Privacy Policy

1. Who is responsible for your data

Origin Moment is operated by the legal seller identified on the Website.

Where applicable data-protection law uses the term “controller”, Origin Moment is the controller responsible for deciding why and how personal data are processed, unless another party is expressly identified as an independent controller.

Controller

Individual Entrepreneur MKRTICH MARTIROSYAN MNATSAKAN

Business phone

+374 91 258 488

Privacy contact

[email protected]

2. Information you provide to create an Origin Moment

Depending on the product, we may process information such as:

Birthday:

• name;
• date of birth;
• selected city or location;
• associated geographic information required to create the product.

Wedding:

• names of the partners;
• wedding date;
• wedding city or location;
• partner birth dates where provided;
• associated geographic information required to create the product.

Gift Mode:

• giver's name;
• personal gift message.

Please do not include medical information, political beliefs, religious beliefs, sexual information, identification-document information or other sensitive personal information in a Gift Message.

Origin Moment does not need this information to provide the service.

3. Location information

Origin Moment asks you to select a city or location relevant to the Origin Moment.

We do not require your device's precise GPS location to create the product.

The selected location may include:

• city;
• country;
• region;
• geographic coordinates;
• time zone;
• GeoNames identifier;
• localized place names.

These data are used to create accurate astronomy, location presentation and other personalized content.

When you use location search, the search request may be sent to GeoNames. Because the request is made through an internet connection, GeoNames may also receive ordinary connection information such as the requesting IP address.

4. Order and certificate information

When you create an order or an Origin Moment is issued, we may create and store operational information such as:

• Order ID;
• Certificate ID;
• product type;
• price and currency;
• promotion information where applicable;
• payment and fulfillment status;
• creation and issuance timestamps;
• personalized digital snapshot associated with the order;
• QR / Time Capsule identifiers;
• technical records necessary to maintain the issued product.

An issued Origin Moment is intentionally based on a frozen snapshot so that its certificate, PDF and associated digital content remain consistent with what was issued.

5. Recovery email

Providing a recovery email is optional.

If you choose to enable email recovery, we process your email address to:

• verify the address;
• send security links;
• restore owner access where requested;
• protect the recovery system against abuse.

The email address is protected in storage using cryptographic techniques. Origin Moment also stores a derived hash used for secure lookup and rate limiting.

Recovery and verification emails are currently delivered through Zoho CPaaS / Transactional Email.

Open and click tracking are disabled for Origin Moment recovery emails.

We do not use a recovery email for marketing merely because it was provided for account recovery.

6. Owner access and security credentials

Origin Moment does not require a traditional customer account.

Instead, access may be protected using:

• private owner links;
• Recovery Codes;
• secure owner sessions;
• Certificate IDs combined with appropriate credentials;
• verified recovery email;
• limited-duration recovery links.

Private credentials are not intended to be public.

Where appropriate, credentials are stored as cryptographic hashes or encrypted values rather than directly readable credentials.

7. Cookies

Origin Moment currently uses cookies that are necessary for security and access functionality.

For example, after owner access is successfully established, the Website may set the secure cookie:

__Host-om_owner

This cookie:

• is used to recognize an authorized owner session;
• is HttpOnly;
• is Secure;
• uses SameSite protection;
• may remain valid for up to approximately 180 days unless it expires or is invalidated earlier.

Separate strictly necessary security cookies may be used for internal administrative access.

Origin Moment currently does not use advertising cookies or third-party behavioural tracking cookies.

According to Cloudflare, Cloudflare Web Analytics does not use analytics cookies or browser storage. Section 20 explains the information processed by this service.

Before introducing additional analytics or advertising technologies, we will update this Policy and obtain consent or provide other controls where legally required.

8. Technical and security information

When you use a website, certain technical information is necessarily processed by hosting, network and security systems.

This may include:

• IP address;
• request time;
• browser or device information;
• requested URL;
• HTTP headers;
• network and security information;
• error or service-delivery information.

Origin Moment may use this information to:

• deliver the Website;
• protect the service;
• prevent fraud or abuse;
• enforce rate limits;
• investigate security incidents;
• maintain reliability.

For certain Origin Moment security functions, a network address may be transformed into a cryptographic hash before being stored for rate-limiting or security purposes.

9. Public QR codes and Time Capsules

A final Origin Moment may contain a public QR code linked to a digital Time Capsule.

Anyone who receives the QR code or its public URL may be able to view the public content associated with that Origin Moment.

The public Time Capsule may include information intended to form part of the keepsake, such as:

• name or names;
• date of birth for Birthday products or wedding date for Wedding products;
• city or place;
• astronomical content;
• historical content;
• other public certificate or Time Capsule information.

The public QR does not provide private owner access.

The public content may also include the giver's name, gift message and partner birth dates included in a Wedding certificate. Personalization details included in a certificate may be made available to the browser when its public QR code or URL is opened, even when the Time Capsule page does not display them. Recipients may share the certificate, images of it, and its public QR code or URL with other people.

Customers should review the product before sharing it and understand that information intentionally contained in a public certificate or Time Capsule may be viewed by anyone who obtains the corresponding QR code or URL.

10. Sharing your certificate

Origin Moment may allow an owner to share the final certificate through device or operating-system sharing functions.

Sharing is voluntary.

When you share the final certificate, information visible on the certificate and its permanent public QR may become available to:

• people you send it to;
• social networks;
• messaging services;
• storage providers;
• other third-party platforms selected by you.

Those third parties process information under their own privacy policies.

Once a certificate has been copied or published outside Origin Moment, Origin Moment cannot control or revoke copies held by other people or services.

11. Information about other people

You may create an Origin Moment that contains information about another person, for example:

• your partner;
• a family member;
• a child;
• a wedding partner;
• a gift recipient.

If you provide information about another person, you should have a lawful basis or appropriate authority to provide that information.

You should also consider whether making the final certificate or Time Capsule public is appropriate for that person.

Where applicable law imposes additional requirements when personal information is obtained from someone other than the individual concerned, Origin Moment will comply with those requirements.

12. How we use personal information

We process personal information for purposes including:

• creating the requested Birthday or Wedding Origin Moment;
• generating personalized astronomy and location-based content;
• producing the certificate and PDF;
• creating and operating the Time Capsule;
• creating and maintaining orders;
• issuing permanent digital products;
• providing owner access;
• providing optional recovery;
• providing customer support;
• managing corrections and reissues;
• processing authorized promotions or complimentary issuance;
• preventing fraud and abuse;
• securing the Website and owner system;
• complying with applicable legal obligations;
• defending or enforcing legal rights where necessary.

We do not use personal information collected for creating an Origin Moment for unrelated advertising purposes without an appropriate legal basis.

13. Legal bases for processing

The precise legal basis depends on the applicable law and processing activity.

Where Armenian law applies, personal information may be processed where permitted by law, including where information is provided in connection with an agreement and used for the operations contemplated by that agreement.

Where the GDPR applies, legal bases may include:

Performance of a contract or steps requested before entering a contract — for creating, delivering and maintaining the Origin Moment.

Legitimate interests — where necessary and proportionate for security, fraud prevention, service reliability, enforcing rights and protecting the platform.

Legal obligation — where processing is required to comply with accounting, tax, consumer, regulatory or other legal obligations.

Consent — where applicable law requires consent for a specific optional activity.

Where processing relies on consent, you may withdraw consent where the law provides that right. Withdrawal does not make earlier lawful processing unlawful.

14. Automated processing

Origin Moment uses software and algorithms to generate elements of the personalized product, including astronomy, historical selection, formatting and presentation.

These systems are used to create the requested digital keepsake.

Origin Moment does not currently use personal information for solely automated decisions that produce legal effects or similarly significant effects concerning the customer.

15. Service providers

Origin Moment relies on selected third-party service providers to operate the service.

These currently include or may include:

Supabase — database and backend infrastructure.

Railway — application hosting and deployment infrastructure.

Cloudflare — DNS, network delivery, proxy and security infrastructure, and Cloudflare Web Analytics.

GeoNames — geographic place lookup.

Zoho CPaaS / Transactional Email — recovery and verification email delivery.

Wikipedia / Wikimedia infrastructure — source information used to create historical content.

Google Cloud Translation — translation of selected historical prose where required.

Origin Moment limits the information sent to providers according to the function they perform.

The current historical translation flow does not intentionally send customer names, recovery email addresses, owner credentials or full personalized certificates to Google Cloud Translation merely to translate historical text.

16. Payments

Real bank acquiring is not yet active on the Website. Online payment processing is not currently available, and preparing an order does not charge you.

When payment processing is enabled, payment transactions will be handled through the approved acquiring bank, payment processor or digital-wallet provider.

Where card information is entered directly into the payment provider's secure environment, Origin Moment intends not to receive or store full payment-card credentials.

When payment processing is enabled, Origin Moment may receive transaction information necessary to verify payment, such as:

• transaction reference;
• payment provider;
• amount;
• currency;
• payment status;
• related transaction metadata.

This section will be reviewed against the actual bank integration before online payment processing is enabled.

17. International data processing and transfers

Origin Moment is based in the Republic of Armenia and uses service providers located in different jurisdictions.

Our current primary database is hosted by Supabase in Frankfurt, Germany.

Our production application infrastructure is hosted through Railway in the US West region.

Recovery and verification email is delivered through Zoho CPaaS using its United States data center.

Cloudflare provides global network, DNS, proxy, security and website analytics services. Because Cloudflare operates a globally distributed network, technical request data may be processed at data centers in different countries depending on network routing and service operation.

The primary service locations above are not exclusive processing locations. Providers may also process information in other countries for support, security, service operation and content delivery.

Origin Moment will make international transfers only where permitted by applicable data-protection law and will use required safeguards or authorizations where necessary.

Where Armenian law permits transfers to jurisdictions recognized as providing an adequate level of protection, transfers may occur in accordance with that framework.

Where processing would involve a jurisdiction not recognized as providing adequate protection and Armenian law requires prior authorization or additional safeguards, Origin Moment will take the legally required steps before relying on that transfer.

Where the GDPR applies, transfers outside the European Economic Area will rely on a lawful transfer mechanism, such as an adequacy decision, applicable contractual safeguards or another mechanism permitted by law.

18. Data retention

We retain different categories of information for different periods depending on why the information is needed.

Issued Origin Moments:

An issued Origin Moment and its frozen digital snapshot are intended to provide a long-term digital keepsake.

Information necessary to maintain an issued Origin Moment, its Certificate ID, QR identity, Time Capsule and owner functionality may therefore be retained for an extended period while those services are provided.

Long-term retention does not override mandatory rights under applicable data-protection law.

Pending orders:

A pending order may have an operational expiration time. Expiration of the ability to complete an order does not necessarily mean every associated operational record is immediately deleted.

Records may be retained where reasonably necessary for security, fraud prevention, support, accounting, dispute handling or legal compliance.

Owner sessions:

Owner sessions are currently designed to expire after approximately 180 days.

Recovery links:

Email verification and recovery links are designed to expire after approximately 15 minutes and are single-use.

Records indicating that a security challenge was issued, used or expired may be retained longer where reasonably necessary for security and abuse prevention.

Recovery email:

A verified recovery email may be retained while recovery functionality remains enabled for the corresponding Origin Moment.

An owner may remove the recovery email using available owner controls, subject to information that must still be retained for legitimate security or legal purposes.

We will not intentionally retain identifiable personal information longer than necessary for the purpose for which it is processed or as required by law.

19. Security

Origin Moment uses technical and organizational measures designed to protect personal information.

Current measures include, where applicable:

• encrypted protected values;
• hash-only credential verification;
• secure HttpOnly cookies;
• short-lived single-use recovery links;
• access controls;
• server-side authorization;
• restricted service credentials;
• rate limiting;
• immutable issued snapshots;
• separation of public QR access from private owner access;
• measures intended to prevent unauthorized database access.

No internet service can guarantee absolute security.

Customers should keep private owner links, Recovery Codes and access to recovery email accounts confidential.

20. Analytics and advertising

We use Cloudflare Web Analytics to understand visits and improve website performance.

Analytics information includes page views, page hostnames and paths, referring pages, country, device type, browser, operating system and loading performance.

According to Cloudflare, this analytics service does not use cookies, localStorage, sessionStorage or other browser storage, and does not fingerprint visitors.

Cloudflare receives the source IP address to handle an analytics request, discards it at the nearest data center, and does not store it in its RUM core databases or logs. This statement concerns analytics; separate network and security processing is described in Sections 8, 15 and 17.

Analytics information may be processed outside Armenia. Cloudflare states that it retains unsampled analytics for seven days and then a reduced sample for longer-term reporting.

Cloudflare's documentation explains its analytics data processing:

https://developers.cloudflare.com/speed/observatory/rum-beacon/

Cloudflare's Privacy Policy is available here:

https://www.cloudflare.com/privacypolicy/

Origin Moment currently does not:

• sell personal information;
• use third-party advertising cookies;
• perform behavioural advertising;
• build advertising profiles from Origin Moment personalization data.

Before introducing additional analytics or advertising technologies, we will update this Policy and obtain consent or provide other controls where legally required.

21. Children

The purchasing service is intended for adults or persons otherwise legally capable of entering into the relevant contract.

Origin Moment may nevertheless contain information about a child where an adult lawfully provides that information for a Birthday or gift product.

We do not intentionally ask children to create customer accounts or independently enter into paid contracts.

If you believe personal information concerning a child has been provided unlawfully, please contact us.

22. Your privacy rights

Depending on the law that applies to you, you may have rights concerning your personal information.

These may include rights to:

• obtain information about whether and how your data are processed;
• access personal information concerning you;
• correct inaccurate or incomplete data;
• request blocking, restriction or deletion where applicable;
• withdraw consent where processing depends on consent;
• object to certain processing where applicable;
• receive portable data where applicable law provides that right;
• complain to a competent data-protection authority;
• seek judicial or other legal remedies.

These rights are not absolute.

Origin Moment may need to retain certain information where required by law, necessary to establish or defend legal claims, or legitimately necessary to maintain a purchased digital service.

23. Requests concerning personal information

Privacy requests may be submitted through the official Origin Moment contact information published on the Website.

Before providing private information or changing protected owner data, Origin Moment may need to verify that the requester is entitled to make the request.

We will not ask you to publish Recovery Codes, private owner links or other confidential credentials through an insecure public channel.

Requests will be handled within the time required by applicable law.

24. Regulatory complaints

You may have the right to complain to the data-protection authority or other competent authority in your jurisdiction.

This Privacy Policy does not limit any right to seek administrative, regulatory or judicial protection.

25. Changes to this Privacy Policy

Origin Moment may update this Privacy Policy when:

• the product changes;
• providers change;
• new payment infrastructure is introduced;
• analytics or other technologies are introduced;
• legal requirements change;
• additional privacy controls are implemented.

The current version will display its version number and last-updated date.

Material changes affecting ongoing processing will be communicated where required by law.

26. Language

Origin Moment may provide this Privacy Policy in more than one language.

For users in Armenia, legally required privacy information will be made available in Armenian where required.

Translations should preserve the substance of the privacy rights and obligations described in the English version.

27. Contact

Privacy questions and requests may be sent using the official Origin Moment contact information published on the Website.

Website:

https://originmoment.com