Privacy Policy

1. Information We Collect

• Personal Information: Your name, email address, and phone number, together with payment details that are handled by trusted outside processors such as Stripe, whenever you register an account or complete a purchase.
• Fundraiser Data: Should you start or give to a Memorial Fundraiser, we and our payment processor Stripe gather what is needed to handle donations and payouts. From donors, we collect your name and email address at checkout, the amount you give, and whether you chose to give anonymously. Unless you gave anonymously, your name and donation amount appear publicly on the memorial. Your email address is never displayed publicly, and organizers do not see donor email addresses in the Service today; we use it to send receipts and to process refunds. For organizers, the identity and bank information that payouts require, meaning your Social Security number, date of birth, photo ID, and bank account details, is collected directly by Stripe under Stripe's own privacy policy. LoveKept does not store your Social Security number, identity documents, or bank account numbers. LoveKept retains only your verification status, your payout state, and an opaque bank-account fingerprint used for fraud prevention. LoveKept does not receive or keep organizer bank details beyond that fingerprint, and that applies to our internal system logs as well. Section 15 of our Fundraising Terms covers donor information and privacy in more detail.
• Memorial Content: The photographs, video, obituaries, guestbook messages, and other tributes you choose to add to a memorial page. Unless you change this, memorial pages can be seen by anyone.
• Usage Data: Technical signals your device sends automatically, including your IP address, browser and operating system, device characteristics, the page that referred you, and the pages you open. To learn how the platform is used and to make it faster, we rely on PostHog for product analytics and Google Tag Manager for event tracking.
• Drafting Tool Data: When you turn to our assisted writing features, such as the obituary writer, we work with whatever information you supply as the prompt. The drafts these tools return come from outside technology partners and may be saved as part of your memorial content.
• Sensitive Data Disclaimer: When you build a memorial or publish tributes, stories, or obituaries, you expressly consent to the public processing of any sensitive personal data you decide to include, for instance a person's health history, religious beliefs, or political opinions. You confirm that you are entitled to share that information and accept that it will be openly accessible.

2. Cookies and Tracking Technologies

To run, protect, measure, and refine the Service, we use cookies and comparable tools, browser local storage among them. A cookie is simply a small file saved to your device when you arrive at our site.

• Strictly Necessary: Needed for the Service to work at all, for example keeping you signed in and managing your session through our provider Supabase, routing and protecting requests through our host Vercel, and remembering the cookie preference you set. These cannot be switched off.
• Analytics (consent-gated): Placed by PostHog, and where we have enabled them Google Tag Manager, Google Ads, and Reddit Ads, to show us how the Service is used so we can improve it. Analytics load only where permission allows, as described below.

If your browser's time zone suggests you are probably in the European Economic Area or the United Kingdom, we present a cookie banner and hold back every analytics cookie until you select "Accept." Choosing "Reject" means no analytics cookies load. Visitors in other regions may have analytics enabled by default and can opt out whenever they wish through their browser controls. We store your selection in your browser so that we can respect it.

Your browser settings also let you block or clear cookies, though turning off the strictly necessary ones may stop you from signing in or using key features. We work to meet the cookie consent rules that apply to us, including the GDPR and the ePrivacy Directive for people in the European Economic Area and the United Kingdom. Our Cookie Policy lists in full the cookies and storage we rely on and how to adjust your choices.

3. How We Use Your Information

• Running our memorial services, keeping them working, and improving them over time.
• Completing your transactions and sending order confirmations.
• Reaching out about your account, product updates, or the help you have requested.
• Delivering memorial digest emails when you have subscribed to a memorial's updates.
• Producing draft content at your request, such as obituary drafts.
• Reviewing content so that it stays within our Terms of Service.
• Watching over the security and integrity of the platform.
• Meeting our legal obligations.

4. Data Sharing and Disclosure

• Service Providers (Subprocessors): Some of your data goes to vetted outside vendors that help us run the Service: payments (Stripe, and, for flower orders, Authorize.net, the payment processor used by our flower partner Florist One, which receives the card details you enter directly from your browser); our database, authentication, and file storage (Supabase); site hosting and delivery (Vercel); transactional email (Resend); product analytics (PostHog), plus Google Tag Manager, Google Analytics, Google Ads, and Reddit Ads where we have enabled them; flower fulfillment (Florist One); tree planting fulfillment (1ClickImpact); and the assisted generation and moderation of content, including obituary drafting and content review (Google's Gemini API and OpenAI, which receive the input you provide). Contracts require these providers to safeguard your data and to use it solely in performing work for us.
• Legal Requirements: We may hand over information where the law, a subpoena, a court order, or another legal process compels us, or where doing so protects the safety, rights, or property of LoveKept or other people.
• Business Transfers: Should we undergo a merger, acquisition, restructuring, or a sale of all or substantially all of our assets, user information may pass along as part of that transaction. Before your personal information falls under a different privacy policy, we will tell you by email or through a clear notice on the Service.
• No Sale or Sharing for Advertising: We never sell your personal data, and we do not disclose it to outside parties for cross-context behavioral advertising or tracking.
• Protection of Memorial Authors: We guard our users' privacy closely. We will not reveal a memorial author's identity, email address, or other personal information to anyone who asks, whether an individual or a third party, unless the author has clearly authorized it or a valid legal process such as a court order or subpoena requires it.
• Fundraiser Payouts: Where Memorial Fundraisers are concerned, we share donation and organizer information with our payment processor Stripe, using Stripe Connect, so that donations can be processed, required identity verification can run, and payouts can reach organizer-controlled connected accounts. Stripe collects organizer identity and bank-account information directly. Donor names and donation amounts appear on the memorial as Section 1 describes; donor email addresses are used for receipts and refund processing and are never displayed publicly.

5. Data Retention

So that a loved one's legacy endures, we keep memorial data indefinitely unless the account holder or an authorized family member asks us to remove it. Account and transaction records are held for as long as our legal and accounting obligations require. When an account is closed, we handle your data as set out in Section 12 of our Terms of Service.

If you use Memorial Fundraisers, records of donations, refunds, payouts, and identity-verification outcomes are kept for as long as tax, accounting, anti-fraud, and other legal obligations require, even after the related account or memorial is deleted. The identity and bank information that Stripe collects directly is retained under Stripe's own policies.

6. Security

We protect your data with widely used safeguards, among them SSL/TLS encryption, hardened servers, and access controls. Even so, no way of sending information across the Internet or storing it electronically is completely secure, and we cannot promise absolute security.

If a breach ever affects your personal information, we will notify you and the relevant regulators to the extent the law requires, and take commercially reasonable steps to limit the impact.

7. Your Rights and Choices

• Access and Correction: From your account settings you can view and change certain details, such as your email address and password. If you own a memorial, you can edit its content yourself and delete it from your dashboard.
• Deletion: To have your account and its personal data deleted, email support@lovekept.co from the address tied to your account so that we can confirm it is you. We aim to reply within thirty (30) days. Bear in mind that material others have posted in public areas, such as guestbook entries, and anything we must keep for legal, accounting, or security reasons may remain as Section 5 describes, and memorials may be kept in a read-only state as explained in our Terms of Service.
• Data Export and Portability: You can ask for a copy of your personal data in a structured, commonly used format by writing to support@lovekept.co from your account email address. Once we have confirmed your identity, we respond within thirty (30) days. For now, our support team processes export and deletion requests by hand rather than through an automated in-app tool.
• Cookies: Your browser settings let you control or switch off cookies. Section 2 covers this in more detail.
• Marketing Communications: To stop promotional emails, follow the "unsubscribe" instructions in any message we send, and you may leave memorial digest emails at any time. Note that opting out of marketing does not end the transactional messages about your account, such as payment receipts or security updates, which will still reach you.

8. Children's Privacy

The Service is meant for adults and is not designed for anyone under the age of 18, and we do not knowingly gather personal information from people in that age group. If we learn that we have collected such information from someone under 18, we delete it without delay. Should you believe a person under 18 has given us personal information, please write to us at support@lovekept.co.

9. California Privacy Rights

California residents hold specific rights under the California Consumer Privacy Act and the California Privacy Rights Act (CCPA/CPRA). These include:

• The right to know what personal information we collect, use, and disclose;
• The right to request deletion of your personal information;
• The right to opt out of the sale or sharing of personal information (we do not sell or share your data for advertising);
• The right to non-discrimination for exercising your privacy rights.

To use any of these rights, contact us at support@lovekept.co. We confirm your identity before acting on a request and respond within the periods the law sets.

10. Rights for Users in Europe and the UK

If you are in the European Economic Area (EEA) or the United Kingdom (UK), you hold specific rights under the General Data Protection Regulation (GDPR) and the UK GDPR:

• Legal Basis for Processing: Our processing rests on: (a) contractual necessity, to deliver the memorial services you request; (b) consent, for the sensitive data you choose to include in memorial content and for non-essential cookies; and (c) legitimate interests, to secure, improve, and market our platform where those interests are not overridden by your data protection rights.
• Your Rights: You may request access to your personal data, correct inaccuracies, ask for erasure (the "right to be forgotten"), restrict processing, object to processing we base on legitimate interests, and receive your data in a portable, machine-readable format.
• Withdrawal of Consent: Where consent is our basis for processing, you can withdraw it at any time. Withdrawal does not affect the lawfulness of any processing carried out before you withdrew.
• Complaints: If you believe your rights have been violated, you may lodge a complaint with your local data protection supervisory authority.

11. International Data Transfers

LoveKept is based in the United States. When you reach the Service from another country, your information may be sent to, held, and processed here, under data protection laws that can differ from those where you live. For personal data moving from the EEA or the UK to the United States, we depend on the appropriate legal safeguards, including the European Commission's Standard Contractual Clauses where they are required, to keep your data adequately protected. By using the Service, you consent to your information being transferred to the United States and to the other jurisdictions where we or our service providers operate.

12. Changes to This Policy

This Privacy Policy may change from time to time. When a change is material, we give at least thirty (30) days' advance notice, either by email to your registered account address or through a prominent notice on the Service. The current version always appears on this page with an updated effective date. Continuing to use the Service after a change takes effect means you accept the revised Privacy Policy.

13. Governing Law

This Privacy Policy is governed by and construed under the laws of the State of Delaware, United States, without regard to its conflict of law provisions, in keeping with our Terms of Service.

14. Contact Us

For questions about this Privacy Policy, or to exercise any of your rights, reach us here:

Email: support@lovekept.co

Operator: Albatross Ecommerce LLC