Data controller
The controller for personal data processed through SURPRIA is Alexis CAMBAKIDIS. Data protection requests may be sent using the following contact details:
Data we process
- Account data: first name, last name, email address, hashed password and technical security information.
- Surprise data: title, personalized text, theme, settings, uploaded media and event status.
- Recipient data: name or label, email address and/or phone number when provided, language and private-link status.
- Reactions: video, audio, recording-session information, upload status and technical data required for upload.
- Consent records: the recipient’s choices for camera, microphone and video storage, together with the associated date.
- Order and payment data: order references, plan, amount, status and Stripe technical identifiers. Full payment card data is handled by Stripe and is not stored by SURPRIA.
Why we use this data
- Create and secure user accounts.
- Create, personalize, activate and share surprises.
- Record, transmit, display and let the creator retrieve consented reactions.
- Process payments, manage orders and prevent abuse or security incidents.
- Send service-related messages such as account activation, invitations and useful notifications.
Legal bases
Depending on the processing activity, SURPRIA relies on contract performance, consent, compliance with legal obligations or legitimate interests in securing and operating the service.
- Account, surprise, order and service delivery: performance of a contract or pre-contractual steps.
- Camera, microphone and recipient reaction recording: consent collected before recording.
- Security, abuse prevention and necessary technical logs: legitimate interests, subject to individuals’ rights.
Retention periods
Data is not kept indefinitely. A surprise remains active for up to 90 days from activation and may be archived earlier once all planned recipients have received their link and a reaction has been recorded for each of them. After archiving, video reactions and the relevant media are retained for 30 days before deletion. A reminder may be sent approximately 7 days before deletion so the creator can retrieve their memories. Event data is deleted 90 days after media deletion; orders and payments are retained separately. Each completed Memory Movie remains downloadable for 7 days after rendering, even if its source reactions have since been deleted. Account deletion may end access earlier. If a Memory Movie is already queued or rendering at that deadline, source deletion is deferred until processing finishes.
When an account is deleted, related events, recipients, media and reactions are permanently deleted, except information that must be retained longer to meet legal, accounting or tax duties or to establish, exercise or defend legal claims.
Service providers and recipients
SURPRIA does not sell personal data. Some information is shared only with providers required to operate the service:
- IONOS for website hosting and infrastructure, including the Cloudflare CDN supplied with the hosting offer.
- Stripe for secure payment processing and related transaction management.
- Our SMTP provider for transactional email and Esendex for transactional SMS delivery.
Cookies and trackers
SURPRIA currently uses only cookies or storage mechanisms necessary for operation, authentication, language preferences and security. No advertising or behavioral tracking tool is currently used. If this changes, this policy and, where required, the consent mechanism will be updated.
Your rights
Subject to applicable law and conditions, you may exercise the following rights:
- Access personal data concerning you.
- Correct inaccurate or incomplete data.
- Request deletion where the legal conditions are met.
- Request restriction, object or withdraw consent depending on the processing concerned.
- Data portability where this right applies.
How to exercise your rights
To exercise your rights or ask a question about your data, email contact@surpria.com and provide enough information for us to process your request. Proof of identity may be requested only where necessary to prevent someone else exercising your rights.
You also have the right to lodge a complaint with the competent supervisory authority, including the CNIL in France.
Security and policy updates
SURPRIA uses reasonable technical and organizational measures intended to limit unauthorized access, loss or alteration of data. This policy may change as the service or applicable rules evolve; the update date shown at the top identifies the applicable version.
Transfers and recipient information
Depending on their organisation and the services used, some technical providers may process data from countries outside the European Economic Area. Where such a transfer occurs, SURPRIA relies on the mechanisms provided by the GDPR and the safeguards implemented by the relevant provider.
Surprise recipients receive information before any recording. Access to the camera and microphone and storage of the reaction require a positive choice; refusal prevents recording. Consent may be withdrawn for the future by contacting SURPRIA, without affecting the lawfulness of processing carried out before withdrawal.