User Data Policy

1. Scope

This policy explains, in practical terms, what Surnuaiapüha stores for an Account Holder and for each memorial Profile, what becomes public, and how you can export or delete it. It supplements our Privacy Policy.

2. What we store

• Your account email and sign-in records.
• For each Profile: name, dates of birth and death, place of birth, written remembrance, family-tree relationships, uploaded photographs, the grave photograph, the grave map pin and its category.
• Private identifiers you choose to record for family members, such as personal identity codes.
• Payment records: amount, date and the processor's reference.

3. Public versus private

A published Profile shows the name, dates, written remembrance, photographs and — where set — the grave map pin, to anyone visiting the site or the public map. Private identifiers, your account email and your payment records are never shown publicly and are never included in the public map data.

The public map is served from a restricted view that exposes only the pin coordinates, the memorial name, the category icon and the link to the memorial page.

4. Connected accounts

If you choose to connect a third-party account (such as Facebook) to import photographs, we store only the connection tokens and the items you select. You can disconnect at any time from your dashboard, which deletes the stored tokens.

5. Data deletion callback

For platforms that require one, our data deletion callback is https://www.surnuaiapüha.ee/api/public/facebook/data-deletion. On a valid request we record it, delete every matching connection in our database, return a confirmation code, and point you at our data deletion status page so the deletion can be verified.

6. Export and deletion

Email support@balticmemorials.com to request a copy of your data, a correction, or the deletion of a Profile or your whole account. We verify the request and respond within 30 days. Because memorials are meant to endure, we may contact other people named as collaborators on a Profile before deleting published content.

7. Security

All data is stored in an encrypted database with row-level security so only you, and our administrative processes acting on your behalf, can read your private records. Secrets and tokens are stored server-side and never exposed to the browser.

8. Contact

Digitalsurfing Limited, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom · support@balticmemorials.com.