Privacy

Who we are

IntraNow Limited is the controller of the personal information described in this notice. That means we decide what is held and why, and we are responsible for it.

Write to us about anything in this notice at support@cherished.id. A person reads it. We have not appointed a Data Protection Officer, because we are not required to.

IntraNow Limited is registered in England and Wales. Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.

Who this notice is about

Three different groups of people appear on this site, and the law treats them differently:

• Account holders. The family member who creates a memorial, and anyone they invite.
• Contributors. People who send a photograph, a video or a memory without making an account.
• People who appear in what is sent. Anyone in a photograph or named in a memory, who has given us nothing at all and may not know the page exists. We did not collect their information from them, and there is a separate section about that below.

The person being remembered is not covered by data protection law, which applies to living people only. Everyone else in a photograph of them is.

What we hold, and why we are allowed to

If you have an account

Your name, email address, password (stored only as a hash, never readable), and, if you turn it on, the secret behind two-factor authentication. We hold the memorials you belong to and what you are allowed to do on each.

Our lawful basis is performance of a contract: you asked us to provide this service and we cannot without these.

If you send something to a family

The name you give, the message you write, the files you send, and an email address if you choose to leave one so we can confirm your contribution arrived. We also keep a one-way fingerprint of the network address you came from for a limited period. It cannot be turned back into an address; it exists to stop automated abuse.

Our lawful basis is legitimate interests: yours in reaching the family, theirs in receiving it, and ours in running a service that is not overwhelmed by abuse. We have considered whether this is fair to you and concluded that it is, because you chose to send it and the family are the only people who see it until they decide otherwise.

What is inside the photographs

We keep the original file exactly as it arrived, and build smaller copies for the page with the technical metadata stripped out. Where a photograph records when or where it was taken, we keep that, because when and where a picture was taken is often the most valuable thing about it.

A photograph can reveal things the law treats as sensitive, such as someone's ethnicity, or their religion if it was taken at a service. We do not analyse photographs to work any of that out, we do not run face recognition, and we do not sort or index anybody by those characteristics.

If you pay us

Payments are taken by Stripe. We never see or hold your card number. We keep a record that a payment was made, for what, and when, because we have a legal obligation to keep accounting records.

Keeping the service working

Server logs, error reports and an audit trail of significant actions taken on a memorial, so a family can see who approved or removed what. Our lawful basis is legitimate interests in keeping the service secure, working and accountable.

Who else is involved

We use a small number of companies to run the service. They act on our instructions and may not use anything for their own purposes.

• Bunny.net stores the photographs and videos and delivers them to browsers. Files are held in its United Kingdom region. Video playback loads a player from Bunny's own domain.
• Fly.io runs the application and the database, in London.
• Resend sends the emails we send you.
• Stripe takes payments, and loads its own script on the payment page to detect fraud.

Some of these are based outside the United Kingdom, so some information reaches other countries. Where that happens it is covered by the transfer safeguards set out in [transfer safeguards to be confirmed].

Beyond those, we share nothing. No advertisers, no data brokers, no insurers, no analytics companies. We would disclose information if the law required us to, and we would tell you unless we were forbidden from doing so.

Photographs of people who never signed up

This is the part of this notice we think about most. A family photograph contains living people who did not choose to be on a website, and we usually have no way of contacting them to say so.

If you are in a photograph on one of these pages and you would rather not be, you do not need an account and you do not need to explain yourself. Tell the family who run the page, or write to support@cherished.id. Removing something from a page takes effect immediately, and we can delete it from storage entirely rather than merely hiding it.

Pages are private by default, are not listed in search engines unless a family specifically asks, and many are behind an access code.

How long we keep it

For as long as the family want the page, which is the point of it. Closing a page for non-payment does not delete anything: it stops being visible, and everything stays where it is.

We cannot keep a closed page forever, and the law does not allow us to hold personal information with no limit at all. So a page that has been closed and untouched for two years is removed. Before that we write to the account holder twice, at around eighteen months and again at twenty-three months, and each message carries a link to download everything. Replying to either one stops the clock. Nothing is removed without both having been sent.

Two years is deliberate rather than arbitrary. It covers a first anniversary, and a second, and it covers a family coming back once grief has lifted enough to think about a website.

Everything else:

• Account details are kept while the account exists, and deleted when you close it.
• Prepared downloads expire after a few days, because a link to a folder of somebody's family photographs should not sit around indefinitely.
• Network address fingerprints are kept for a short period for abuse prevention, then discarded.
• Payment records are kept for as long as tax law requires, currently six years.
• Some memorials are held indefinitely by arrangement, and are marked so that none of the above applies to them.

If a family asks us to delete a memorial, we remove the files from storage and the records from the database, and it does not come back.

Your rights

You can ask us to:

• give you a copy of what we hold about you;
• correct anything that is wrong;
• delete it;
• stop or restrict what we are doing with it;
• hand it over in a portable form, or send it to somebody else;
• stop relying on legitimate interests, where that is what we are relying on.

Write to support@cherished.id. We answer within one month, usually far sooner, and we will not make you fill in a form or prove yourself twice. It costs nothing.

Some of these rights have limits. We cannot delete a contributor's name from a family's own record of who gave them what without their agreement, and we cannot delete accounting records early. Where we cannot do something, we will tell you why.

We make no automated decisions about you, and we do not profile anybody.

If you are unhappy with how we have handled something, please tell us first, because we would rather fix it. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Cookies and similar technologies

We use no advertising cookies, no analytics and no third-party trackers. We set a cookie to keep you signed in, one to protect forms against cross-site request forgery, and one to remember that you have entered a memorial's access code. These are necessary for the site to work and we do not ask permission for them, because none is required.

Two third parties load their own code in your browser: Stripe on the payment page, for fraud detection, and Bunny's video player when you watch a video. Both may set cookies of their own, and their own privacy notices cover those.

Children

This service is for adults arranging and using a memorial. We do not knowingly create accounts for anybody under 16. Children appear in family photographs, of course. Where a family publishes a photograph of a child, they are responsible for having the right to do so, and anybody with parental responsibility can ask us to remove it.

How we keep it safe

Everything travels over an encrypted connection. Passwords are hashed and cannot be read back. Original files are never publicly addressable; what a visitor sees is a resized copy. Access to accounts by our staff is limited and recorded. Two-factor authentication is available on every account and we recommend it.

No system is perfect. If something happened that put your information at risk we would tell you, and the Information Commissioner's Office where the law requires it.

Changes to this notice

If we change anything that matters we will say so on this page and email account holders, rather than quietly updating a date at the top.