Privacy

A Legacy Beyond operates alegacybeyond.com and provides online memorials and personalised memorial emblems. The organisation is responsible for deciding how personal information is used. You can contact us at info@alegacybeyond.com.

This policy applies to customers, memorial administrators, family and friend contributors, people who contact support and visitors to our website. Memories may include information about living people shown or mentioned in photos, films, recordings and stories. UK data protection rights may apply to those living people even where the memorial commemorates someone who has died.

We collect account identifiers and email addresses; names where supplied; purchases, fulfilment and delivery details; memorial settings and submitted stories, photographs, videos and recordings; contributor display names and stated relationship to the deceased; optional contributor email addresses; support requests and complaints; and technical information reasonably needed for security and the operation of the service. Payment processing is provided by Stripe. ALB does not intend to store complete payment card numbers.

Guest contributors do not need accounts. They must enter a display name, which can be “Anonymous”, and the relationship field used by the memorial. Providing an email address is optional. Contact details are not ordinarily visible to memorial administrators or memorial visitors. Administrators can see a submitted contribution, the display name and stated relationship. All contributions are subject to administrator approval. Without a verified email, we may need further evidence before changing or removing a contribution.

We process customer and fulfilment information where necessary to perform our contract. We process tax and accounting records where necessary to comply with legal obligations. We use information for service security, fraud prevention, support, respectful moderation and protection of people's rights where supported by legitimate interests, subject to a balancing assessment. Certain processing may require consent or another lawful basis in the particular circumstances, including children's information or sensitive personal information included in memorial content.

An administrator chooses whether a memorial is public or protected by a four-digit PIN. Public content may be viewed and copied by others and may appear in search engine results. PIN-protected content is intended for people with the PIN; recipients may share it. We take reasonable steps to prevent search indexing of private memorial content, though third parties may retain earlier results or copies. Submitted memories are not published until approved.

We send necessary messages such as sign-in information, purchase confirmations, service updates, administrator notifications and replies to support requests. Marketing emails, if introduced, will be handled separately under the applicable consent or other electronic marketing rules. A contributor's optional email is not used to give an administrator direct access to their contact details.

We use Vercel Web Analytics for website usage measurement. It sets no analytics cookies. Essential session or authentication cookies may be used to keep account holders signed in.

The principal production platform uses Vercel and Supabase in London regions. Service providers include Stripe for payment processing, Resend for email, Vercel for hosting and analytics, and Supabase for data and media storage. Some processing, support access, logs or backups may take place outside the UK. Where UK personal data is transferred internationally, ALB will identify the transfer mechanism and required safeguards.

Published memorial material is held for the lifetime of the memorial service, subject to lawful deletion, service closure and the published memorial arrangements. Unapproved memories may be deleted twelve months after submission. Purchase and accounting records are kept for six years, as tax law requires.

When a verified administrator asks us to delete a memorial, it goes offline at once and is removed permanently after 30 days, during which the request can be cancelled. A contributor's optional email address is cleared after 90 days, and the hashed network addresses we keep to prevent abuse after 30 days. Notifications and the contact details of people who report content are deleted after twelve months.

A verified administrator can export the memorial as a ZIP containing the life story, written contributions and uploaded photos, videos and voice recordings. A verified administrator may request permanent deletion of the entire memorial. We explain the consequences and provide an export opportunity. Removal from the live service does not necessarily erase all legally retained records or temporary backups immediately. Individual contributors may contact us about removing or correcting their own material, subject to verifying entitlement and the rights of others.

ALB permits age-appropriate participation by children, with parental or guardian involvement where required and adult responsibility for paid purchases. We take account of children's privacy and safety, including careful handling of their images and recordings.

Depending on the circumstances, individuals may have rights to be informed, access their personal information, request correction or erasure, ask for processing to be restricted, object to particular processing, and request portability. Where we rely on consent, it may be withdrawn. Rights can have legal limits and may require verification. To make a request, email info@alegacybeyond.com. You may complain directly to the Information Commissioner's Office at ico.org.uk without contacting us first.

We will update this notice when our practices materially change. The publication date will appear at the top, and we will provide additional notice where required.