Privacy Policy

Effective date: October 16, 2026

1 Operator and contact

Pure Memorial at purememorial.com is operated by Grigorev Andrei, an individual entrepreneur, established in the Republic of Kazakhstan, registration details Individual Identification Number (IIN) 840504050150, registered address 140 Aymanova Street, Almaty 050057, Republic of Kazakhstan. We determine why and how personal data is processed and act as its controller or operator.

For data requests, complaints and human review, contact support@purememorial.com. No account is required. We have not appointed a representative in the European Union or the United Kingdom. Requests can be sent directly to the Operator at the address above.

This policy covers visitors, account holders, guests who leave a memory without an account, people who upload a death certificate through a creator's private link, invitation recipients and living people identified in submitted content. The Terms of Service govern use of the Service.

2 Main points

We process account information, memorial content, memories from account holders and guests, verification documents, invitations, reminders and payment records. Public content is visible to anyone; Unlisted content is accessible to anyone with its link; Private limits page access to the creator and authorized staff.

Claude, Anthropic’s artificial intelligence system, receives content and verification documents for checks. Some decisions are automated; human review is available. We use providers in the United States and global infrastructure. Deleting an account does not automatically erase all payment, delivery, invitation or provider records. We do not sell or rent personal data or use memorial content for targeted advertising. Google Analytics measures how the website is used only if you allow it, and never for advertising.

3 Data we process and its sources

3.1 Visits and analytics

Hosting and security providers receive your Internet Protocol (IP) address, device and browser information, requested page, referring page and request time to deliver and protect the website and investigate errors.

Vercel Web Analytics records visits without analytics cookies. Its statistics use page addresses, referring pages, permitted query parameters, approximate country, device, browser and event times. A request-derived visitor identifier is discarded after twenty-four hours under Vercel’s published policy. We use aggregate traffic statistics; page addresses can themselves contain names, memorial-link codes or other personal information. Cookieless does not mean that every transmitted value is anonymous.

Google Analytics 4 runs only if you choose Accept in the cookie notice. Until then, and after you decline, the Google tag is not loaded and nothing is sent to Google. When allowed, Google Analytics sets the cookies _ga and _ga_<ID> to recognize your browser across visits and receives your IP address, device and browser information, screen size, language, the pages you view, the order and times of visits, how you arrived, and actions such as registering, creating a memorial, starting or completing a purchase, sharing a memorial, sending an invitation, leaving a memory, subscribing to reminders and reading or following links in blog articles. Google uses the IP address to derive approximate location and states that Google Analytics does not log or store it.

We send each page as its type, not its address: every memorial page is reported as the same generic memorial page with a generic title, and pages whose address contains an identifier, link code or token are reported without it. Blog article addresses are sent as they are. Query strings and fragments are removed, except the campaign tags utm_source, utm_medium and utm_campaign of the page where a visit starts. We do not send names, email addresses, memory texts, search text, or account, memorial or payment identifiers. Google signals, advertising features, advertising personalization and links to Google advertising products are turned off. We use aggregate reports; event-level data is retained in Google Analytics for fourteen months.

3.2 Accounts and sources of registration

We process email, account identifier, optional display name and profile-image link, role, plan, creation and update times, age confirmation, and the accepted Terms version and date. Supabase handles password hashes and authentication records, including sign-in and security information. Google sign-in supplies the account information you authorize, such as name, email, profile-image link and identifier, not your Google password.

Your display name can appear as a creator or memory author; an absent name may appear as Anonymous. We do not display your account email on memorial pages, although text you submit may disclose it.

Campaign parameters utm_source, utm_medium and utm_campaign may be saved with your profile from the registration-page address or a referring page on our site. This attribution does not use cookies or browser storage. We also store your optional answer to How did you hear about Pure Memorial, and use aggregate registration, creation, verification and purchase counts. These source fields remain account-linked records even when the administration view shows totals.

3.3 Memorials and maps

Creators submit names, birth and death dates, biographies, epitaphs, life-story chapters, faith symbols, photographs, captions, covers, resting-place addresses and coordinates, visiting information, and visibility and feature settings. Content can identify living people. Submit only information you may lawfully share and avoid unnecessary sensitive details.

Standard photo forms resize and reformat images on your device and remove original camera metadata. We store the resulting web version, not a guaranteed original. Verification files and other submitted documents may retain metadata.

When a resting-place map is displayed, your browser requests Mapbox map images and, when loaded, interactive maps. Mapbox receives network and device information, referring-site information and requested coordinates. Place search also sends search text and selected coordinates. These are the entered destination, not automatically your current location. Google Maps and Apple Maps receive destination coordinates when you open their directions links.

3.4 Memories and reports

We process memory text, author, time and moderation status; reports contain the reporting account, reasons, details and outcome.

A guest who leaves a memory without an account provides the name to show with it and, if they choose, how they knew the person. That name and description are shown with the memory to everyone who can view the page, and to its creator and moderators. We also store the guest’s confirmation of age and acceptance of the Terms, with the Terms version and time. We do not ask guests for an email address. To limit abuse and checking costs, we keep a counter keyed to a one-way cryptographic hash of the guest’s Internet Protocol (IP) address and to the memorial; it does not store the readable address and expires under section 8. The reporting feature does not show the reporter’s identity to the memorial creator. Binding legal processes may require disclosure.

Moderation records contain outcomes, categories, reasons, model information, errors and reviewer actions. Usage records limit automated checks and exports. Information usually comes from the person who submits it; living people may be mentioned without having an account.

3.5 Verification documents

For optional verification we process an accepted death record, file metadata, memorial facts, extracted document details and review results. Extraction can include document type, issuing country and authority, record number, names and dates, consistency checks and indications of alteration.

The file is stored privately in Supabase, accessible to its creator and authorized reviewers, and sent to Anthropic for checking. Reviewer notifications through Resend and Gmail may contain extracted information. Documents are not displayed on memorial pages. A document can identify a living informant, doctor or registrar; contact us about obscuring unnecessary details before upload. Do not submit unrelated identity documents.

A certificate can also be uploaded, without an account, by a person to whom the creator sent a private upload link. For each link we store a one-way cryptographic hash of its secret part (the link itself is never stored), the memorial, who created it, when it was created, used, cancelled or expires, the number of upload attempts, and which submission came through it. We do not ask the uploader for a name or email address; their network information is handled as for any visit (section 3.1). The uploaded document is processed as described above, and the result is sent to the creator, not to the uploader.

3.6 Invitations

A sender provides recipient email addresses, a personal note if desired, and sender and memorial information. We send that invitation and screen the note. The address normally comes from the person named in the email.

Invitation records store a cryptographic hash of the normalized address, sending details, note and opt-out status. A known address can be matched to its hash, so this is pseudonymous rather than necessarily anonymous data. Readable recipient addresses and subjects are also stored in email logs. Recipients can stop invitations without an account; they are not enrolled in marketing.

3.7 Reminders

We store the account-to-memorial reminder subscription, creation time and stopped status. Creators are subscribed by default, including creators of memorials that predated the feature. Other signed-in users subscribe by choosing Remind me on an eligible page.

Reminders are scheduled a week and a day before a birthday, when known, or death anniversary. Other users are not shown a subscriber list. For non-creators, delivery pauses while a memorial is hidden or Private and may resume when eligibility returns unless the subscription was stopped. Verification does not affect reminders. Guests without an account cannot subscribe to reminders. Each reminder has a stop link usable without sign-in. Stopping records the choice rather than deleting the subscription, so earlier email links can support reactivation.

3.8 Payments

Polar Software, Inc. acts as seller and merchant of record. Polar and payment processors collect purchase, billing, tax and payment-security information. We send account identifier and email to connect the purchase and receive customer, order and subscription identifiers, plan, amounts, currency, tax, refund, status and date information, plus payment-event processing records. We do not receive full card numbers or card security codes. Polar’s Privacy Policy covers its own processing.

3.9 Messages and support

We process contact details, content and delivery information for confirmation, password reset, invitations, reminders, verification, moderation and other service messages. Application email logs contain recipient, subject, template, related item, status, errors and provider identifier; they are not necessarily copies of the complete message body. Email tracking in our configured sending service: open tracking and click tracking are disabled in Resend.

Support, complaints and appeals include your correspondence and proportionate supporting evidence. Incoming support mail is routed through Cloudflare Email Routing to Gmail; reviewer notifications also arrive in Gmail. Do not email complete identity documents or unrelated sensitive records unless proportionate evidence is specifically requested through an appropriate channel.

3.10 Browser storage

Authentication cookies and related storage maintain sign-in and protect authentication flows. The pm_analytics cookie remembers your Google Analytics choice for twelve months; it is set when you choose and is not read by our servers. Google Analytics cookies are set only after you accept, as described in section 3.1. We do not use advertising cookies. Map integrations and third-party services may use storage under their own policies. A separately required choice for non-essential processing cannot be replaced by agreement to the Terms.

Starting a memorial before registration saves its name and dates in local browser storage. This draft is not submitted as a memorial until you create one. It is cleared after successful creation. A draft older than seven days is ignored and removed when the Service next reads it; if you do not return, the stored value can remain until browser data is cleared. You can remove it through your browser’s site-data controls. The installed website also caches a generic offline page, not memorial pages or account data for offline use.

4 Purposes and legal bases

Where the General Data Protection Regulation (GDPR), the United Kingdom GDPR or comparable rules apply, we use the following grounds for ordinary personal data:

• Contract performance: requested account, memorial, contribution, export, deletion and paid-plan functions, reminders a user chooses, and publishing a memory a guest submits under the Terms. This applies to the relevant user’s own information, not automatically to everyone mentioned in their content.
• Legitimate interests: proportionate publication and family sharing of ordinary third-party information, preventing false death notices, limiting automated or abusive memory submissions, personal invitations, default creator reminders, moderation, security, support, delivery records and usage/source statistics. The interests are remembrance, operating a safe service and understanding its use, balanced against affected people’s rights.
• Legal obligations: applicable accounting, tax, valid legal requests and mandatory complaint or notification duties.
• Consent: Google Analytics measurement and its cookies, and other processing for which applicable law requires separate consent. We must obtain a valid consent before such processing and allow withdrawal.

You can object to legitimate-interest processing, including default reminders and account-linked source statistics. Special-category data about living people, such as health or religious beliefs, requires an additional applicable legal condition; ordinary contract or legitimate-interest grounds alone do not authorize it. We do not need such details for ordinary memorial features. Where submitted information lacks a lawful basis, we restrict or remove it as required.

Providing information necessary for a requested feature is required to use that feature. Verification, photographs, faith symbols, invitations and the referral question are optional. Without accepted verification, search indexing and the Verified badge are unavailable; memories, invitations and reminder subscriptions work on unverified pages too. Accepting the Terms is not blanket consent to processing or marketing.

5 Automated checks

Through Anthropic’s commercial application programming interface (API), Claude receives photographs and submitted texts, including biographies, epitaphs, life stories, visiting information, captions, memories (including guests’ memories and the name they enter) and invitation notes. Photo checks also receive the memorial’s name. Results can allow publication, hold content or prevent it from being saved or sent. Rejected memories may remain available to their author, creator and moderators. On checking outages, photographs and memories may await review while owner text or invitation notes may still be saved or sent.

Document checking compares the death record, memorial name and dates, and file signals. It can approve automatically; other submissions go to a person, and only a person rejects a verification document. A living-person report or reports from three different accounts can automatically hide a memorial. These systems can make mistakes and do not conclusively establish authenticity or wrongdoing.

Request free human review through support, explain your position and challenge a result. We provide explanations and remedies required by law, including a response within three working days to an automated-processing objection where Kazakhstan law requires it. Applicable rights concerning solely automated decisions with legal or similarly significant effects remain available.

6 Recipients and locations

Authorized staff and the following providers receive information needed for their functions. Content is also disclosed to viewers permitted by its settings, and information may be disclosed for binding legal duties or lawful claims.

• Supabase: authentication, database and storage of accounts, memorials, photographs, certificates and related records. Primary database and storage: East US (North Virginia), United States; the database and Storage use the same Supabase project. Support and subprocessors may operate elsewhere.
• Vercel: hosting, delivery, technical logs and cookieless analytics; request information and content handled by the platform, using United States and global infrastructure.
• Anthropic: texts, images, verification documents and checking context; United States and other locations under its applicable processing arrangements.
• Resend: service-email recipients, message content and delivery information; United States and provider infrastructure.
• Polar and payment processors: checkout, billing, subscriptions, tax, receipts and payment support; United States and relevant payment-provider locations.
• Mapbox: map and place-search queries, coordinates, network and device information; United States and global infrastructure.
• Google: optional sign-in, Google Analytics measurement when you allow it, and Gmail support and reviewer correspondence; United States and global infrastructure.
• Cloudflare: incoming email routing and domain/network delivery information; global infrastructure.

Providers’ roles differ. Service processing is governed by applicable processing terms; Polar, payment processors, Google and map services may also act independently for their own account, payment, security or legal purposes. Directions services you open have their own policies.

Anthropic’s published commercial API rules do not use inputs and outputs for model training by default. We do not opt submitted content into optional model training. Standard API retention is up to thirty days, with exceptions for specific services, agreed arrangements, abuse enforcement and law; flagged material may remain longer. See its training information and retention policy. Our retained copies follow section 8.

Providers may use subprocessors. Necessary records may pass to a lawful business successor subject to applicable privacy duties and notice requirements.

7 International transfers

The Operator is in Kazakhstan and providers use United States and global infrastructure. Private visibility does not mean local-only storage or exclude provider processing. Safeguards actually used for relevant international transfers: the standard data-processing addenda incorporated into the applicable service terms of Supabase, Vercel, Anthropic and Resend, and for Google Analytics the Google Ads Data Processing Terms. These addenda provide contractual duties concerning processing instructions, confidentiality, security, subprocessors and deletion. They also incorporate the European Commission's Standard Contractual Clauses and United Kingdom transfer provisions where the relevant laws and transfer conditions make those provisions applicable. These terms operate alongside the security measures described in section 11. Request information and, where applicable, a copy through support, subject to lawful protection of confidential details.

Transfer safeguards do not replace any separate local-storage or consent requirement. Agreement to the Terms alone does not establish a lawful transfer mechanism.

8 Retention and deletion

These periods govern ordinary operational retention. Daily cleanup processes expired application records; technical failures may delay a run and are retried. Separately required legal holds are limited to relevant data, restricted to their lawful purpose and ended when no longer necessary.

• Account and profile: until successful account deletion, including recorded age/Terms acceptance, campaign tags and optional source answer, except separately justified legal evidence.
• Memorials, photographs, covers, chapters and settings: until content, memorial or account deletion. File removal is attempted during deletion; scheduled cleanup retries orphaned files older than one day.
• Memories and ordinary moderation history: for the life of the relevant content, subject to author, creator or lawful removal and related account/memorial deletion. Guests’ memories, the name and description they entered and their recorded Terms acceptance are kept with the memory and removed with it.
• Death certificates, extraction and verification results: for the memorial’s life to support verification review, unless earlier lawful erasure applies; removed with the related records.
• Certificate upload links: for the memorial’s life, as a record of how a submission arrived; removed with the memorial.
• Memorial reports: until resolution and then twelve months, or earlier related-account or memorial deletion. Reporter entries in memory moderation logs expire twelve months after the relevant moderator decision; where no moderator decision is recorded, the report date is used once the memory is no longer awaiting report review.
• Invitation notes: thirty days in application invitation records. Copies in delivered emails or provider records have separate retention. Invitation hashes and sending records have no fixed automatic expiry; retained only while justified by sending controls, valid opt-out links, disputes or honoring recipient choices, and reviewed on request. A hash retained for suppression does not justify unrelated content retention.
• Google Analytics: event-level data for fourteen months in Google Analytics, then aggregate reports only. The _ga cookies expire up to two years after your last visit unless you decline or clear them; the pm_analytics choice cookie after twelve months.
• Reminder subscriptions and stopped choices: until account or memorial deletion. Unsubscribing changes the status and does not erase the row.
• Application email logs: twelve months, including when the related account has been deleted.
• Moderation, export and guest-memory usage counters, including hashed network-address keys: no more than thirty days before scheduled expiry processing; some counters may be cleared earlier.
• Payment and payment-event records: retained as needed to administer purchases and subscriptions, reconcile transactions, process refunds and resolve disputes. Records needed for Kazakhstan tax accounting are retained until the applicable statutory limitation period expires and for at least five years, counted from the tax period following the period in which the relevant tax obligation was calculated; longer mandatory periods or lawful holds may apply. Technical payment-event records do not currently have a fixed automatic expiry. Their retention must remain justified by payment reconciliation, duplicate-event prevention or a specific dispute or legal duty; retention is reviewed on request and records no longer needed are deleted. These survive account deletion with the direct account link removed; transaction identifiers may still identify people.
• Support, complaint and reviewer mailbox correspondence: ordinary support correspondence is kept for up to twelve months after the request is closed; reviewer notification emails, including any extracted document details they contain, are kept for up to thirty days after the final verification decision. Relevant correspondence may be retained longer where needed for an active dispute or a specific legal obligation, with restricted use and review when that need ends. These mailbox periods are applied separately from application cleanup. Account deletion does not itself erase Gmail messages.
• Provider technical and security logs: under the standard plans used for the Service, Supabase Pro API and database logs are retained for seven days, Vercel Pro runtime logs for one day, and Resend email content and delivery logs for thirty days. These are the ordinary service-log periods, not a guarantee that every provider-controlled record is erased within those periods. Other operational, account, security and abuse-prevention records follow the relevant provider's applicable policies and processing terms. Providers may retain separately necessary legal and security records.
• Backup copies: daily Supabase Pro database backups are retained on a rolling seven-day basis, without the point-in-time recovery add-on. These database backups contain database records and Storage metadata, but do not include the photographs or documents stored as Storage objects. We do not maintain separate copies or exports as backups. Resend states that its own backups are retained for seven days; other provider-managed backup and recovery systems follow the applicable provider's retention and deletion arrangements. Active deletion is not a guarantee of immediate erasure from every provider system or backup.

Public photograph responses are cached for up to one hour; other photo responses can be browser-cached for five minutes. Share cards can be cached by our delivery network for a week. Temporary links can remain valid until expiry unless their files are removed. Third-party search results, previews, recipient mailboxes, screenshots and independent copies follow those parties’ schedules. Hiding a section or location does not itself delete its data; the separate cover can remain visible when the gallery is off.

9 Choices and rights

Depending on applicable law, you may obtain access and a copy, correction, erasure, restriction, objection, portability of eligible data, withdrawal of consent and applicable safeguards for automated decisions. Consent withdrawal does not invalidate earlier lawful processing. You can change your Google Analytics choice at any time through Cookie settings at the bottom of public pages; declining stops measurement in that browser and deletes the Google Analytics cookies there.

Your data in the dashboard exports available account/source information, memorials, stored photographs and certificates, memories, reports, invitations, reminder subscriptions and email-log records sent to your address. The ZIP contains readable text and stored files, not every provider record or the full body of every email. Contact us for missing information or an eligible machine-readable portability copy. The five-download daily limit does not restrict statutory requests.

You may edit memorial data and your display name and delete memorials or your account. Successful account deletion removes memorial content and your own memories and reports subject to section 8. Renewing subscriptions are scheduled to end before deletion; if cancellation fails, contact support. Export first if needed. Stop reminders through their controls or email links and invitations through the separate opt-out link, without creating an account.

Guests without an account can exercise their rights through support. Send the page link, the name you used and the text or approximate time of your memory; because there is no account to check, we may ask for proportionate details to confirm that you wrote it. The memorial’s creator can also hide or delete your memory.

Send other requests to support. We may request proportionate identity or authority evidence. We reply within mandatory deadlines; under the GDPR this is normally one month, with an allowed extension and notice for complex or numerous requests. Requests are normally free; any refusal or charge must meet legal conditions and be explained.

You may complain to a competent authority without first contacting us. In the European Economic Area, this may be the authority where you live, work or the alleged infringement occurred; in the United Kingdom, the Information Commissioner’s Office; in Kazakhstan, the authorized personal-data protection body. Court remedies remain available.

10 Deceased people and children

The GDPR does not itself protect deceased people, but national laws and relatives’, heirs’ and other persons’ rights may protect their information or images. Living people mentioned or depicted in content or records retain applicable rights even without an account. Information about them normally comes from the contributor, document submitter or invitation sender. Contact us to seek correction, restriction or removal.

Accounts, purchases and contributions, including guests’ memories, are restricted to adults eighteen or older. Adults may create memorials for deceased children with necessary authority and permissions. Avoid unnecessary information about living children. Report suspected child accounts or unlawful disclosures; we assess and restrict or remove them where required.

11 Security

We use encrypted connections, database access controls, private photo storage and separate private certificate storage. Displayed photographs follow visibility rules with the cache and link limitations above. Staff access is limited by work needs. No system is perfectly secure; protect credentials and downloaded archives. We notify authorities and affected people of breaches where and within the time required by applicable law.

12 Policy changes

We publish each version and effective date and keep earlier versions on the Privacy page. Material changes receive advance notice through a prominent Service notice or email, using any required notice method and period. Where new processing requires consent, we obtain it before starting. Urgent lawful security or legal changes may take effect sooner with prompt explanation.