Privacy Policy

Everlasting Unions, a DBA of Spolfig LLC · Effective Date: August 1, 2026 · Version 3.0
Governing Law: State of Utah, United States · Google API Compliance Included

1. Who We Are & Scope

Everlasting Unions, a DBA of Spolfig LLC ("we," "us," "our") operates the digital memorial platform at everlastingunions.com and memorial.everlastingunions.com. This Privacy Policy applies to all users of our Platform, including individual B2C users and B2B partner organizations (funeral homes).

For B2B partners: your organization acts as a data controller for personal information about the families you serve. We act as your data processor. Please ensure families are informed of this Privacy Policy.

2. Information We Collect

We collect the following categories of information:

• Account Data: Name, email address, password (hashed), language preference, and account creation date.
• Memorial Content: Photos, videos, audio files, biographical text, timelines, family member information, and tributes uploaded by you or visitors.
• Payment Data: Billing details are collected and stored by our payment processor (Square, Inc.). We receive only a transaction confirmation and plan identifier — we never store full card numbers.
• Usage Data: IP address, browser type, pages visited, session duration, referral source, and other standard web analytics data.
• Communications: Emails or messages you send to our support team.
• B2B Partner Data: Company name, branch structure, agent assignments, and associated memorial data.
• Third-Party Imported Media: Photos you choose to import from Google Photos or Facebook (see Sections 5 and 6).

We do not collect sensitive personal information such as Social Security numbers, government ID numbers, or biometric data.

3. How We Use Your Information

We use your information to:

• Create and maintain your account and digital memorials;
• Process payments and manage your subscription;
• Provide AI-powered memorial features (see Section 8);
• Send transactional emails (account confirmation, payment receipts, expiration notices);
• Respond to support requests and resolve disputes;
• Improve the Platform through aggregated, anonymized analytics;
• Comply with legal obligations and enforce our Terms of Service;
• Detect, prevent, and investigate fraud or security incidents.

We do not sell your personal information. We do not use your memorial content for advertising purposes.

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual necessity: Processing required to deliver the services you have requested (account management, memorial hosting, payment processing).
• Legitimate interests: Security monitoring, fraud prevention, and Platform improvement through aggregated analytics.
• Consent: Optional features such as Google Photos integration, AI features, and marketing communications (which you may withdraw at any time).
• Legal obligation: Compliance with applicable laws and responding to lawful government requests.

5. Third-Party Service Providers

We share data with trusted service providers solely to operate the Platform:

Provider	Purpose	Data Shared	Privacy Policy
Square, Inc.	Payment processing	Billing info, transaction data	View
Backblaze B2	Media file storage	Photos, videos, audio files	View
Google LLC	Photo import (user-initiated)	Selected Google Photos only	View
Meta (Facebook)	Photo import (user-initiated)	Selected Facebook photos only	View
Anthropic / AI Provider	Voice of Memory AI feature	Memorial biography & context (when feature is enabled)	View
Transactional Email Provider	Account & notification emails	Email address, message content	—

We require all service providers to maintain appropriate data protection standards. We do not permit providers to use your data for their own marketing or unrelated purposes.

6. Google API User Data

Everlasting Unions uses the Google Photos API to allow users to import selected personal photos into their memorials. Our use and transfer of information received from Google APIs strictly adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• We only access the specific photos you manually select to import. We do not access your entire Google Photos library.
• We do not use Google user data for advertising or share it with third parties beyond Backblaze B2 for storage purposes.
• You can revoke our access to your Google account at any time via your Google Account permissions.
• Imported photos remain in your memorial until you delete them or close your account.

7. Cookies & Tracking Technologies

We use the following categories of cookies:

• Essential cookies: Required for the Platform to function (session management, CSRF protection, language preference). Cannot be disabled.
• Functional cookies: Remember your preferences (e.g., chat consent, display settings).
• Analytics cookies: Aggregated, anonymized data to understand Platform usage. You may opt out via your browser settings.

We do not use advertising or tracking cookies to build profiles for third-party ad targeting. You can manage cookie preferences through your browser settings. Note that disabling essential cookies may impair Platform functionality.

8. AI Features (Voice of Memory)

The "Voice of Memory" feature uses artificial intelligence to generate conversational responses based on content you provide about the deceased. Regarding this feature:

• Processing occurs within a private, closed AI system. Your memorial data is not used to train public AI models.
• AI-generated content is not a factual account and should be understood as a creative, AI-assisted tribute.
• You control this feature and may disable it at any time from memorial settings.
• Memorial content shared with our AI provider is subject to our data processing agreement with that provider.

9. Data Retention

We retain your data for the following periods:

• Active accounts: Data retained for the duration of the account.
• Suspended/cancelled accounts: Data retained for 12 months after suspension, then permanently deleted unless a legal hold applies.
• Payment records: Retained for 7 years to comply with financial regulations.
• Support communications: Retained for 3 years after the last interaction.
• Anonymous analytics: Retained indefinitely in aggregated form.

You may request earlier deletion of your personal data by contacting us (see Section 18). Some data may be retained longer if required by law or for legitimate fraud prevention purposes.

10. Data Security

We implement industry-standard security measures including:

• TLS/SSL encryption for all data in transit;
• AES-256 encryption for sensitive data at rest;
• Hashed passwords (bcrypt) — we never store passwords in plain text;
• Access controls limiting data access to authorized personnel only;
• Regular security reviews and vulnerability assessments.

No system is 100% secure. We cannot guarantee absolute security but we are committed to continuously improving our defenses.

11. Children's Privacy

The Platform is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we discover that a child under 13 has provided us with personal information, we will promptly delete it. Parents or guardians who believe their child has provided us with information may contact us at privacy@everlastingunions.com.

Memorials created for deceased minors are managed by the account holder (parent, guardian, or next-of-kin), who assumes full responsibility for the content.

12. Your Privacy Rights

You have the following rights regarding your personal data:

To exercise any of these rights, contact us at privacy@everlastingunions.com. We will respond within 30 days. We may require identity verification before processing requests.

13. California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide additional rights:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we collect, use, and disclose.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out: We do not sell personal information. There is nothing to opt out of regarding data sales.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• Sensitive Personal Information: We do not collect or process sensitive personal information as defined under CPRA beyond what is necessary to provide the Service.

To submit a CCPA request, contact us at privacy@everlastingunions.com with "CCPA Request" in the subject line.

14. Utah Digital Privacy Act (UDPA)

As a Utah-based company, we comply with the Utah Consumer Privacy Act (UCPA). Utah residents have the right to:

• Access personal data we have collected about them;
• Delete personal data provided by or obtained about them;
• Obtain a portable copy of personal data they have provided;
• Opt out of the processing of their personal data for targeted advertising or sale (we do neither).

To submit a Utah privacy request, contact privacy@everlastingunions.com.

15. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify affected users via email within 72 hours of discovering the breach (where practicable);
• Report to applicable regulatory authorities as required by law;
• Provide information about the nature of the breach, the data affected, and the steps we are taking.

16. International Users

The Platform is operated from the United States. If you access the Platform from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States. By using the Platform, you consent to this transfer. We take steps to ensure that international data transfers are handled in accordance with applicable law.

17. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or applicable law. We will post the revised Policy with an updated effective date. For material changes, we will notify registered users by email or in-app notification at least 14 days before the change takes effect. Continued use of the Platform after the effective date constitutes your acceptance of the updated Policy.