Privacy Policy
How Left This World Memorial protects and handles your personal information
Effective Date: October 4, 2025 | Last Updated: August 9, 2026
Our Commitment to Privacy
At Left This World, we understand the deeply personal nature of creating and maintaining digital memorials. We are committed to protecting your privacy and handling your personal information with the utmost care and respect, recognizing that you are entrusting us with some of your most precious memories.
Privacy Summary: We collect only the information necessary to provide our memorial services, we never sell your data, and you have full control over your information and memorials.
Information We Collect
Personal Information
When you create an account, we collect: Name (first and last name), Email address (for account access and important notifications), Password (securely encrypted), Profile photo (optional). Legal Basis: Contract performance and legitimate interests (account security)
Memorial Information
This includes all content you choose to share on memorial pages: Biographical information about deceased individuals, Photos and videos (stored securely with BunnyCDN), Stories, tributes, and guest book posts, Service details and family information, Custom memorial URLs and settings. Legal Basis: Consent and legitimate interests (memorial service provision)
Important: Left This World Memorial Ltd is the data controller for guest information. We decide how long it is kept, how it is protected and when it is deleted, so any question or request about guest data comes to us rather than to the person who created the memorial. If you created the memorial: please do tell the people you invite that you are using Left This World, and that anything they post will be handled as described in this policy. It is good practice and it means nobody is surprised at a difficult time. But the legal responsibility for guest data sits with us, not with you. For guests: when you join a memorial page, your name and email address are visible to the memorial page owner so they can manage who has access. Your tributes and uploaded media are visible on the memorial page. The owner's data export includes anonymous guest summary statistics, such as a total guest count, and never your personal details. You can exercise any of the rights set out in this policy directly with us, without going through the memorial page owner.
Technical Information
To ensure security and improve our services, we collect: IP addresses (for security and approximate location), Browser type and version, Device information (mobile/desktop), Page visits and feature usage, Session data and authentication tokens. Legal Basis: Legitimate interests (service improvement and security)
How We Use Information
We use your information for: Memorial Services (Creating, maintaining, and securing your memorial pages and content), Security & Safety (Protecting your account, preventing fraud, and maintaining service integrity), Service Improvement (Enhancing our services and developing new features to better serve you).
We use your information to:
- To create and manage memorials
- To communicate with you
- To enhance user experience
- Creating and managing memorials
- Communication
- Enhanced user experience
- Memorial Services
- Security & Safety
- Service Improvement
- Send important account and service-related communications
- Deliver subscription confirmations and billing information
- Notify you about memorial page activity (when enabled)
- Send system updates and security alerts
- Provide marketing communications (with your consent)
- Analyze email engagement to improve our communications
- Website analytics and user behavior analysis
- Conversion tracking and subscription optimization
- User experience improvement through usage data
- Providing optional writing assistance when you choose to use it
Legal Basis for Processing
Under UK data protection law (UK GDPR), we must have a lawful basis for processing your personal information. We rely on different legal bases depending on how we use your data:
Consent
When guests submit tributes, photos, or messages to memorial pages, they provide explicit consent for us to process and display their contributions. This consent is freely given and can be withdrawn at any time.
Applies to: Guest submissions, tributes, photos, and messages on memorial pages
Contract
We process subscriber personal information as necessary to fulfil our contractual obligations to provide memorial page services, manage subscriptions, and deliver the features you have paid for.
Applies to: Service delivery, subscription management, account administration
Legitimate Interest
We have a legitimate interest in preventing fraud, improving our services, and ensuring platform security. We carefully balance these interests against your privacy rights.
Applies to: Fraud prevention, service improvement, security measures, analytics
Information Sharing
We share your information with third-party services to provide and improve our services. Additionally, guest information (name and email address) is shared with the memorial page owner who invited you, to enable them to manage access to their memorial page. Guest book posts and uploaded media are visible to all visitors of the memorial page.
Third-Party Service Providers:
BunnyCDN
Purpose: Media Storage
Data Shared: Photos and videos
Privacy Policy: https://bunny.net/privacy
Supabase
Purpose: Database and Authentication
Data Shared: User data
Privacy Policy: https://supabase.com/privacy
Google OAuth
Purpose: Authentication
Data Shared: Authentication data
Privacy Policy: https://policies.google.com/privacy
Brevo (Email Service)
Purpose: Transactional and marketing email delivery
Data Shared: Email addresses, names, email preferences, delivery tracking data
Privacy Policy: https://www.brevo.com/legal/privacypolicy/
Google Analytics 4
Purpose: Website analytics and user behavior tracking
Data Shared: Website usage data, page views, user interactions, session information
Privacy Policy: https://policies.google.com/privacy
Google Tag Manager
Purpose: Tag and analytics management
Data Shared: Website events, user interactions, conversion tracking data
Privacy Policy: https://policies.google.com/privacy
CookieYes
Purpose: Cookie consent management and compliance
Data Shared: Cookie consent preferences, user choices, compliance records
Privacy Policy: https://www.cookieyes.com/privacy-policy/
Vercel
Purpose: Website hosting, analytics, and performance monitoring
Data Shared: IP addresses, page views, web vitals performance metrics, request metadata, user agent information
Privacy Policy: https://vercel.com/legal/privacy-policy
Sentry
Purpose: Error monitoring and session replay for debugging
Data Shared: Error data, browser information, session replays of user interactions, console logs, device information
Privacy Policy: https://sentry.io/privacy/
Vercel AI Gateway
Purpose: Routing writing-assistance requests to an AI provider
Data Shared: The text you enter when you use a writing-assistance feature, and the draft returned to you. Not retained after the request completes.
Privacy Policy: https://vercel.com/legal/privacy-policy
Anthropic
Purpose: AI writing assistance (sub-processor of Vercel AI Gateway)
Data Shared: The same text, for the sole purpose of returning a suggested draft. Not used to train AI models.
Privacy Policy: https://www.anthropic.com/legal/privacy
Cloudflare Turnstile
Purpose: Checking that a person, rather than an automated script, is using the guest invitation page and the contact form
Data Shared: IP address, browser and device characteristics, and interaction signals from the page where the check runs. Not used to build a profile of you or to track you between sites.
Privacy Policy: https://www.cloudflare.com/privacypolicy/
Writing Assistance and Artificial Intelligence
Some parts of the site offer to help you write — a biography, a eulogy, a message of condolence. Writing about someone you have lost is hard, and these features exist to help you make a start, not to write it for you. They are optional and only ever run when you choose to use them.
When you use one of these features, the text you have entered is sent to Vercel's AI Gateway, which passes it to an artificial intelligence provider (currently Anthropic) and returns a suggested draft. Vercel acts as our data processor and Anthropic as its sub-processor. Both operate in the United States, and the transfer is covered by the safeguards described under International Data Transfers.
- •Nothing is sent unless you choose to use one of these features.
- •What comes back is a draft. You decide whether to keep it, change it, or discard it — nothing is ever published on your behalf.
- •Artificial intelligence is never used to make a decision about you, your account, your subscription, or your access to the service.
- •The gateway does not keep your text once your request has finished, and we do not permit your content to be used to train AI models.
- •You can use every part of the service without ever using a writing-assistance feature.
We also use artificial intelligence internally to help us answer support enquiries and find records more quickly. It can read and summarise information; it cannot change your account, your subscription, or your memorial pages. Anything that needs acting on is done by a person.
Data Security
We take protecting your memories and personal information seriously. Here's how we keep your memorial content safe:
Data Retention
We only keep your information as long as needed for the memorial services we provide or as required by law. Memorial content is preserved to honor your loved ones, while account data is removed promptly when no longer needed.
Retention Periods:
- Memorial content, photos, and tribute posts: retained for as long as the memorial is active. If a subscription ends, the memorial goes offline and its content is kept for at least 30 days so it can be restored, then permanently deleted.
- Account details and profile information: Retained while your account is active, deleted within 30 days of account closure
- Payment and subscription data: Managed by Stripe according to their retention policies (typically 7 years for financial compliance)
- Guest posts and comments: Preserved as part of the memorial tribute while the memorial remains active. Individual posts and comments can only be deleted by their authors within 24 hours of creation, after which they become part of the permanent memorial record
- Email preferences and marketing consent: Retained until you unsubscribe or close your account, with unsubscribe requests honored permanently
- Records required for legal compliance: Retained for 6 years as required by applicable business record retention laws (including UK Companies Act requirements)
- Where a memorial's owner removes a guest from the memorial: we keep a record of that guest's email address, and the IP address they signed up from, for as long as the memorial exists, so that the removal can be enforced. It is deleted with the memorial
Your Rights
You have rights regarding your personal information.
Access Your Information
View all personal information we hold about you. How: Go to Account Settings → Download My Data
Correct Your Information
Update or correct any inaccurate personal information. How: Go to Account Settings → Edit Profile
Delete Your Information
Remove your account and the data associated with it. If you have a paid subscription, cancel it first from the customer portal, or ask us and we will cancel it as part of the deletion. Deletion is not instant: your account is taken down straight away, and for two weeks afterwards you can contact us to change your mind. After that it cannot be recovered. How: Go to Account Settings → Delete Account
Withdraw Consent
Withdraw your consent for data processing at any time. Important: Withdrawing consent will make your memorial pages completely unavailable to all visitors (including yourself) until consent is re-granted. How: Go to Account Settings → Privacy & Consent
Data Portability
Export your data in a structured, machine-readable format. How: Go to Account Settings → Download My Data
Restrict Processing
Ask us to pause what we do with your information rather than delete it, for example while you are disputing its accuracy or objecting to our use of it. We will keep it but stop using it, except to establish or defend a legal claim. How: email privacy@leftthis.world and tell us what you want restricted and why.
Object to Processing
Object to certain types of data processing, including marketing communications. How: Go to Account Settings → Privacy & Consent, or use unsubscribe links in emails
Email Communication Rights
You can unsubscribe from marketing emails at any time using the unsubscribe link in our emails. However, we will continue to send essential transactional emails (e.g., subscription confirmations, security alerts, memorial activity notifications) that are necessary for the operation of your account and memorial pages. These cannot be disabled as they are integral to the service.
Age Requirements
Special protections apply to children's personal information.
Our services are for adults. Subscribers must be 18 or older to enter into a payment agreement, and guests must confirm they are 18 or older before they can join a memorial page. We do not knowingly collect personal information from anyone under 18, and will delete such data if we discover it. If you become aware that someone under 18 has provided us with personal information, please contact us immediately.
International Data Transfers
Your personal information may be transferred to and processed in countries outside the UK and European Economic Area (EEA), including the United States. When we transfer your data internationally, we ensure appropriate safeguards are in place to protect your information. We use third-party services that may process data in different locations: • Stripe (payment processing) - EU/Ireland and US • Supabase (database hosting) - UK region • BunnyCDN (media storage and delivery) - UK (London) with US replication • Google Analytics (website analytics) - US • Vercel (website hosting and AI Gateway) - US • Anthropic (AI writing assistance, as a sub-processor of Vercel AI Gateway) - US All our service providers have Data Processing Agreements (DPAs) in place and are required to maintain appropriate security measures and comply with applicable data protection laws. For transfers to the United States, we rely on: • The UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge) for certified organisations • The UK International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses where applicable • Adequacy decisions for countries with adequate data protection Where possible, we prioritise UK and EU-based data storage to minimise international transfers.
All data processing decisions, transfers, and operations are controlled from the United Kingdom and governed by UK law. While we may use service providers located internationally, we remain the data controller and ensure all transfers comply with UK data protection standards. You have the right to see the safeguards we rely on for these transfers. Email privacy@leftthis.world and we will send you a copy of the relevant transfer agreement, with any commercially confidential terms removed.
Governing Law & Supervisory Authority
Governing Law
This Privacy Policy and all data processing activities are governed by the laws of England and Wales. Any disputes arising from this policy or our data practices will be subject to the exclusive jurisdiction of the courts of England and Wales.
Supervisory Authority
Left This World Memorial Ltd is registered with and regulated by the UK Information Commissioner's Office (ICO) for data protection purposes. The ICO is the UK's independent authority set up to uphold information rights and data privacy for individuals.
Complaining to us
If you think we have handled your personal information badly, please tell us first. You have a legal right to complain to us directly, and we would rather hear it from you than read it second-hand. Email privacy@leftthis.world with what happened and what you would like us to do about it. There is no form to fill in and no particular wording you need to use. We will acknowledge your complaint within 30 days of receiving it. We will then look into it, ask you anything we need to, and tell you what we have found and what we intend to do. If it is going to take a while, we will keep you posted rather than leave you wondering. You do not have to complain to us before going to the ICO, and you can go to them at any point, including while we are still looking into it. Details are below.
Your Right to Complain
You have the right to lodge a complaint with the ICO if you believe your personal data has been processed unlawfully or if you are dissatisfied with how we have handled your data protection rights. You can contact the ICO or submit a concern through their online portal.
Visit ICO Concerns Portal →Policy Updates
We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or business operations. When we make material changes that affect how we collect, use, or share your personal information: 1. **Notification**: We will notify all active users via email at least 30 days before the changes take effect. 2. **Grace Period**: You will have 30 days from the notification date to review and accept the updated Privacy Policy. 3. **Acceptance Required**: During the grace period, you can continue using all features normally. After the grace period expires, if you have not accepted the updated Privacy Policy, administrative features (editing memorial content, managing permissions, account settings) will be temporarily suspended. 4. **Memorial Pages Stay Live**: Your memorial pages will remain publicly accessible and fully functional during any suspension period. Only administrative access is affected. 5. **Easy Acceptance**: You can accept the updated Privacy Policy at any time by logging into your account and following the prompts. Minor updates (such as fixing typos, updating contact information, or clarifying existing language without changing its meaning) will be made without notification or requiring re-acceptance. You can always find the current version of this Privacy Policy on our website with the "Last Updated" date clearly displayed.
Contact Us
Left This World Memorial Ltd is the data controller responsible for your personal information. Company Number: 16691046 (England & Wales) For any questions or concerns about this policy, please contact us using the details below.
Data Protection Contact
Email: privacy@leftthis.world