Privacy Policy

Last updated: 13th October 2026

VisitMyStory provides online memorial experiences alongside synchronised physical memorial plaques. This Privacy Policy explains how VisitMyStory collects, uses, stores, shares and protects personal data when you visit our website, create or contribute to a memorial, purchase our products or services, contact us, register for an account, or otherwise interact with us.

Website: www.visitmystory.com

We take privacy seriously and aim to process personal data lawfully, fairly and transparently.

This Privacy Policy explains our approach under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, and, where applicable, the EU General Data Protection Regulation (EU GDPR).

1. Who We Are

The organisation responsible for deciding how and why your personal data is processed is the data controller.

Data controller: Placzek & Gorania LTD

Trading name: VisitMyStory

Company registration number: 15837057

Email: info@visitmystory.com

Website: www.visitmystory.com

For privacy and data protection enquiries, please contact us using our website contact form or the contact details above.

Data Protection Officer

We have not appointed a Data Protection Officer because we are not legally required to do so. Privacy and data protection enquiries can be made using the contact details above.

2. What Personal Data We Collect

Depending on how you interact with VisitMyStory, we may collect and process the following categories of personal data.

Information you provide to us

This may include:

• name;
• email address;
• postal address;
• telephone number;
• account username and password;
• billing and payment information;
• information provided through contact forms;
• information provided when purchasing a memorial plaque or other service;
• memorial information and biographical information;
• photographs, videos, audio recordings and other media;
• comments, messages and contributions;
• information provided when creating or editing a memorial;
• information provided when communicating with us;
• information relating to orders and transactions.

Information collected automatically

When you use our website, we may collect:

• IP address;
• browser type and version;
• operating system;
• device information;
• approximate location derived from IP address;
• pages visited;
• links clicked;
• date and time of visits;
• referring website;
• website activity and technical information;
• cookie and similar technology information.

Information received from other people

In some circumstances, we may receive personal data from someone other than the individual it relates to.

For example, a person creating or contributing to a memorial may provide information, photographs, stories, comments or other information about a deceased person or about living relatives, friends, contributors, photographers or other identifiable individuals.

Where we receive personal data about a living individual from another person, we will process that information in accordance with applicable data protection law.

3. Memorial Information and Information About Deceased People

VisitMyStory is a memorial service. Information supplied to us may therefore relate to people who have died as well as people who are still living.

The UK GDPR generally applies to information about living individuals. Information relating solely to a deceased person is not generally personal data for UK GDPR purposes.

However, memorial content can contain information about living individuals, including relatives, friends, contributors, photographers or other identifiable people. That information remains subject to applicable data protection law.

4. Potentially Sensitive or Special Category Information

Memorial content can sometimes contain information which falls within the special categories of personal data under the UK GDPR.

• health information;
• medical information;
• religious or philosophical beliefs;
• political opinions;
• racial or ethnic origin;
• sexual orientation;
• other information protected as special category data.

5. Why We Use Your Personal Data

Providing our services

We use information to:

• create and manage memorial pages;
• synchronise digital memorial experiences with physical memorial plaques;
• process orders;
• provide customer support;
• manage user accounts;
• process payments;
• communicate with customers;
• deliver products and services;
• maintain and administer the website.

Website operation and security

• operate and maintain our website;
• authenticate users;
• prevent unauthorised access;
• detect spam;
• prevent fraud and abuse;
• investigate security incidents;
• maintain backups;
• troubleshoot technical problems;
• protect our website, systems and users.

Improving our services

We may analyse appropriate technical and usage information to understand how our website and services are used and to improve functionality, reliability and user experience.

Communications

We may use contact information to send communications relating to your account, orders, memorials, services, website changes, technical matters, migrations, security issues or other matters directly relevant to your relationship with VisitMyStory.

VisitMyStory may send newsletters or general promotional marketing materials about our products and services. We will only send these where you have given consent or, if you are an existing customer, about products and services similar to those you have bought from us, where the law allows this.

Every marketing email includes a link to unsubscribe, and you can also opt out at any time by contacting us. Opting out of marketing does not stop communications about your account, orders or memorials.

6. Our Lawful Bases for Processing

Under the UK GDPR, we must have a lawful basis for processing personal data. The appropriate lawful basis depends on why we are processing the information.

The lawful bases we may rely on include:

We will not rely on legitimate interests where those interests are overridden by your interests or fundamental rights and freedoms.

7. Information You Are Required to Provide

Some personal information is necessary for us to provide particular products or services.

If you do not provide information that is necessary for a particular service, we may be unable to provide that service, process an order, create an account or otherwise fulfil your request.

8. Consent

Where we rely on consent as our lawful basis, consent will be freely given, specific, informed and unambiguous.

You may withdraw consent at any time.

9. Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Cookies and similar technologies may be used to keep you logged in, remember your preferences, maintain website functionality, and improve our services.

Essential cookies and technologies

Essential cookies and similar technologies are used to keep authenticated users signed in, maintain security, remember your cookie preference and provide core website functionality. These technologies may be used without consent where they are strictly necessary for a service you request.

Non-essential cookies and technologies

Optional cookies and similar technologies are disabled until you accept them through our cookie banner. If you reject optional cookies, we do not load optional analytics, advertising or personalisation services. Core memorial content and authentication continue to work because they do not depend on optional consent.

You can change your preference by clearing the VisitMyStory cookie preference in your browser and revisiting the website. The preference is stored in a first-party cookie for 180 days so that we can respect your choice on later visits.

Some memorials include a favourite song played through an embedded Spotify player. Spotify sets its own cookies and receives information about your visit when its player loads, so we only load it if you have accepted optional cookies, or when you choose to play the song. Until then we show a placeholder instead. Spotify's use of your information is covered by Spotify's own privacy policy.

Cookies we use

These are all the cookies that can be set when you use our website. We do not use advertising cookies.

• vms_cookie_consent

  Set by

  VisitMyStory

  Purpose

  Remembers whether you accepted or rejected optional cookies.

  How long it lasts

  180 days

  Type

  Essential

• sb-…-auth-token

  Set by

  VisitMyStory (sign-in, provided by Supabase)

  Purpose

  Keeps you signed in. Only set when you sign in, and may be split into several parts ending .0, .1 and so on.

  How long it lasts

  Up to 400 days, or until you sign out

  Type

  Essential

• mem_unlock_…

  Set by

  VisitMyStory

  Purpose

  Remembers that you entered the correct PIN for a password-protected memorial, so you are not asked again.

  How long it lasts

  24 hours

  Type

  Essential

• ph_…_posthog

  Set by

  PostHog

  Purpose

  A random ID that lets us see which pages a visitor goes between in one visit and across visits, so we can improve the site. Linked to your account ID, never your email, once you sign in.

  How long it lasts

  1 year

  Type

  Optional: only after you accept optional cookies

• sp_t

  Set by

  Spotify

  Purpose

  Set by the Spotify song player on a memorial.

  How long it lasts

  1 year

  Type

  Optional: only after you accept optional cookies or press play

• sp_landing

  Set by

  Spotify

  Purpose

  Set by the Spotify song player on a memorial.

  How long it lasts

  1 day

  Type

  Optional: only after you accept optional cookies or press play

Other technologies that do not use cookies

Vercel BotID runs a security check in your browser to stop automated spam being sent through our contact form. It does not set cookies or store anything on your device, and it is used because it is necessary to keep the website secure.

Vercel Web Analytics and Speed Insights tell us which pages are visited and how quickly they load. They do not set cookies, and they only load if you accept optional cookies. Before anything is sent, we remove the parts of a web address that can carry private information, such as invite links.

PostHog helps us understand how people use the website: which pages they go between, which buttons they use, and where they stop, for example partway through creating a memorial. It only loads if you accept optional cookies, and it stops, and clears what it stored, if you later reject them. It may also record anonymised replays of visits so we can see where the site is confusing. Everything you type is hidden in these replays, and memorial pages and your account pages are blocked out entirely. Before anything is sent, we remove private parts of web addresses and replace the address of each memorial with a placeholder, so PostHog never learns who a memorial is for. PostHog stores this data in the European Union.

When you sign up, publish a memorial, start a checkout or complete a payment, our servers also tell PostHog that the step happened, linked to your account ID (never your name or email). This does not use cookies or anything on your device, and helps us understand which parts of the website lead people to create memorials and order plaques.

Stripehandles payments on its own secure checkout pages. When you pay, Stripe may set its own cookies on those pages, for example to prevent fraud. This is covered by Stripe's own privacy and cookie policies. We do not load Stripe on our own pages.

Platforms currently used by VisitMyStory

Our website currently uses the following technologies and platforms: Vercel (hosting, Vercel BotID for spam protection, and Vercel Web Analytics and Speed Insights, which only load if you accept optional cookies), Supabase (database, sign-in and file storage), Stripe (payments), Resend (email), PostHog (website usage analytics, hosted in the EU, which loads in your browser only if you accept optional cookies), and Spotify (song players on memorials, which only load if you accept optional cookies or choose to play a song).

10. Comments

When visitors leave comments on our website, we collect the information entered into the comments form.

We process this information to operate the comments function, moderate content, prevent spam and protect the website.

11. Media Uploads

Users may be able to upload photographs, videos, audio files or other media. You should ensure that you have the necessary rights, permissions, authority or other lawful basis to upload and publish material, particularly where it contains identifiable living people.

12. Public Memorial Content

Some memorial pages and content may be publicly accessible.

Information that is deliberately published publicly may be accessible to anyone using the internet and may potentially be copied, downloaded, indexed by search engines or reused by third parties.

13. Embedded Content From Other Websites

Some pages may contain embedded content from third-party websites, such as videos, photographs, maps, social media content, or external articles.

14. Who We Share Personal Data With

We may share personal data with third parties where necessary to operate our business and provide our services.

These may include website hosting providers, payment providers, email providers, security providers, analytics providers, delivery providers, professional advisers, accountants, insurers, legal advisers, regulators, and law enforcement where legally required.

15. International Transfers

Some of our service providers may process personal data outside the United Kingdom or European Economic Area. We aim to use service providers that store personal data within the UK or EEA where reasonably possible.

16. How Long We Keep Your Data

We therefore generally retain personal data indefinitely, for as long as we reasonably consider it necessary for the purposes for which it was collected, including providing and maintaining memorial services, maintaining customer and business records, protecting our legal rights, maintaining security, and complying with legal obligations.

17. Registered Users

If you register for an account, we store the personal information you provide in your user profile.

18. Data Security

We take appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, disclosure and misuse.

19. Personal Data Breaches

If we become aware of a personal data breach, we will assess the incident and take appropriate action in accordance with applicable data protection law.

20. Your Data Protection Rights

Depending on the circumstances and applicable law, you may have the following rights: right to be informed, right of access, right to rectification, right to erasure, right to restrict processing, right to data portability, right to object, right to withdraw consent, and rights relating to automated decision-making.

21. How to Exercise Your Rights

Email: info@visitmystory.com

Contact form: www.visitmystory.com/contact

22. Fees for Data Protection Requests

We generally do not charge a fee for exercising your data protection rights.

23. Complaints

If you have concerns about how we use your personal data, we encourage you to contact us first so that we can investigate and attempt to resolve the issue.

You also have the right to complain to the relevant data protection supervisory authority. For UK matters, this is the Information Commissioner's Office (ICO).

24. Children's Privacy

VisitMyStory is intended for users aged 18 and over. We do not knowingly provide accounts to individuals under 18 and do not intentionally collect personal data from children for the purpose of providing accounts or services to them.

25. Automated Decision-Making and Profiling

We do not currently use personal data to make solely automated decisions that produce legal effects or similarly significant effects on individuals.

26. Third-Party Websites and Links

Our website may contain links to websites operated by third parties. We are not responsible for the privacy practices, security or content of third-party websites.

27. Where We Obtain Personal Data

We normally collect personal data directly from you. However, we may also receive information from another person creating or contributing to a memorial, service providers, payment providers, website security providers, publicly available sources, social media platforms, and other organisations where permitted by law.

28. Your Responsibility When Uploading Other People's Information

If you upload photographs, stories, comments, contact details or other information relating to another living individual, you should consider whether you have the appropriate permission, authority or other lawful basis to provide that information to us and publish it.

29. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, the website, our use of personal data, service providers, or applicable law or regulatory guidance.

Last updated: 13th October 2026

30. Contact Us

VisitMyStory

Legal entity: Placzek & Gorania LTD

Website: www.visitmystory.com

Email: info@visitmystory.com

Contact form: www.visitmystory.com/contact