05.2026

This Privacy Policy (the “Policy”)
explains how SOLFINITY LLC (hereinafter referred to as the “Administration,”
“Platform,” “we,” “us,” or “our”),
as the owner of the Addmoments SaaS platform, collects, uses, stores, and
protects the personal data of its users.

We classify our users into two
categories:

“Organizers” – registered users who create Events and manage albums.

“Guests” – unregistered users who access an album via a QR code or a shared
link to upload and view media content.

1. WHAT DATA WE COLLECT

1.1. Organizer Data

We may collect the following categories
of personal data from Organizers:

●      
Identification Data: first name and last name.

●      
Contact Data: email address and telephone number (where provided).

●      
Account Data: password (stored exclusively in encrypted/hashed form).

●      
Payment Information: we do not store complete payment card details. Payment transactions
are processed through secure third-party payment service providers, including LiqPay.

●      
Technical Data: IP address, browser type, and information relating to the use of the
Platform.

1.2. Guest Data

As Guests are not required to register an
account, we collect only the minimum amount of data necessary to provide the
Platform’s services:

●      
Media Content: photographs, audio recordings, and video recordings voluntarily
uploaded by Guests to an Event album. Such files may contain images or other
personal data relating to identifiable individuals.

●      
File Metadata (EXIF Data): information automatically embedded in photographs or videos by the
Guest’s device, including the exact date and time the file was created, camera
model, technical specifications, and, where enabled on the device,
geolocation/GPS coordinates.

The Platform does not automatically
compress, modify, remove, or otherwise alter such metadata and stores it “as
is.”

●      
Technical Data: IP address (for security, routing, and spam prevention purposes) and
cookies (limited to those that are strictly necessary for the operation of the
upload session).

2. PURPOSE OF DATA PROCESSING

2.1. We process the collected data solely for the
following purposes:

2.1.1. To
provide the Addmoments Platform services, including account registration, Event
creation, QR code generation, and the storage and display of content.

2.1.2. To
process payments made by Organizers for premium features or additional storage.

2.1.3. To
provide technical support and communicate with Organizers.

2.1.4. To
ensure the security of the Platform and to prevent fraud, cyberattacks, and
unauthorized access.

2.1.5. To
analyze and improve the performance of the Platform, solely on an anonymized
and aggregated basis.

3. ALLOCATION OF ROLES (DATA CONTROLLER AND DATA PROCESSOR)

3.1.With respect to the registration, payment,
and technical data of Organizers, the Administration acts as the Data
Controller.

3.2.With respect to media content (photographs,
audio recordings, video recordings, and EXIF metadata) uploaded by Guests, the
Administration acts solely as the Data Processor, providing cloud
infrastructure for the storage and processing of such data. The Data
Controller of this data is the Event Organizer.

3.3.The Event Organizer is solely responsible
for ensuring the lawful collection of photographs, audio recordings, and video
recordings of Guests, obtaining any required consents for recording, informing
Guests that their metadata (including geolocation data, where applicable) may
be disclosed to other participants, and moderating or removing content through
the moderation tools provided by the Platform. These roles and responsibilities
are further governed by our Data Processing Agreement (DPA).

4. DATA RETENTION

4.1. Organizer Data

Organizer Data is retained for the entire
duration of the Organizer’s account. If an Organizer deletes their account,
their personal data will be permanently deleted within thirty (30) days.

4.2. Guest Media Content

Guest media content (including
photographs, audio recordings, and video recordings) is stored on the
Platform’s servers only for the album retention period selected by the
Organizer when creating the Event. Upon expiration of that period, and after
the Organizer has been given the opportunity to download an archive of the
Event content, all media files are automatically and permanently deleted from
our servers, subject to the standard period required for the secure removal of
encrypted backup copies.

This version uses terminology and
phrasing consistent with GDPR-oriented privacy policies and SaaS agreements,
making it suitable for publication in an international legal context.

5. DISCLOSURE
OF DATA TO THIRD PARTIES (SUB-PROCESSORS)

5.1.We do not sell or disclose personal data to
third parties for marketing purposes. Personal data may be disclosed only to
the extent necessary for the operation of the Platform, including:

5.1.1. Cloud
hosting service providers (such as Amazon Web Services (AWS)), whose
servers are located within the European Union for the secure physical storage
of data.

5.1.2.
Payment service providers for the processing of Organizers’ payment
transactions.

5.1.3.
Courts, law enforcement authorities, or other competent public authorities
where disclosure is required by applicable law or pursuant to a lawful request.

5.2.An up-to-date list of our third-party
service providers (Sub-processors) is available in Appendix B to the Data
Processing Agreement (DPA) or via the relevant link on our Website.

6. INFORMATION SECURITY

6.1.We implement appropriate technical and
organizational security measures, including:

6.1.1.
Encryption of data in transit using SSL/TLS protocols during the upload
and viewing of Content.

6.1.2.
Generation of unique cryptographically secure links for accessing Event albums.

6.1.3.
Restricting access by Platform personnel to users’ private albums. Access to
Content is granted solely upon the Organizer’s explicit request for the purpose
of providing technical support.

7. USER RIGHTS

7.1.In accordance with the Law of Ukraine
“On Personal Data Protection” and, where applicable, the General
Data Protection Regulation (GDPR), you have the right to:

●      
Be informed about the sources of
collection, the location, and the purposes of processing of your personal data.

●      
Access your personal data.

●      
Request the correction, updating,
or deletion of your personal data (the “right to be forgotten”).

●      
Withdraw your consent to the
processing of your personal data where processing is based on your consent.

Note for Guests regarding the exercise
of their rights:
As the Administration acts solely as the Data
Processor of Guest Content, if you, as a Guest, wish to remove your
photograph, audio recording, or video recording from an Event album, you must
submit your request directly to the Event Organizer, who has moderation rights
over the relevant album. If you submit such a request to the Administration, we
will forward it to the relevant Organizer for processing and provide any
necessary technical assistance to facilitate compliance.

8.
CONTACT INFORMATION

If you have any questions regarding this
Privacy Policy or the processing of your personal data, including questions
relating to the General Data Protection Regulation (GDPR), or if you
wish to submit a complaint, you may contact our Data Protection Officer using
the following details:

Company Name:
SOLFINITY LLC

Company Registration Number (EDRPOU): 45787482

Email:
support@addmoments.com

Registered Office: 7-A Staroievreiska Street, Lviv, 79008, Ukraine