Your GDPR Rights

Right of Access

You have the right to request a copy of all personal data we hold about you. This is sometimes called a "Subject Access Request" (SAR).

What this means for you:

• You can ask us for a complete copy of your account data, memorial content, and any other information we hold — including any report records linked to your account
• We will provide this in a clear, readable format
• We will also tell you how and why we are using your data

Right to Rectification

You have the right to ask us to correct any personal data that is inaccurate or to complete data that is incomplete.

What this means for you:

• If your name, email, or other account details are wrong, you can update them in your account settings or ask us to correct them
• You can edit memorial content directly through your dashboard
• If you spot any other inaccuracies, let us know and we will fix them promptly

Right to Erasure ("Right to be Forgotten")

You have the right to request that we delete your personal data in certain circumstances.

What this means for you:

• You can request deletion of your account and all associated personal data
• We will delete your personal data within 30 days of a verified request
• You can also request deletion of specific data (e.g., individual photos or condolences)
• Some records are kept for a limited period even after erasure where we have an overriding legitimate interest or legal obligation: report records (reporter IP, optional email, account ID) are kept for up to 24 months for abuse prevention, and submitter IP and payment identity linked to a notice are kept for fraud and harassment investigation (payment records for 7 years under Irish tax law). See our Privacy Policy for details

Right to Restrict Processing

You have the right to ask us to limit how we use your data in certain circumstances.

When you might use this:

• You believe your data is inaccurate and want us to stop using it while we verify
• Our processing is unlawful but you prefer restriction over deletion
• We no longer need your data but you need it for legal claims
• You have objected to processing and are waiting for us to verify our grounds

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV).

What this means for you:

• Self-serve download. Sign in, open Account Settings → Privacy & Data and click Download My Data. You'll get a single JSON file containing your account, memorials, photos, condolences, payments, and AI history. Photo and video files are referenced by URL — download them directly from the URLs in the export.
• If you need the export in a different format, email [email protected] and we'll respond within the 30-day GDPR window.
• This right applies to data you provided to us and that we process based on consent or contract.

Right to Object

You have the right to object to our processing of your data when we rely on "legitimate interests" as our legal basis.

What this means for you:

• You can object to us using your data for service improvement analytics
• If you object, we will stop processing unless we can demonstrate compelling legitimate grounds
• You can object to direct marketing at any time (though we currently only send transactional emails)

Rights Related to Automated Decision-Making

GDPR gives you rights regarding automated decisions that significantly affect you.

How this applies at MemoryMantle:

We do not make automated decisions that significantly affect you. Our AI photo enhancement feature is a tool that processes your photos to improve quality — it is not a decision-making process. You always have full control over whether to use enhanced photos or keep the originals.

Our condolence moderation system may flag content for review, but a human always makes the final decision on content removal.