Privacy policy

Northiom AS (org. no. [ORG NUMBER], [STREET ADDRESS], Gjøvik, Norway) is the controller for the personal data processed in Everhere (everhe.re). Contact us at hello@everhe.re about anything in this policy.

Memorial owners decide what they publish about the person who has died and about others, and are responsible for having the right to publish it.

• Account: your name, email address and Google account ID, which we receive from Google when you sign in. We do not store your Google profile picture and do not access anything else in your Google account.
• Sign-in and security: session identifiers, IP address, browser type and timestamps, used to keep you signed in and to protect the service.
• Memorials you own: the information you add about the person who has died, such as names, dates, places, life story and photos, which may also mention or show other people.
• Contributions: greetings, memories, photos and tributes you leave, shown together with your name.
• Invitations: email addresses that memorial owners enter to give people access. If you were invited, we received your email address from the owner.
• Payments: what you bought, the amount, the date and which memorial it was for. Card details are handled by Stripe and are never sent to us.
• Your acceptance of our terms, and your confirmations when you create a memorial or upload photos, with the date.
• Emails we send you, such as invitations, reminders and payment confirmations, and messages and reports you send us.

• To provide your account, memorials, contributions and purchases (performance of a contract, GDPR article 6(1)(b)).
• To show your name with your contributions and tributes, so families know who wrote to them (performance of a contract).
• To send invitations that memorial owners ask us to send (our and the owner's legitimate interest, article 6(1)(f)).
• To send reminders and payment confirmations (performance of a contract, and legal obligation under consumer law, article 6(1)(c)).
• To keep accounting records required by Norwegian bookkeeping law (legal obligation, article 6(1)(c)).
• To keep the service secure, prevent misuse, handle reports and establish or defend legal claims (legitimate interest, article 6(1)(f)).

We do not use your data for advertising, profiling or automated decisions, and we never sell it.

Data protection law does not protect people who have died, but we treat memorial content with care and respect requests from close relatives. The tradition chosen for a memorial, such as Christian, Jewish or Muslim, describes the person who has died.

Do not publish sensitive information about living people, such as their health, religion, sexual orientation or finances, without their consent. If you share such information about yourself in a contribution, you make it public yourself.

• Public memorials can be read by anyone with the link. Private memorials can only be read by the owner and invited people.
• Contributions and tributes are shown with your name to everyone who can see the memorial. Contributions awaiting approval or hidden by the owner are only visible to the owner and to you.
• Memorial owners can see contributions to their memorials, the email addresses they invited, and the names of people who paid to extend their memorial.
• Memorial pages are marked so that search engines should not index them.
• We never show your email address to other users, except to the owner who invited you.

We use these providers to run Everhere:

• Cloudflare: hosting, databases, file storage and email delivery, as our data processor. Memorial data and photos are stored in the EU.
• Google: sign-in. Google is responsible for your Google account under its own privacy policy.
• Stripe: payment processing. Stripe processes payment data as an independent controller under its own privacy policy.

We may also disclose data when the law requires it, for example to the police on a valid legal request, or when needed to establish or defend legal claims.

Cloudflare, Google and Stripe are based in the United States and may process data there, for example while handling requests, sign-ins or payments. These transfers rely on the EU–US Data Privacy Framework, which all three participate in, and on the European Commission's standard contractual clauses.

• Your account and contributions: until you delete them or your account.
• Memorials: until the owner deletes them. Memorials in archive mode stay online. Drafts that are never published are deleted 12 months after they were created.
• Invitations: until the owner removes them, the memorial is deleted or the invited person deletes their account.
• Sign-in sessions: up to 30 days, or until you sign out.
• Emails we send: 30 days after sending.
• Payment records: 6 years, to meet Norwegian bookkeeping rules. They are no longer linked to you if you delete your account. Unfinished payments are deleted after 30 days.
• Backups: deleted data can remain in database backups for up to 30 days.

You have the right to access your personal data, to have it corrected or deleted, to restrict or object to processing, and to receive your data in a portable format.

You can download your data and delete your account at any time from your dashboard, and delete your own contributions on each memorial. For other requests, email us. We respond within one month and may ask you to confirm your identity.

If someone has published content about you, such as a photo, you can ask the memorial owner to remove it or report it to us.

If you are not satisfied with how we handle your data, you can complain to the Norwegian Data Protection Authority (Datatilsynet) or the data protection authority where you live.

Everhere is not intended for children under 13, and you must be at least 18 to create a memorial or make a payment. Do not upload photos of identifiable children without the consent of a parent or guardian.

We only use cookies that are strictly necessary for the service, so we do not ask for consent:

• everhere.session_token keeps you signed in (up to 30 days).
• A temporary cookie protects the Google sign-in flow (a few minutes).
• Cloudflare may set security cookies to protect the service against abuse.

We do not use analytics, tracking or advertising cookies. Google and Stripe set their own cookies on their pages under their own policies.

We use encrypted connections, private databases and file storage, encrypted sign-in tokens and access limited to what is needed. Photos are resized in your browser and location data is removed before upload.

We update this policy when needed and show the date of the latest change at the top. We tell you about important changes by email or in the service.

Northiom AS · org. no. [ORG NUMBER] · [STREET ADDRESS], Gjøvik, Norway · hello@everhe.re