Privacy Policy — Etherstone

DRAFT — PENDING LEGAL REVIEW — NOT FOR PRODUCTION This policy is placeholder text. It has NOT been reviewed by a lawyer, is not a complete description of our data practices, and must be replaced by counsel before launch. It is published now so the consent-capture machinery can be built. 1. What we hold - Account data: your email address, display name, and role. - Memorial content: biographical details of the deceased, photographs, video, audio, written memories, and family relationships — supplied by funeral homes and families. - Operational records: sign-in events, consent records, and an audit log of administrative actions. 2. Why we hold it To operate memorial pages, to let families manage them, to let funeral homes administer the memorials they created, and to keep records of consent and of administrative actions. 3. Public versus private A memorial is only publicly visible when it is published. Families control which sections are public. Family-only media is stored separately and served through short-lived signed links rather than public URLs. 4. Sharing We use Supabase (database, authentication, file storage), Vercel (hosting), and Resend (email delivery). We do not sell personal data. 5. Retention Deleted media is recoverable for 30 days, then permanently removed. Records of consent are retained after account deletion so that consent given can still be evidenced — this is a deliberate choice and is one of the specific points counsel must review. 6. Your rights Depending on where you live you may have rights to access, correct, or delete personal data we hold about you. Contact support@etherstone.net. 7. Contact support@etherstone.net