Privacy Policy

Their Story (“we”, “us”, “our”) provides digital memorial pages and personalised QR memorial plaques to families in the United Kingdom. We are the data controller for the personal information described in this policy.

You can contact us about privacy at theirstory.co.uk@gmail.com.

• Account information — the email address and name used to register, plus authentication data needed to sign you in.
• Memorial content — biography text, photographs, videos, audio, stories, timeline entries and family relationships you choose to upload.
• Visitor contributions — tributes, candle lighting, heart reactions and, where provided, a visitor’s name and email address. Visitor email addresses are private and are never shown publicly.
• Order and delivery information — the package purchased, payment status and the delivery address supplied for a plaque. Card details are handled by Stripe and never stored by us.
• Support messages — the content of enquiries and support tickets you send us.
• Anonymous usage data — memorial page views and QR scans recorded using a daily-rotating anonymous identifier. This is not used to profile or identify individuals.

• To create and operate your account and memorial page (contract).
• To process payments, produce and dispatch plaques (contract).
• To send service emails such as verification, password reset, order and fulfilment updates (contract).
• To keep the service secure, prevent abuse and meet accounting obligations (legal obligation and legitimate interests).
• To provide anonymous visit statistics to memorial owners (legitimate interests).

We do not sell, rent or share personal information with advertisers, and memorial pages never carry advertising.

Memorial owners control visibility. A memorial can be public, protected by a 4-digit PIN, or private. PINs are stored only as salted hashes and cannot be read by us. Protected and private memorials are excluded from search engine indexing.

We use a small number of trusted service providers who process data on our instructions: our hosting and database provider, Stripe for payments, and our transactional email provider. We may disclose information where required by law. Personal data is stored on servers within the UK or European Economic Area wherever possible; where a provider processes data elsewhere, appropriate safeguards such as Standard Contractual Clauses apply.

Memorial content is kept for as long as the memorial remains active, so that it stays available to the family. Account and memorial data are deleted on request. Order and payment records are retained for six years to meet UK accounting and tax requirements. Anonymous analytics are retained in aggregate only.

Access to memorial content is controlled by row-level database permissions, media is served through expiring signed links, passwords and PINs are hashed, and administrative actions are recorded in an audit log. No online service can be guaranteed completely secure, but we take the protection of family memories seriously.

Under UK data protection law you have the right to access, correct, delete or restrict the use of your personal data, to object to processing, and to request a copy of your data in a portable format. You can export your data or delete your account from your dashboard privacy settings, or contact us at theirstory.co.uk@gmail.com. If you are unhappy with our response you may complain to the Information Commissioner’s Office at ico.org.uk.

Accounts are intended for adults aged 18 or over. Memorial pages may include information about people of any age, added by the family who owns the memorial.

If we make material changes we will update the date at the top of this page and, where appropriate, notify account holders by email.