Privacy Policy

1. Who We Are

Eternal Rest (“we”, “our”, “us”) operates this website as a platform for publishing death notices, family notices, and condolence books. For data protection enquiries, contact us at info@eternalrest.com.tt.

2. What Data We Collect

We collect the following information:

• Account information: Email address and optional display name for public, funeral director and administrator accounts. Supabase manages authentication, password hashing and sessions. Your private account name is not automatically published with a contribution.
• Saved notices and searches: Private notice references, search names and structured filters. Notices you save do not reveal a public follower count or subscribe you to email. A withdrawn notice leaves only a removable unavailable entry.
• Notice alerts: Only when you explicitly opt in, your current confirmed login email, consent time and version, search alert start time, matching references and delivery status. We do not use candle, enquiry or payment addresses for these alerts.
• Notice content: Names, locations, dates, obituary text, photos, and other details included in death and family notices.
• Condolences and messages: Author name and message text, with a private one-way identifier for abuse prevention. Older records may retain an IP address until the verified privacy migration is complete.
• Funeral director enquiries: Your name, phone number, service needs and message; email is optional for your receipt and contact about the enquiry. Submitting does not subscribe you to marketing.
• Candles: An optional signature name, separate permission to display it after review, and an email address only when you request a private receipt. A salted identifier limits repeated lighting; your email and identifier are never public.
• Condolence photos and reports: Your submitted display name, prepared photograph, upload permission, submission reference and moderation status; reports include a reason and optional details. The original photograph is prepared in your browser before upload. The server checks the prepared image again and stores a resized JPEG without location or camera metadata. Private moderation history can retain original text, corrections, reasons and decisions.
• Security and delivery: Request information needed to run the website, authentication audit events, rate-limit identifiers and delivery outcomes. Hosting, authentication, payment, map and email providers receive request information needed for their services. This is separate from advertising or audience analytics.
• Payment data: Stripe processes card details. We retain private payment and refund amounts, currencies, statuses, provider references and reconciliation records.

3. How We Use Your Data

• To publish and display death and family notices
• To enable condolence books and message walls
• To moderate user-submitted content
• To prevent abuse and enforce community guidelines
• To process payments for family notice publication
• To send transactional emails (password resets, confirmations)
• To keep your private saved lists across devices and send optional daily notice digests at 08:00 Trinidad & Tobago time. Digests cover new matching publications since you enabled alerts, independently of the saved death-search publication shortcut.

4. Your choices

Browsing does not require an account. Publishing a notice, sending an enquiry, displaying a candle signature, requesting a receipt and enabling notice alerts are separate choices. Giving us an email for one purpose does not subscribe you to another. Only submit content and photographs you have permission to share.

5. Data Sharing

We do not sell personal data. We share data with:

• Supabase: Database and authentication hosting
• Vercel: Application hosting
• Stripe: Payment processing
• Resend: Transactional email delivery
• OpenStreetMap: Map tiles requested by your browser when a location map is displayed. The tile service receives your IP address and requested map area. Addresses and directions links remain available if the map fails to load.
• Links you open: Hosted Stripe Checkout, Google Maps directions, WhatsApp and social sharing links open external services. Their processing applies when you visit them; a link is separate from an advertising cookie.
• Enquiry recipients: The verified funeral director team or the Eternal Rest enquiry team identified on your receipt. Authorised platform administrators can access the private enquiry to route, review and handle it. A receipt confirms acceptance, not that a business has contacted you.
• Requested Facebook sharing: Only the named pages you select receive managed sharing requests. Their operators share the approved notice and public link. Withdrawing a request stops unstarted work; an existing or uncertain external post needs operator reconciliation and removal. We retain consent and outcome records and do not promise a posting time.

7. Access, correction and removal requests

To request access to, correction of or removal of your information, contact info@eternalrest.com.tt. Include the relevant public notice URL or private receipt reference and describe your request. Do not email passwords, card details or private capability links. We may need to verify your authority before disclosing or changing a record. A shared name alone does not establish that authority. Requests involving published content, another contributor or retained payment evidence require individual review.

8. Data Retention

Published notices can remain as permanent public records. Family listing and message-wall periods are separate from the approved detail page, and moderation or withdrawal can remove public access. Approved messages remain with a public notice after ordinary wall closure. Account data is retained while the account is active. A visitor can request account deletion in settings; the account becomes unavailable immediately while the removal finishes. Existing notices, separately submitted messages, referenced photographs and payment records may remain after the account link is removed.

Unpaid family drafts normally expire 90 days after their last changed save, with 30 days to recover after expiry or deletion. Removed draft photographs can be restored for seven days. Cleanup can take longer when a service fails; access ends at the recovery boundary. Payment uncertainty, disputes and referenced content can delay erasure. Once abandoned checkout submissions are confirmed unpaid and eligible, their original content is removed while minimal payment and duplicate prevention records remain. Completed redaction cannot be undone.

Account settings also lets you change your display name, confirm an email change, change your password, or sign out on this or all devices. Creating an account does not subscribe you to alerts. Business and administrator account removal requires an ownership review through support.

Manage individual searches or stop all notice alerts in notification preferences. Email unsubscribe needs no login; opening a confirmation link alone does not unsubscribe. Changing your login email pauses alerts until you confirm and explicitly opt in again. Account deletion removes saved notices, searches and their preferences, and suppresses pending alert emails.

Digest operational records and email content are retained for up to 90 days after completion or terminal cancellation. Matching references from an old alert period are removed 30 days after that period changes. References for a currently active alert period remain to prevent repeated emails; they contain notice identities, not copied obituary content. Removing a saved search removes its matching preferences and evidence and stops pending matches from being sent.

Enquiries and private contact notes are retained while open and for 365 days after closure. After that, we remove names, phone numbers, email addresses, message content and private note text, while retaining non-identifying receipt, status and outcome history. Open enquiries are reviewed after 365 days and rechecked every 90 days. Abuse-prevention IP hashes are due for removal after 30 days, including for open enquiries. Notification recipient and content data is due for removal 30 days after resolution, or 90 days when unresolved; minimal duplicate-prevention and delivery outcomes remain. Cleanup failures can delay erasure; scrubbed notifications cannot be resent.

Completed account-removal operational records are scheduled for removal after 90 days. If removal encounters a service problem, the disabled account remains pending for recovery. Contact support separately to request removal of published content.

Approved condolence photographs remain available while their parent notice and photo wall are public. Rejected photographs become unavailable immediately and are due for private byte deletion after 30 days. Failed or expired upload reservations are normally retained for seven days while outstanding object references are reconciled. Resolved report details and reporter identifiers are redacted after 90 days; resolved report records are retained for 365 days. Private text correction snapshots remain while the contribution is public, then become eligible for redaction after 365 continuously non-public days. Storage failures or unresolved references can delay physical cleanup without extending public access.

Withdrawal stops new public access on this website. It cannot recall copies already downloaded, printed, emailed or shared elsewhere. Protected recovery backups and unresolved payment, abuse or ownership evidence need separate review; restoring a backup must preserve newer removal and unsubscribe decisions.

9. Contact

For any privacy-related questions, contact us at info@eternalrest.com.tt.

Candle signatures and private links

Signing is optional. Your name stays private unless you separately request public display and an administrator approves it. You can edit for ten minutes after lighting. Your private receipt link grants read and removal access for 30 days; anyone with that link has the same access. Where available, we keep the link in this browser tab's session storage and remove its secret from the address bar after opening it. An account does not own an anonymous candle.

Removing your signature immediately hides the name and revokes the link, while the candle remains counted. A requested email is for one receipt only and never subscribes you to marketing. Unsent receipts are cancelled after removal or expiry; an email already in transit may arrive, but its revoked link cannot be used.

The abuse identifier stops being used after 24 hours. Private names, emails and receipt access expire after 30 days. Daily cleanup normally erases identifiers within 48 hours and private signature data within 31 days of lighting; a delayed cleanup does not extend access. Approved names with public permission may remain until withdrawn or moderated away. After your link expires, contact info@eternalrest.com.tt for a privacy removal request. A name alone does not establish authority to inspect another person's information.