Privacy Policy

1. Who We Are

Pet Memorial Garden ("we", "us", "our") is an online service that enables users to create and manage digital memorial pages for deceased pets. The Service is operated by a registered software company in the United Kingdom.

We are the data controller for personal information you provide to us when using the Service.

For privacy-related enquiries, contact: support@petmemorialgarden.co.uk

2. What Data We Collect

2.1 Account Data

When you register, we collect:

• Your name
• Email address
• Password (stored as a one-way hash — we cannot read it)
• Date and time of registration and last login
• IP address at registration (fraud prevention)

2.2 Memorial Content

Content you choose to provide for a memorial page, including:

• Pet name, breed, dates, and biography
• Photos you upload
• Inscription and memorial style preferences
• Location coordinates (latitude and longitude — used to display the memorial on the map)

2.3 Tribute & Gift Data

When visitors leave messages or virtual gifts on a memorial, we store:

• The message or gift type and any accompanying note
• The visitor's name (or "Anonymous" if they choose)
• Date and time of the tribute
• If the visitor is logged in, their user ID; otherwise their IP address (for abuse prevention only)

2.4 Payment Data

Payments are processed by Stripe, a PCI-DSS compliant payment processor. We do not see or store your card number, expiry date, or CVV.

We do receive and store:

• Stripe session and payment intent IDs (transaction reference)
• Stripe customer ID (links your account to Stripe for subscription management)
• Order type, amount, and date
• For QR Plaque orders: your shipping name and postal address

2.5 Technical & Usage Data

We automatically collect:

• IP address and approximate location (country/region)
• Browser type and version
• Pages visited and time spent
• Referral source
• Error and performance logs

This data is used to operate, debug, and improve the Service. It is not used for advertising profiling.

3. How We Use Your Data

4. Cookies

We use a small number of first-party cookies:

• Session cookie — keeps you logged in during your visit. Expires when you close your browser (or after 30 days if you choose "Remember me").
• CSRF token — a security cookie that protects forms from cross-site request forgery attacks.

We do not use advertising or tracking cookies, and we do not use Google Analytics or similar third-party analytics services.

Third-party services embedded in the Service (OpenStreetMap tiles, Stripe checkout) may set their own cookies — please see their respective privacy policies for details.

5. Who We Share Data With

We do not sell your personal data. We share data only with:

• Stripe — to process payments. Stripe Privacy Policy
• OpenAI — if you purchase an AI Poem or AI Portrait, your pet's description and uploaded photo are sent to OpenAI's API to generate the content. OpenAI processes this data in accordance with their API usage policies. We do not send any personally identifying information about you (only your pet's details).
• Replicate — AI portrait image generation. Your uploaded photo is sent to Replicate's API for processing.
• Hosting and infrastructure providers — our servers and supporting services are hosted in data centres in the United Kingdom and/or European Union.
• Law enforcement or regulatory authorities — where we are legally required to disclose information.

6. Retention

• Active accounts: Data is retained for as long as your account is active.
• Lapsed subscriptions: Memorial content is retained for 90 days after a subscription lapses, then permanently deleted.
• Deleted accounts: Accounts marked as deleted are retained for 90 days (for fraud investigation purposes) then removed. Memorial content associated with deleted accounts may be removed sooner.
• Banned accounts: Your email address is added to a ban list to prevent re-registration. This entry is retained indefinitely unless you successfully appeal. No other personal data is retained beyond the standard deletion period.
• Payment records: We retain transaction records for 7 years to comply with financial regulations.
• Server logs: Raw access logs are retained for 30 days then deleted.

7. Your Rights

Under UK GDPR and the Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you
• Rectification of inaccurate data
• Erasure ("right to be forgotten") — subject to legal retention requirements
• Restriction of processing in certain circumstances
• Portability of your data in a machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, email support@petmemorialgarden.co.uk with "Data Request" in the subject line. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Children

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

9. Security

We take reasonable technical and organisational measures to protect your data, including:

• All data in transit is encrypted using HTTPS/TLS
• Passwords are stored using bcrypt hashing — they cannot be recovered in plaintext
• CSRF protection on all authenticated forms
• Prepared statements throughout to prevent SQL injection
• Admin access is restricted by authentication
• Rate limiting on login, registration, and API endpoints

No system is completely secure. In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and affected users without undue delay.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "last updated" date at the top of this page will change. For material changes, we will notify registered users by email. Your continued use of the Service constitutes acceptance of the updated policy.

11. Contact & Complaints

If you have any questions about this Privacy Policy or how we handle your data:

Email: support@petmemorialgarden.co.uk
We aim to respond within 2 working days.

If you are unhappy with our response, you may contact the ICO: ico.org.uk/make-a-complaint