Legal

Privacy Notice

Last updated: 17 May 2026.

This document is a draft pending legal review. Wording will be finalised by Aoife with legal counsel before publication.

1. Data controller

Theirs & Ours Pte Ltd, a company incorporated in Singapore, is the data controller for the personal data described in this notice. You can contact us at privacy@theirsandours.com. (This is a placeholder address pending confirmation.)

2. What we collect

Account data

Name, email address, and delivery address you provide when creating an account or paying for a book.

Content

Photos and voice or video recordings you and your contributors upload.
Written memories, messages, and notes contributors submit.
The names of the people who contribute and of the person the book is about.

Payment data

Card details are entered directly with our payment provider Stripe. We do not store card numbers, CVCs, or expiry dates on our own systems. We receive only the transaction reference, the amount, and the success or failure status.

Technical data

Session identifiers and IP addresses are processed at request time to operate the service. We do not store long-term tracking data and we do not use third-party tracking cookies.

3. Lawful basis

We process personal data under one of the following lawful bases:

Contract: Processing necessary to produce and deliver the book you have ordered.
Consent: For contributor submissions, which contributors agree to via the consent statement shown at the time of submission. Consent text is snapshotted with each contribution so the wording in force at the time of submission is preserved alongside the record.
Legal obligation: Where we are required to retain records — for example, transaction records for tax purposes.
Legitimate interest: For operational purposes such as fraud prevention and service security, where this interest is not overridden by your rights.

4. How we use it

To produce, print, and deliver the book you have ordered.
To coordinate contributors (sending invite links, edit links, and thank-you notifications).
To process payments and issue receipts.
To provide customer support.
To comply with legal obligations.

We do not use your content or personal data to train AI models. We do not sell personal data or content to anyone.

5. Sub-processors

We use the following sub-processors to deliver the service:

Cloudflare R2: Storage of photos and voice or video recordings (United States, with regional replication where available).
Anthropic Claude: AI writing assistance for AI-generated text in the book (United States).
Replicate: Photo enhancement (United States).
Stripe: Payment processing (United States, with Ireland for European payments).
Cloudprinter: Book printing and fulfilment (multiple regions, enabling print-near-delivery).
Resend: Transactional email delivery (United States).
Twilio: WhatsApp and SMS messaging where the product uses messaging features (United States, with regional infrastructure).
Upstash: Key-value cache storage (Singapore region for our account).
Neon: Primary database hosting (regions selected by us; current configuration uses Asia-Pacific).

Each sub-processor has its own privacy practices and security controls. We review the sub-processor list before adding new processors.

6. Data retention

Book project data: Content, contributor information, and project configuration are retained while the project is active and as needed to fulfil the book.
QR-coded voice and video assets: Where the book product includes voice or video assets accessed via a QR code, those assets are retained for a minimum of ten years from the date of print, in line with the product commitment to long-term recipient access.
Account data: Retained while your account is active. Deleted on account closure, except where retention is required to satisfy legal or tax obligations (typically up to seven years for transaction records).
Backups: Routine backups are retained for up to ninety days before being overwritten.

7. Your rights

Under the UK GDPR, EU GDPR, Singapore PDPA, and applicable US state privacy laws (including CCPA and CPRA), you have the right to:

access the personal data we hold about you;
correct inaccurate or incomplete personal data;
request deletion of your personal data, subject to legal retention obligations;
export your personal data in a structured, machine-readable format;
object to processing based on legitimate interests;
withdraw consent at any time, where consent is the lawful basis.

To exercise any of these rights, email privacy@theirsandours.com. We will respond within thirty days.

If you are not satisfied with our response, you have the right to complain to your local data protection regulator — the Information Commissioner's Office in the UK, your national supervisory authority in the EU, the Personal Data Protection Commission in Singapore, or the relevant state authority in the United States.

8. International data transfers

Personal data may be transferred outside the UK, the EU, or Singapore to sub-processors located in the United States and other jurisdictions. These transfers are safeguarded by standard contractual clauses approved by the relevant data protection authorities and, where applicable, by additional technical and organisational measures.

9. Memorial-specific handling

When you create a memorial board or book, the content concerns a deceased person and may include information about that person contributed by family, friends, and colleagues.

We rely on you, the buyer, to confirm contributors have agreed to inclusion at the time of contribution. Consent text is shown to each contributor before submission.
We will action takedown requests from contributors, from the buyer, or from people with legitimate standing to act on behalf of the deceased person.
Memorial content is retained on the same schedule as other content unless takedown is requested.

10. Cookies and similar technologies

We use a small number of session cookies necessary for the service to operate (sign-in state, draft preservation in the buyer wizard, language preference). We do not use third-party tracking cookies. We do not use advertising or analytics cookies.

11. Contact

For privacy questions or to exercise your rights, email privacy@theirsandours.com. (This is a placeholder address pending confirmation.)

12. Updates

We may update this notice from time to time. Material changes will be notified by email to the address on your account at least thirty days before they take effect.