Legal

Privacy Rights

Last updated: July 13, 2026

Privacy rights requests

ILY provides a process for exercising rights available under the European Union General Data Protection Regulation, the UK GDPR, and other applicable privacy laws.

Depending on the law that applies and the circumstances of the request, you may have the right to:

Access personal data relating to you
Receive a portable copy of eligible personal data
Correct inaccurate or incomplete personal data
Request deletion of personal data
Request restriction of certain processing
Object to certain processing
Withdraw consent where processing is based on consent
Receive information about how your personal data is processed

These rights are not absolute and may be limited where necessary to protect another person’s rights, comply with law, maintain security, prevent fraud, or establish, exercise, or defend legal claims.

You do not need to use the words “GDPR”, “data portability”, or any other specific legal wording. A request that clearly asks for access to, deletion of, correction of, or a copy of personal data will be reviewed as a privacy rights request where applicable.

Enhanced identity verification

Privacy requests submitted by email are initiated outside the authenticated ILY application. A complete privacy export may contain highly sensitive family photos, videos, private messages, children’s information, account records, dates, locations, and information relating to other family members.

For this reason, ILY requires an enhanced identity and authority verification process before releasing a complete or high-risk privacy export. Verification may include signing in to the relevant ILY account, re-authentication, confirmation through the registered email or phone, a one-time code, confirmation from a trusted device, government-issued photo ID where reasonably necessary, evidence of parental responsibility or other legal authority, and confirmation of authority for shared family accounts.

For a complete media export initiated outside the authenticated application, government-issued photo identification will ordinarily be required in addition to account verification unless an alternative method provides an equivalent level of assurance.

ILY will request only information reasonably necessary to verify identity and authority. Identification documents must be submitted through a secure method and should be deleted promptly after verification unless continued retention is legally required or reasonably necessary to resolve a security or legal dispute. If ILY cannot reasonably verify the requester’s identity or authority, ILY will not release the requested data.

Shared family accounts

ILY accounts may contain information uploaded or created by several family members. A privacy request from one member does not automatically entitle that person to receive every item in the shared family account.

Before releasing shared data, ILY may:

Determine which member uploaded or created particular content
Confirm the requester’s account role and permissions
Protect the privacy and rights of other adults and children
Request authorization from other account members
Redact, separate, or exclude information relating primarily to another person
Limit an export to the requester’s eligible personal data
Require proof of authority for requests involving a child or represented person

Being the family administrator does not automatically provide an unrestricted legal right to every family member’s personal data.

What may be included

The scope of the response depends on the request, the applicable right, the legal basis for processing, and the rights of other people. A response may include account and profile information, family membership and permissions, eligible photos and videos, captions, comments, reactions, messages, calendar records, metadata, album structure, privacy choices and consent records, a machine-readable manifest, and other eligible personal data associated with the requester.

Where an original photo or video is within the valid scope of the request, ILY will normally provide the original uploaded file or another appropriate and usable copy, subject to lawful limitations and the rights of other people.

The response does not necessarily include every internal business record, fraud-prevention record, confidential security record, inferred result, derived analytics record, or data belonging primarily to another person.

Delivery method

After identity and authority verification, ILY will provide a secure download pathway for the personal data the requester is legally entitled to receive. Depending on the size and nature of the request, data may be supplied in multiple download batches, media and metadata may be delivered separately, the official ILY desktop application may be required, a single ZIP archive is not guaranteed, and secure links or credentials may expire. The requester will be informed of the download availability period when the export is issued.

The privacy rights download pathway is separate from ILY’s optional paid managed full-account backup service.

GDPR requests

GDPR requests and other applicable privacy rights requests are handled under applicable law. Where permitted, ILY may charge a reasonable administrative fee or refuse to act on requests that are manifestly unfounded or excessive, particularly where repetitive.

Response time

ILY will acknowledge the request and may ask for information reasonably necessary to identify the requester, confirm authority, clarify the request, or locate the relevant data.

ILY generally responds without undue delay and within one month after receiving the request and the information reasonably necessary to verify and process it. Where permitted by applicable law, a complex or numerous request may require an extension of up to two additional months. ILY will notify the requester within the initial response period if an extension is required and will explain the reason.

Requests made for another person

A requester acting for another person may be required to provide written authorization, proof of parental responsibility or guardianship, a power of attorney, executor or estate documentation, identity verification for the requester and represented person, and other evidence reasonably necessary to establish authority. Requests involving children will be reviewed carefully to protect the child’s interests and the rights of other family members.

Security review

For a complete or high-risk export, ILY may send alerts to the registered account email and trusted devices, notify the family administrator or affected members where appropriate, apply a reasonable security review period, and pause release where account takeover, impersonation, or conflicting ownership claims are suspected. Security procedures must not be used to unnecessarily delay or obstruct a valid privacy request.

Refused or limited requests

Where ILY refuses or limits all or part of a request, ILY will normally explain the reason for the decision, any additional information required, whether another person’s rights affect disclosure, the available method for challenging the decision, and the right to complain to an applicable supervisory authority.

Managed full-account backup

ILY offers an optional paid managed full-account backup and export service through the official ILY desktop application. This is a commercial convenience and support service that is separate from a valid statutory privacy rights request.

The managed service may include manual account indexing and preparation, full-library processing, persistent pause and resume, automatic retry of failed files, verification of downloaded files, organized folders and metadata, support for writing directly to an external drive, integrity checks, and human review. Fee depends on library size. Organized downloads use the folder structure {YYYY}/{MM}/{DD-HASH}.

Contact

Submit privacy rights requests, questions, or complaints to gdpr@ily.chat. Where applicable, you may also lodge a complaint with the data protection authority in the country where you live, work, or believe an infringement occurred.