Last updated: October 13, 2026
This policy explains how Rewindal (GENERAL GALACTIC SOLUTIONS SRL, "we", "us") uses personal data when you use https://rewindal.comand the services around it (the "Service"). We follow the EU General Data Protection Regulation (GDPR) and Romanian data protection law.
Rewindalis a way to design a printed photo calendar for the wall or desk. You add photos, short videos, and text. After we print and ship it, someone can scan a page with their phone and watch that month's clip. They do not need a Rewindal account to watch.
Data controller: GENERAL GALACTIC SOLUTIONS SRL, trading as Rewindal
VAT / CIF: RO43613823
Address:
Aleea Berzei nr. 5, sc. B, ap. 37, et. 4
Dorohoi, jud. Botoşani
Romania
Postal code 715200
Email: [email protected]
For privacy requests, email [email protected]. We are established in Romania. The lead supervisory authority is ANSPDCP (see Your rights).
When you create an account we store:
Email code. We email a one-time sign-in code through Amazon SES. Google reCAPTCHA Enterprise runs when you request that code, to block abuse.
Google.If you choose Continue with Google, Google shares the email address and basic profile it provides for sign-in. We use that to create and recognize your account. Google's Privacy Policy applies to Google's own processing.
Facebook and Instagram.Both buttons use Meta login. We request your public profile and email address. We use them to create and recognize your account. We do not read your posts, friends list, or Instagram photos, and we do not post on your behalf. Meta's Privacy Policy applies to Meta's own processing. Signing in with Facebook or Instagram does not delete your Rewindal account. How to ask us to delete data we received from Meta is in Account and data deletion.
When you check out we store:
The shipping and billing details on an order are a snapshot taken at checkout. Later changes to the address saved on your account do not rewrite past orders.
To make the calendar we store what you put in it:
We use this content to show your preview, print the calendar, and play the clip when someone scans the page. We do not sell it, use it for advertising, or use it to train machine-learning models. We do not run facial recognition on it.
If you use the contact form we store your name, email address, and message, and we email you a confirmation. reCAPTCHA Enterprise runs when you send the form. If you email us directly, we keep that correspondence.
Like most websites, our hosting and security tools receive your IP address, device and browser details, and the pages you request. We use this to run the Service, prevent abuse, and fix faults. Details are in Cookies and similar technologies.
Calendars are personal. They often show partners, parents, children, and friends. When you upload that content, you are the source of their personal data. You need a valid reason to share it with us and with the people who will see the printed calendar or a view link — for example because you are the parent, or because the person expects this gift.
We process those photos and videos only to provide the calendar you ordered: preview, print, and playback. We do not build profiles of the people in them, and we do not try to infer health, beliefs, or similar characteristics from an image.
A printed calendar and its view link work like a photo album you hand to someone. Anyone who has the calendar or the link can watch the clips. Share them only with people you want to see that content.
The person who receives a calendar does not sign up. A QR code on the page, or a view link, is enough to open that month's clip.
If they use the camera, the camera runs in the browser on their phone. The phone matches the printed page to the tracking file we stored, then plays the clip. The camera picture stays on the phone. We do not upload it, and we do not use it to recognize faces.
When a clip starts, we store that it started: which calendar page, the time, and whether playback used the camera view or the video player. We do not store the viewer's name, account, or precise location. Ordinary server logs may still include IP address and browser data for that request, as described under technical data.
You can send a link so someone else can add a photo or video to your calendar without creating an account. The link is valid for 48 hours. Anyone who has the link during that time can upload to your calendar. What they upload is stored as your calendar content, under the rules in this policy. You can stop using the link by letting it expire.
We need an account email to create an account, and a name, phone number, and address to ship an order. If you do not provide them, we cannot provide that part of the Service. Analytics cookies are optional.
| Purpose | Legal basis (GDPR) |
|---|---|
| Create your account, keep you signed in, and let you design and preview a calendar | Contract (Art. 6(1)(b)) |
| Host your photos, videos, and text, produce print files, and keep view links working so a printed page can play its clip | Contract (Art. 6(1)(b)) |
| Take payment, calculate tax, issue invoices, and deliver the printed calendar | Contract (Art. 6(1)(b)); legal obligation for tax and accounting records (Art. 6(1)(c)) |
| Send service email: sign-in codes, contact replies, and order messages such as payment confirmation | Contract (Art. 6(1)(b)), or legitimate interest in answering you (Art. 6(1)(f)) |
| Accept a photo or video from someone you invited with an upload link | Contract with you (Art. 6(1)(b)) |
| Play a clip for someone who has the calendar or view link, and record that a clip started | Contract with the buyer (Art. 6(1)(b)); legitimate interest in operating playback (Art. 6(1)(f)). We do not identify the viewer. |
| Block abuse and fraud, including reCAPTCHA on sign-in codes and the contact form, and rate limits | Legitimate interest (Art. 6(1)(f)) |
| Find and fix errors, including sampled session replay in production (Sentry) | Legitimate interest (Art. 6(1)(f)) |
| Measure how the site is used (Google Analytics and Vercel Analytics) | Consent (Art. 6(1)(a)), and only if you turn on Analytics in the cookie preferences popup and choose Accept |
| Keep records we are required to keep, and establish or defend legal claims | Legal obligation (Art. 6(1)(c)), or legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, the interest is running a secure service, answering messages, and keeping printed calendars playable. You can object, as described under Your rights.
We send email about your account and orders. We do not send marketing newsletters. If we ever do, we will ask for consent first, and you will be able to withdraw it.
Our staff can access accounts, calendars, and orders when they need to in order to operate, support, or fulfill the Service. We do not sell personal data, and we do not share calendar photos or videos with advertisers.
We use service providers who process data on our instructions, or who receive only what they need to do their job:
We also disclose data if the law requires it, or where it is necessary to protect rights, safety, or security.
Supabase and our Amazon Web Services workloads for this product are in the EU (Frankfurt). Other providers, including Stripe, Google, Meta, and Vercel, may process data outside the European Economic Area. Where they do, we rely on the safeguards required by GDPR, such as Standard Contractual Clauses and the measures those providers put in place.
You can email us for more detail about transfers that apply to your data.
Calendar files are stored in private storage. View links and partner access to print files use access controls and time-limited signed links. Traffic to the Service is encrypted in transit. No online service can guarantee absolute security. If you think your account has been compromised, email us.
Under the GDPR you can ask us to:
Email [email protected]from the address on your account, or from another address if you do not have an account. If you appear in someone else's calendar, you can use the same address. We may need to involve the account holder, because they uploaded the content. We may ask you to confirm your identity. We respond within one month in most cases, and we will tell you if we need longer.
You can lodge a complaint with the Romanian supervisory authority (ANSPDCP) or with the authority in the EU country where you live or work.
Email [email protected] from the email address on your account and ask us to delete the account, or to delete specific data. The steps are on our Data deletion instructions.
Deleting the account removes or anonymizes personal data in our active systems, including profile details and calendar content, except records we must keep for a legal obligation (for example invoices) or a legal claim. Once calendar content is deleted, view links for that calendar stop playing.
If you signed in with Facebook or Instagram, the same request deletes the data we hold from that login, including the email and profile identifier Meta shared with us. You can also remove Rewindal under Facebook settings for apps and websites. That disconnects Meta from future sign-in. It does not, by itself, delete your Rewindal account, calendars, or orders.
The Service is for adults. You must be at least 18 to create an account. We do not offer accounts to children, and we do not aim marketing at children.
An adult may include photos or videos of children in a calendar they order only if they have the right to do so (for example, as a parent or guardian). Parent or guardian supervision is required and recommended whenever a child might see or use any part of the Service, including viewing a calendar or AR playback. We use those images only to print and play that calendar. We do not use them to identify children or for advertising.
If you believe a child created an account, or that content was uploaded without the right to do so, email us and we will take appropriate steps.
We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects, such as deciding whether you may buy a calendar from a profile of you.
reCAPTCHA gives a risk score when you request a sign-in code or send the contact form. We use that score only to block spam and abuse. If a request is blocked, you can try again or email us. Stripe may run its own fraud checks during payment; that processing is described in Stripe's privacy policy.
Cookies are small files stored on your device. We also use local storage for your cookie choice.
Several listed companies may set cookies or use similar storage on your device when you use Rewindal. Those companies publish their own user privacy policies and terms for people who use their services (you as their user or visitor). Those documents are separate from our Terms & Conditions with you and from our contracts with those providers as vendors.
These are required for the Service to work:
We load these only with your consent:
You can withdraw consent for optional cookies at any time. Withdrawal does not affect processing that happened before you withdrew.
In production we use Sentry for error reporting, performance traces, and sampled session replay, as described above. Sentry may use cookies or similar storage in your browser. This is for reliability and security, not advertising; it is not controlled by the cookie preferences screen. We rely on legitimate interest for this processing. Sentry user privacy · user terms
You can block cookies in your browser. Blocking essential cookies can prevent sign-in, checkout, or form submission.
We will post changes on this page and update the date at the top. If a change materially affects how we use your data, we will tell you in the Service or by email where that is appropriate.
Privacy questions and requests: [email protected]
Our Terms cover the contract for using Rewindal and ordering a calendar.