Subprocessors

What for

Runs the application, its database and its servers in AWS's Frankfurt region in Germany (eu-central-1). Backup copies of the live database and disks are kept in AWS's Ireland region (eu-west-1).

What it receives

Everything the service holds. Most box contents are encrypted by the application before they are written, and the keys that open them are locked by AWS's own key service (AWS KMS).

What for

Keeps uploaded files, such as photos and documents, in a private bucket in the same Frankfurt region, once they are moved off the application server.

What it receives

Uploaded files, on private storage that is not served from the web.

What for

Every visit to the website, the app and our staff panel passes through Cloudflare first. It answers for our domain names, encrypts the connection, blocks attacks and repeated attempts, and checks our staff before they reach the staff panel.

What it receives

Your IP address, browser details and the addresses you ask for. Cloudflare opens the encrypted connection at its own servers to filter it, then passes it on to ours over an encrypted tunnel.

What for

Sends every email the service sends, including the ones families receive. Our providers are Amazon SES, with Mailgun as a backup.

What it receives

Names and email addresses of the people we write to, and the text of each email.

What for

Holds the mailboxes of our addresses, such as support@, privacy@ and security@. A death report, a privacy request or a question you send us by email arrives there.

What it receives

What you write to us, your name and email address, and any attachment.

What for

Sends notifications to the Gentle Handover phone app.

What it receives

A device token and the short text of the notification.

Nothing is sent to this company while it is switched off.

What for

Sends reminders and alerts to people who link their Telegram account.

What it receives

The Telegram chat id and the text of the message.

Nothing is sent to this company while it is switched off.

What for

Text messages and phone calls for check-ins, alerts and one-time codes.

What it receives

Phone numbers and the text of the message or call.

Nothing is sent to this company while it is switched off.

What for

WhatsApp messages for check-ins and alerts, only to owners who switched WhatsApp on for their verified number.

What it receives

The phone number and the text of the message.

Nothing is sent to this company while it is switched off.

What for

Error reports, so we can find out why something broke.

What it receives

The address of the page, the user id and technical details of the error. Never box contents.

What for

Counts visits to the public pages, without cookies.

What it receives

The address of the public page, the site you came from, and browser, device and country. Your IP address is used to work out the country and is not stored, according to Plausible. Only after you agree to analytics, never when your browser sends a Global Privacy Control signal, and never on account, portal or memorial pages.

What for

Lets you sign in with your Google account, when you choose to.

What it receives

Your Google account number, name, email address and whether Google confirmed it. Only when you press "Continue with Google", and never any box contents.

What for

Lets you sign in with your Apple account, when you choose to.

What it receives

Your Apple account number, email address (possibly a private relay address) and, the first time, your name. Only when you press "Continue with Apple", and never any box contents.

Nothing is sent to this company while it is switched off.

What for

Checks that a person, not a program, is sending the sign-in, sign-up, password reset, contact and call back request forms.

What it receives

Your IP address and browser details, and the check's one-time answer. Only on those five forms, never inside your account.

What for

Names the country and city of a check-in or of a sign-in from a new device, for the account history and the new device email.

What it receives

The IP address of each check-in and each sign-in from a new device. Off by default. While it is off nothing is sent and the country comes from the network in front of our site.

Nothing is sent to this company while it is switched off.

What for

Lets partners, organisations and the press book a call with our team.

What it receives

What you enter when you book, which is your name, email address, the time and any note, and your IP address and browser details while the calendar is open. Only when you book there. A family asking us to ring back uses our own form, not Cal.com.

Nothing is sent to this company while it is switched off.

What for

AI assistants for accounts that switch them on, and drafting tools for our team (blog articles, social posts, support replies). Each only while switched on.

What it receives

For your account, only what the assistant you use needs. That is the text you write or paste, the details of a memorial page you own, or counts and settings for the planning advisors. For a support reply, your message with email addresses, links and long numbers hidden. Never a message about a death, from a family member or about a crisis. Article and social post drafts send nothing about you.

Nothing is sent to this company while it is switched off.

What for

Wakes someone on our team when something breaks.

What it receives

A short alert, which can include an account id or a ticket reference.

What for

Sells the paid plans as the seller of record. Paddle takes the payment, charges any sales tax or VAT, sends the receipt and pays refunds. Paddle handles that data as a separate controller under its own privacy notice, not as our processor.

What it receives

When you buy, Paddle receives your name, email address, billing address and payment details. We never see your payment details. Paddle tells us your name and email address, what you bought, when, the amount, and whether a payment went through, failed or was refunded.

Nothing is sent to this company while it is switched off.