Legal
We believe privacy is a form of respect. This policy explains how we handle your information.
Last updated: 1 August 2026
Contents
When you create a memorial, we collect the information you provide: names, dates, photographs, biographical text, and service details. When you create an account, we collect an email address or phone number. When visitors light candles or leave tributes, we collect the information they submit (name, message, and, optionally, location). We also collect standard usage data — page views, device type, browser — through anonymous analytics. We do not collect or process payment information of any kind; Tributes Portal is free to use.
We use the information you provide solely to create, display, and maintain your memorial. We use your email or phone to send account verification codes and, with your permission, occasional product updates. We use anonymous analytics to improve the service. We never sell your personal data. We never use memorial content for advertising. Tributes Portal is not an advertising platform and will never become one.
Memorial data is stored on our hosting infrastructure and in object storage for photographs, served through a CDN, encrypted in transit and, where supported, at rest. Our servers sit behind a network that filters out malicious traffic before it arrives, and are locked down so only the connections they actually need get through. Signing in uses Google or a one-time email code — there is no separate Tributes Portal password of yours to be guessed or leaked. Anything sensitive we do store, like a memorial's password or a sign-in code, is hashed before it reaches our database, so it cannot be read back even by us. Every change passes through server-side checks, public forms are guarded against spam and bots, and our systems are built in a way that rules out a common technique used to steal data from other websites. Every action our own staff take is recorded — access to family data is never anonymous. We retain memorial data for as long as an account is active; deleted accounts are purged within 30 days.
You have the right to access, correct, export, or delete any personal data we hold about you. To exercise these rights, contact us at [email protected]. We will respond within 30 days. If you are in the European Economic Area, you have additional rights under GDPR, including the right to lodge a complaint with a supervisory authority. If you are in Nigeria, you have rights under the Nigeria Data Protection Regulation (NDPR) 2019.
We use a small number of trusted third-party services: a transactional email provider and Google Analytics, with IP anonymisation enabled, to understand site usage. None of these third parties receive identifiable memorial content. We do not use social media trackers, advertising networks, or data brokers. A full list of sub-processors is available on request.
For enquiries, contact us at [email protected].
This policy may be updated from time to time. We will notify account holders of material changes by email. Continued use of the service after a change constitutes acceptance of the updated policy.