Privacy Policy

1. Information we collect

• Account information. Your name, email address, telephone number where you choose to provide one, and payment details (handled by our payment processor, Stripe) when you create an account or make a purchase.
• Memorial content. Photographs, video, written tributes, stories, guestbook entries, and any other media you choose to upload to a memorial. Memorials are public by default.
• Usage information. Technical data such as IP address, browser type, device, operating system, referring URL, and pages visited. We use product analytics tools to understand how the Service is used and to improve it.
• Drafting input. Where you use a feature that helps draft an memorial or other text, we process the material you supply as input. Generated drafts may then be stored as part of the memorial you are working on.
• Sensitive material.By creating a memorial or contributing to one, you consent to the public processing of any sensitive personal information you choose to include, for example, the deceased’s health, religion, or political views. You confirm that you have the right to share that information and accept that it will be visible to the public.

2. Cookies and similar technologies

We use cookies and similar technologies to operate, analyse, and improve the Service. Cookies are small files placed on your device when you visit our site.

• Essential cookies. Required for the Service to work, for example, to keep you signed in. These cannot be disabled.
• Analytics cookies. Help us understand how the Service is used and where it can be improved.
• Preference cookies. Remember your settings (such as theme or language).

You can manage or disable non-essential cookies through your browser. Disabling some cookies may affect how the Service behaves. We comply with applicable cookie consent requirements, including those under the GDPR and ePrivacy Directive for users in the European Economic Area and the United Kingdom.

3. How we use information

• To publish, operate, and improve our memorial services.
• To process payments and send order confirmations.
• To respond to your account, support, or correction requests.
• To send memorial digest emails to those who have subscribed to a memorial.
• To generate drafted content where you ask for it.
• To moderate content for compliance with our Terms & Conditions.
• To monitor the integrity and security of the Service.
• To meet legal obligations.

4. Sharing and disclosure

• Service providers. We share information with vendors who help us run the Service, including our payment processor (Stripe), hosting and database providers (Vercel, Supabase), email delivery provider, analytics provider, content-processing technology providers, and reforestation partner. Each is bound by confidentiality and may use the data only to perform their service.
• Legal process. We may disclose information where required by law, subpoena, court order, or other legal process, or to protect the safety, rights, or property of TributeOak or others.
• Corporate transactions. In a merger, acquisition, reorganisation, or sale of all or substantially all of our assets, account information may be transferred as a business asset. We will notify you by email or prominent notice on the Service before your information becomes subject to a different privacy policy.
• No sale, no advertising shares. We do not sell your personal information. We do not share it for cross-context behavioural advertising.
• Memorial authors. We will not disclose the identity, email, or other personal information of a memorial author to a third party unless the author has authorised it or a valid legal process requires it.

5. How long we keep information

Memorials are intended to last. Unless the account holder or an authorised family member asks us to remove a memorial, it may remain published indefinitely. Account and transaction data are retained as long as needed to meet legal and accounting obligations. On account closure, your data is handled in line with the termination provisions of our Terms & Conditions.

6. Security

We use industry-standard measures to protect your data, including encryption in transit (SSL/TLS), secure infrastructure, and access controls. No method of transmission or storage is entirely secure, and we cannot guarantee absolute security.

If a data breach affects your personal information we will notify you and any applicable regulator as required by law, and take commercially reasonable steps to mitigate the impact.

7. Your rights and choices

• Access and correction. You may view and update your profile information from your account settings.
• Deletion. You may request the deletion of your account or specific data by writing to support@tributeoak.com.
• Portability. You may request a copy of your personal information in a structured, commonly-used format.
• Cookies. You may manage cookies through your browser settings (see Section 2).
• Email preferences. You can unsubscribe from promotional emails or memorial digests using the link in any such email. Transactional emails (receipts, account notices) will continue while your account is active.

8. Children

The Service is not directed to children under 18, and we do not knowingly collect information from anyone under 18. If we learn that we have collected information from a person under 18, we will delete it promptly. If you believe a child has provided us with information, please write to support@tributeoak.com.

9. California residents

Residents of California have specific rights under the California Consumer Privacy Act and the California Privacy Rights Act (CCPA/CPRA), including:

• the right to know what personal information we collect, use, and disclose;
• the right to request deletion of your personal information;
• the right to opt out of the sale or sharing of personal information (we do not sell or share for advertising); and
• the right to non-discrimination for exercising your privacy rights.

To exercise these rights, write to support@tributeoak.com. We will verify your identity before responding and reply within the timeframes required by law.

10. Users in Europe and the UK

If you are in the European Economic Area (EEA) or the United Kingdom, you have specific rights under the General Data Protection Regulation (GDPR) and UK GDPR.

• Legal basis for processing. We process your personal data on the basis of (a) contractual necessity (to provide the memorial services you request); (b) consent (for sensitive material you choose to include and for non-essential cookies); and (c) legitimate interests (to secure, improve, and promote the Service, where those interests are not overridden by your rights).
• Your rights.You may request access to your personal data, correct inaccuracies, request deletion (the “right to be forgotten”), restrict processing, object to processing based on legitimate interests, and receive your data in a portable, machine-readable form.
• Withdrawal of consent. Where we process on the basis of consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Complaints. You have the right to lodge a complaint with your local data-protection supervisory authority if you believe your rights have been breached.

11. International transfers

TributeOak operates from the United States. If you access the Service from outside the U.S., your information may be transferred to, stored, and processed in the U.S., where data protection laws may differ from those of your country. Where we transfer personal data from the EEA or the UK to the U.S., we rely on appropriate legal mechanisms to ensure adequate protection, including the European Commission’s Standard Contractual Clauses where required. By using the Service, you consent to these transfers.

12. Changes to this policy

We may update this policy from time to time. For material changes we will give at least thirty (30) days’ advance notice by email or prominent notice on the Service. The current version is always posted on this page with an updated effective date. Continued use of the Service after the effective date is acceptance of the revised policy.

13. Governing law

This Privacy Policy is governed by the laws of the State of Delaware, United States, without regard to its conflict-of-law rules, consistent with our Terms & Conditions.

14. Contact

Questions about this policy, or about information we hold about you, can be sent to support@tributeoak.com.

Operator: Albatross eCommerce LLC