Privacy Policy

1. Introduction

MyAlbumLink ("we", "our" or "the Platform") is committed to protecting the privacy and security of our users' personal information. This Privacy Policy describes how we collect, use, share and protect your personal information in accordance with the Mexican Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP).

2. Data Controller

Data Controller: MyAlbumLink
Address: Mexico
Website: https://myalbumlink.com
Email: admin@myalbumlink.com

3. Information We Collect

3.1 Information You Provide Directly

• Authentication information: Name, email address (managed by our authentication provider Clerk - we do not store passwords)
• User-generated content: 360° virtual tours, panoramic images, titles, descriptions
• Venue information: Venue name, location, city, state, property type, description
• Communications: Messages, support inquiries, feedback

3.2 Information Collected Automatically

• Usage information: Pages visited, time on site, clicks, interactions
• Device information: Browser type, operating system, IP address
• Performance data: Loading speed, technical errors
• Cookies and similar technologies: To improve your experience (see Cookies section)

3.3 Information from Third Parties

• Authentication (Clerk): Name, email address and unique user identifier when you sign in. Clerk independently manages your password and authentication credentials - we never have access to your password
• Google Drive: If you choose to import files from Google Drive, we request read-only access to your Google Drive account via OAuth authentication. See section 3.4 for more details
• Analytics services: Aggregated and anonymous data about site usage

3.4 Google Drive Data Usage

MyAlbumLink offers the optional functionality of importing files from Google Drive. When using this feature:

• Scope of access: We request limited access (drive.file) to your Google Drive. We can only access files you explicitly select through the file picker. We cannot view, modify or delete other files in your Google Drive
• Temporary token: The Google access token is used solely during your active browser session to download the files you select. We do not store, save or transmit your Google token to our servers
• Local download: The files you select are downloaded directly from Google Drive to your browser. From there, they are uploaded to our storage platform (Cloudflare R2) following the same process as a local file upload
• No ongoing access: We do not maintain access to your Google Drive after you close the session or browser. There are no refresh tokens or persistent access
• Data we process: We only process the files you explicitly select in the Google Drive picker. We do not access, scan or index any other files in your Google Drive

You can revoke MyAlbumLink's access to your Google Drive at any time from your Google account permissions settings.

4. How We Use Your Information

We use your personal information to:

• Provide services: Create, host and share 360° virtual tours
• Manage your account: Authentication, profile management, preferences
• Improve the Platform: Usage analytics, development of new features
• Communication: Service updates, technical support, important notifications
• Security: Fraud prevention, protection against misuse
• Legal compliance: Fulfillment of legal and regulatory obligations
• Optimization: Image processing, thumbnail generation, performance optimization

5. How We Share Your Information

We may share your information with:

5.1 Service Providers

• Clerk: Authentication and user management service
• Google Drive API: Optional file import from Google Drive (read-only access, no token storage)
• Cloudflare R2: Image and file storage
• Upstash Redis: Rate limiting and caching services
• Vercel/Hosting: Web platform hosting

5.2 Public Content

Virtual tours you publish as "public" will be visible to anyone who accesses the link. This includes 360° images, titles, descriptions and venue information.

5.3 Legal Requirements

We may disclose your information if required by law, court order, legal process or to protect the rights, property or safety of MyAlbumLink, our users or others.

5.4 Business Transactions

In the event of a merger, acquisition or sale of assets, your personal information may be transferred. We will notify you before your information is transferred and becomes subject to a different privacy policy.

We do not sell your personal information to third parties for marketing purposes.

6. Information Security

We implement technical and organizational security measures to protect your information:

• Encryption: Secure transmission via HTTPS/TLS
• Secure authentication: We use Clerk, a specialized security provider that manages your authentication and password. We do not store passwords on our servers
• Access control: Restricted access to personal data for authorized personnel only
• Monitoring: Logging and monitoring of suspicious activities
• Rate limiting: Protection against brute force attacks and abusive usage
• Backups: Regular data backups
• File validation: Verification of file type, size and content of uploaded files to prevent malware

Despite our efforts, no method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Specific retention periods are:

• Account information: While the account is active + 90 days after deletion
• Content (tours, images): While published + 30 days after deletion
• Access logs: 90 days
• Backups: Up to 30 days (automatic rotation)
• Support data: 2 years from last communication
• Financial data: As required by tax law (minimum 5 years)

8. Your Rights (ARCO Rights)

Under the Mexican LFPDPPP (Federal Law on Protection of Personal Data Held by Private Parties), you have the following ARCO rights:

• Access: Know what personal data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Cancellation: Request the deletion of your data
• Opposition: Object to the processing of your data for specific purposes

How to Exercise Your Rights

To exercise any of these rights, contact us at:
Email: admin@myalbumlink.com
Subject: "Exercise of ARCO Rights"

We will respond to your request within 20 business days in accordance with the LFPDPPP.

9. Cookies and Similar Technologies

We use cookies and similar technologies for:

• Essential cookies: Necessary for site operation (authentication, session)
• Performance cookies: Usage analytics and site improvement
• Functionality cookies: Remembering your preferences

You can control cookies through your browser settings. However, disabling certain cookies may affect site functionality.

10. International Data Transfers

Some of our service providers are located outside of Mexico. When we transfer data internationally, we ensure that adequate safeguards are in place in accordance with the LFPDPPP, such as:

• Contractual clauses ensuring similar levels of protection
• Security certifications from providers
• Other legally recognized protection measures in Mexico

11. Children's Privacy

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal information from minors. If we discover that we have collected information from a minor without appropriate parental consent, we will delete that information immediately.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at admin@myalbumlink.com.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through:

• A prominent notice on our website
• An email to your registered email address
• A notification in your dashboard

The "Last updated" date at the top of this document indicates when the last modification was made. Your continued use of the Platform after the changes constitutes your acceptance of the updated Privacy Policy.

13. Links to Third-Party Sites

Our Platform may contain links to third-party websites. We are not responsible for the privacy practices of these sites. We recommend that you read the privacy policies of each site you visit.

14. Data Protection Authority

If you have any complaints about the handling of your personal data, you may contact the competent authority in Mexico:

15. Contact

If you have questions, concerns or requests related to this Privacy Policy or our privacy practices, please contact us: