Last updated: October 17, 2026
1. Who we are
Momentli is a web platform for weddings and events. Guests share photos by scanning a QR code, and AI face recognition sends each registered guest the photos they appear in. The service is available at momentli.co.il and app.momentli.co.il (the “Service”).
The Service is operated by Ovis, company / ID number [COMPANY / ID NUMBER], of [REGISTERED ADDRESS] (“Momentli”, “we”, “us”).
This Privacy Policy explains what personal data we collect, why, who we share it with, how long we keep it, and what rights you have. It should be read together with our Face Recognition and Biometric Data Policy, our Cookie Policy and our Terms of Service. Terms such as “Host”, “Guest”, “Co-manager” and “Event” have the meaning given in the Terms.
This policy is published in Hebrew and in English. In case of conflict, the Hebrew version prevails.
For any privacy question or request: privacy@momentli.co.il.
2. Our role: controller and processor
Privacy law distinguishes between the party that decides why and how data is processed (a “controller”, or in Israeli law, the “database owner”) and a party that processes data on its behalf (a “processor”, or “holder”). Our role depends on the data:
- Momentli is the controller of Host account data (name, email, profile picture, sessions and billing), of data about visitors to our marketing website, and of contact-form leads.
- Momentli processes Event Content on behalf of the Host. Photos, Guest registrations and the gallery of each Event are processed for the Host who created the Event and according to the Host’s instructions (for example, how long the Event is kept and who receives the link). For this data, the Host decides the purpose and we act as the Host’s processor.
- Momentli is also a controller of the biometric processing it performs for Guests who consent. When a Guest chooses to take a selfie and consents to face recognition, we are responsible for that biometric processing and its safeguards, as described in the Face Recognition and Biometric Data Policy.
Put simply: the Host decides to use Momentli at their Event, and we operate the Service for them; we remain directly responsible to you for your account, for our website, and for how face data is handled.
3. The laws we follow
We process personal data in accordance with:
- The Israeli Privacy Protection Law, 5741-1981, including Amendment 13, and the Privacy Protection (Data Security) Regulations, 5777-2017.
- Where applicable, the EU General Data Protection Regulation (GDPR), including Article 6 (lawful bases) and Article 9 (special categories of data, including biometric data).
- Where applicable, US state privacy laws, including the California Consumer Privacy Act as amended by the CPRA, and state biometric privacy laws (see sections 14 and 15).
4. What data we collect
| Who | Data | Source |
|---|---|---|
| Hosts | Name, email address, Google profile picture; Event details (name, date, optional cover image); plan and payment details (we do not store full card numbers); IP address and browser/device information (user agent) of sessions | The Host, Google sign-in, the payment provider |
| Co-managers | Email address; once they sign in, the same account data as Hosts | The Host who invited them, Google sign-in |
| Guests who register | Name, phone number, selfie; a face vector created from the selfie; matches between the Guest’s face and Event photos | The Guest |
| All Guests | Photos they upload and their association with the uploader’s device; a session cookie linking the device to its uploads and registration; technical data (IP address, browser type) | The Guest’s device |
| People who appear in photos | The image in the photo; face vectors created from every face visible in uploaded photos (this is how matching works) | Photos uploaded by Guests or by the Host |
| Website visitors and leads | Name and phone number submitted in the contact form; with consent, usage analytics and marketing cookies | The visitor |
| Anyone who contacts us | The content of the message and contact details | The sender |
Providing data is not required by law. Registration as a Guest (name, phone and selfie) is optional: a Guest who skips it can still upload and browse photos, but will not receive an SMS or face matching.
5. Why we use data and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and managing Host accounts and Events, and providing the Service | Host and Co-manager data, Event data | Performance of a contract (Art. 6(1)(b)) |
| Receiving, storing and displaying photos in the Event gallery | Photos, uploader association | On behalf of the Host; for us, performance of a contract and legitimate interests (Art. 6(1)(b), (f)) |
| Automated moderation to reject inappropriate images | Photos | Legitimate interests in keeping the Service safe and lawful (Art. 6(1)(f)) |
| Face recognition: matching a Guest’s selfie with Event photos | Selfie, face vectors, matches | Explicit consent of the Guest (Art. 6(1)(a) and Art. 9(2)(a)) |
| Sending the Guest an SMS with a personal link | Name, phone number | Performance of the service the Guest requested (Art. 6(1)(b)) |
| Transactional emails (such as sign-in, invitations to Co-managers, receipts) | Email address | Performance of a contract (Art. 6(1)(b)) |
| Payments, invoices and accounting | Billing data | Legal obligation and performance of a contract (Art. 6(1)(b), (c)) |
| Security, fraud prevention, abuse handling and takedown requests | Technical data, logs, relevant Content | Legitimate interests and legal obligation (Art. 6(1)(c), (f)) |
| Responding to leads and inquiries | Name, phone, message | Legitimate interests or steps prior to a contract (Art. 6(1)(b), (f)) |
| Website analytics (PostHog) | Usage data | Consent (Art. 6(1)(a)) |
| Advertising measurement (Meta Pixel) | Cookie identifiers, usage data | Consent (Art. 6(1)(a)) |
| Direct marketing | Email or phone | Consent (Art. 6(1)(a)) and section 30A of the Israeli Communications Law |
| Complying with the law and defending legal claims | As needed | Legal obligation and legitimate interests (Art. 6(1)(c), (f)) |
We do not use photos, selfies or face data for advertising or marketing, and we do not use them to train artificial intelligence models.
6. Who we share data with
We do not sell personal data. We share it only with service providers (processors) that help us operate the Service, under agreements that require them to protect it and use it only on our instructions. These are the categories of providers we use:
| Category of provider | Purpose | Data location |
|---|---|---|
| Cloud infrastructure providers | Hosting, photo storage, database, content delivery and transactional email | European Union (database) and a global network |
| Face recognition and moderation provider | Face indexing and matching, automated content moderation | Israel |
| Sign-in provider (Google) | Host sign-in | Global |
| SMS provider | SMS delivery | Israel |
| Payment provider | Payment processing | Israel |
| Analytics provider (PostHog) | Website analytics, only with consent | European Union |
| Advertising provider (Meta Platforms) | Advertising measurement (Meta Pixel), only with consent | United States and other countries |
A current list of our service providers is available on request at privacy@momentli.co.il.
In addition:
- Within the Event: photos in the gallery are visible to anyone who has the Event link. The Host and Co-managers can see Event data, including Guest registrations.
- As required by law: we may disclose data to authorities when required by law or by a court order, or to protect the rights and safety of users and others.
- Business transfer: if Momentli is merged, acquired or sells its assets, data may be transferred to the successor, subject to this policy.
7. International transfers
Face recognition is performed in Israel, and our database is hosted in the European Union. Some of our providers operate in other countries, including the European Union and the United States. Israel is recognized by the European Commission as providing an adequate level of data protection. Where data is transferred to a country that does not provide an adequate level of protection, we rely on appropriate safeguards, such as the EU Standard Contractual Clauses (SCCs) or the provider’s certification under an applicable framework, and, for transfers from Israel, on the conditions set out in the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.
8. How long we keep data
| Data | Retention period |
|---|---|
| Event Content (photos, cover image, Guest registrations) | Until the end of the plan’s storage period (1 to 12 months) or until the Host deletes the Event, and then deleted from our systems, including backups, within 30 days |
| Face vectors (from selfies and from photos) and matches | Deleted together with the Event’s face collection at the end of the storage period or when the Event is deleted, or earlier on a Guest’s request. See the Biometric Data Policy |
| Selfies | Deleted together with the Event |
| Photos a Guest deleted | Removed from the gallery immediately and from our systems within 30 days |
| Host account data | Until the account is deleted, and then deleted within 30 days |
| Invoice and payment records | For the period required by tax and accounting law |
| Contact-form leads | 24 months from the last contact |
| Security and system logs | Up to 12 months, unless needed longer to investigate an incident |
| Analytics data (with consent) | According to the provider’s retention settings, up to 24 months |
9. How we protect data
We apply security measures appropriate to the sensitivity of the data, in line with the Privacy Protection (Data Security) Regulations, including:
- Encryption in transit (HTTPS/TLS) and encryption at rest with our storage providers.
- A separate face collection for each Event, so that faces are compared only within the same Event.
- Access to systems restricted to authorized personnel on a need-to-know basis, with strong authentication.
- Logical separation between Events and access controls on Event data.
- Automated moderation of uploaded photos.
- Logging and monitoring, and procedures for handling security incidents, including notifying the Privacy Protection Authority and affected people where required by law.
- Contracts with processors that include data-protection obligations.
No system is completely secure, but we work continuously to protect your data.
10. Your rights
Depending on the law that applies to you, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Delete your data, including photos in which you appear and face data.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Restrict processing in certain circumstances.
- Portability: receive the data you provided in a structured, commonly used format.
- Withdraw consent at any time, including consent to face recognition and to cookies, without affecting processing already carried out.
- Complain to the Israeli Privacy Protection Authority or, if you are in the EU, to your local supervisory authority.
How to exercise your rights: email privacy@momentli.co.il. To help us find the data, please state the Event name and the phone number or email address you used. We may ask you to verify your identity. We will respond within 30 days, unless the law allows a longer period, in which case we will let you know.
Where we process Event Content on behalf of a Host, we may refer your request to the Host or handle it in coordination with them, but we will always act on requests to delete your face data and on requests concerning inappropriate content.
11. Children
The Service is not directed at children under 16, and we do not knowingly collect data from them without the consent of a parent or guardian. Minors may appear in photos that Guests upload at family events. A parent or guardian may ask us to remove photos of a minor or face data of a minor by writing to privacy@momentli.co.il, and we will handle such requests as a priority.
12. Cookies
We use cookies that are strictly necessary for the Service to work, and, only with your consent, analytics and marketing cookies. Full details are in the Cookie Policy. You can change your choice at any time via the “Cookie settings” link in the website footer.
13. Direct marketing
We send marketing messages (such as newsletters or offers) only to people who have given explicit consent, in accordance with section 30A of the Israeli Communications (Telecommunications and Broadcasting) Law, 5742-1982. You can unsubscribe at any time using the link in the message or by writing to privacy@momentli.co.il. Service messages, such as the SMS with the link to your photos, are not marketing messages.
14. California residents (CCPA/CPRA)
If you are a California resident, you have additional rights:
- Categories of personal information we collect: identifiers (name, email address, phone number, IP address); personal information such as photos; biometric information (face vectors); and internet activity information (usage data, with consent). We do not create profiles or inferences about you. Sources, purposes and recipients are described in sections 4 to 6.
- Sensitive personal information: we use biometric information only to provide the face-matching service the Guest requested, and not to infer characteristics about anyone.
- We do not sell personal information. We do not share personal information for cross-context behavioral advertising, except through the Meta Pixel on our marketing website, which runs only if you consent to marketing cookies. You have the right to opt out of such sharing at any time through the “Cookie settings” link in the website footer.
- Your rights: to know and access, to delete, to correct, to limit the use of sensitive personal information, and to opt out of sale or sharing. We will not discriminate against you for exercising these rights. You may submit a request, or have an authorized agent submit one, to privacy@momentli.co.il.
15. US state biometric privacy laws
Laws in some US states, including the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI) and Washington’s biometric identifiers law, impose special requirements on the collection of biometric identifiers. We give written notice and obtain explicit consent before processing a Guest’s selfie, we do not sell, lease, trade or otherwise profit from biometric data, and we destroy it according to a published schedule. Full details are in the Face Recognition and Biometric Data Policy.
16. Changes to this policy
We may update this policy from time to time. The updated version will be published on this page with an updated date. For material changes, we will notify Hosts by email or through the Service, and, where required by law, we will ask for new consent.
17. Contact us
Ovis, company / ID number [COMPANY / ID NUMBER] [REGISTERED ADDRESS]
- Privacy matters and rights requests: privacy@momentli.co.il
- General support: support@momentli.co.il