1. Who we are
Whole Life Story is run by VirtualCup Solutions, Mabini 3rd, Digos City, Davao del Sur, Philippines. We decide how the personal information described here is used, which makes us its personal information controller under the Data Privacy Act.
2. Whose information this covers
A memorial page is about someone who has died, but the people around the page are living, and this policy is mostly about them:
- people who create an account, make a page or order a memorial piece;
- family members who have an account and help look after a page;
- people who write on a page’s memory wall or leave a tribute;
- staff of funeral homes, memorial parks and other partners who work with us;
- anyone who visits a page.
The Data Privacy Act lets the lawful heirs of a person who has died exercise that person’s rights. Section 10 explains how to reach us.
3. What we collect and why
If you order a memorial piece
- Your name and phone number, to confirm the order, arrange delivery and collect cash on delivery.
- Your email address, if you give one.
- The delivery address and any delivery notes, such as where the wake is.
- What you ordered, the text to engrave, and the proof you approved, with who approved it, when and how. This is our record if an engraving is ever disputed.
- Payment records: the method, amount and status, and for online payments the reference from our payment provider. We never receive your card details.
- The version of this policy shown to you when you ordered.
If you have an account
- Your name and email address, and your phone number if you give one.
- The pages you are a member of, your role on each, and the invite link you joined through, with who made it and when you used it.
- For each sign-in, the IP address and browser it came from, to keep your account secure.
- When you accepted these terms and this policy, and which versions.
- Whether you want emails about your pages. We email you when a message is waiting on a memory wall you look after; a few days before the 40th day, each death anniversary, the person’s birthday and Undas, using the dates on the page; up to three times while a page you started is still unpublished; and once if a payment you began was not completed. You can turn these off in your account settings; sign-in and security emails are not affected.
What families add to a page
The story, dates, photos, recordings, documents, video links, captions and milestones; the short lines on what they were known for, who loved them and what they often said; what the family loved about them; the favourite song with a note about it; and, for a page made during the wake, the wake’s and interment’s place and dates, a map link and, if the family chooses, their own payment QR image and a name for abuloy, shown to anyone with the page’s address until the last date has passed. Photos are prepared on your own device before they are sent: very large photos are made smaller (up to 3,500 pixels on the longest side), and the details your phone or camera stored inside the file, such as when and where it was taken, are removed. We keep only that prepared copy, not the file on your device. Recordings and documents are kept as they were uploaded.
If you write on a memory wall or leave a tribute
- On the memory wall: your name, how you knew the person if you say, and what you write. Your email address is optional. It is never shown on the page and never included in the copy of the page its owner can download.
- For a tribute: your name, if you give one. It is shown only to the page’s family members. Everyone else sees only how many tributes were left.
- A scrambled form of your IP address, to stop spam and abuse. We scramble the address with a secret key (a keyed hash), so it can’t be turned back into the original address.
- On the memory wall, the version of this policy shown to you.
- Before a memory wall message is sent, Cloudflare Turnstile checks that it comes from a person and not a program. The check runs in your browser and looks at technical signals from your browser and device. Most people never see it. We don’t send Cloudflare your IP address, and we receive only whether the check passed.
If you visit a page
We limit how often a page can be requested from one connection, using the same scrambled form of your IP address. We count page views and QR code scans as totals, not per person. If a page fails to load, our error reporting receives technical details about the failure, such as the page address and browser.
The record of changes
Every change to a page is recorded: what changed, when, and who made it. Each entry keeps a copy of that person’s name and email address and the scrambled form of their IP address. The record can’t be edited or deleted, and entries stay even if the person later deletes their account, because it is how disagreements about a page are settled.
Partners and feedback
For partners we keep the business’s name and location and a contact name and phone number. Orders and pages record which partner brought them in, so commissions are paid from records. If you send us feedback, we keep your message and your email address if you give one.
4. Why we are allowed to use it
- Your consent, when you create an account, order a piece or write on a memory wall. We record which version of this policy you agreed to.
- Our agreement with you, to make and deliver what you ordered and to keep the page you manage.
- Legitimate interests: keeping accounts secure, stopping spam and abuse (including the Cloudflare check on the memory wall), and keeping the record of changes that settles disagreements.
- Legal obligations, such as keeping order and payment records for tax purposes.
5. Who can see what
A page that isn’t published yet can be seen only by its members. Once it is published, the person’s name, portrait, dates, epitaph, resting place (with the map link and photo of it, if the family adds them), favourite song and the short remembered-for lines (known for, loved by, often said) are always visible to anyone with the page’s address or code. They repeat what is written on the headstone or said at the wake.
Every other section, such as the story, photos, milestones, recordings and the memory wall, has its own setting, chosen by the family:
- Public: anyone who opens the page.
- Family: members of the page, and anyone who enters the page’s family code. The family code is short, so it can be said aloud at a wake. We store it encrypted, so members can read it back to relatives, and we limit how many times it can be tried. Some pieces that stay with one person, such as a pendant, can be set so that scanning them also opens the family sections.
- Members: only signed-in members of the page.
- Hidden: not shown on the page at all.
The owner can also lock the whole page. Then visitors see only the name, portrait, dates, epitaph, resting place, favourite song and the remembered-for lines until they enter the family code, and the memory wall and tributes wait for the code too.
The owner can make a published page private again. While it is private, its address and codes show only a short notice, without the person’s name or photo, and only the page’s members can see the page.
A page’s address is chosen by the owner when they publish it, and it usually carries the person’s name, so anyone may guess it. The section settings, not the address, are what keep private material private.
Pages are unlisted unless the owner chooses otherwise: we tell search engines only about pages the owner has chosen to let them list. What people write on the memory wall appears only after the family approves it.
A page’s members can see each other’s names and roles. Members who can invite also see who made and used each invite link. Members never see each other’s email addresses.
Our own staff can see what they need to run the service: to make and deliver orders, help families, and settle disagreements.
7. How long we keep it
- When something on a page is deleted, such as a photo or a message on the memory wall, it can be restored for 90 days. After that it is deleted permanently.
- When the owner deletes a whole page, they can restore it for 30 days. After that its story, dates, photos, recordings, documents, milestones, memory wall and tributes are deleted permanently. We keep the person’s name, the page’s web addresses, which usually carry the name, and its QR codes, so they keep showing a notice that the page was taken down and are never given to anyone else. Order records for the page are kept as described below.
- A page the owner makes private is not deleted. Everything on it is kept until it is published again or deleted.
- Accounts are kept until you delete yours. Deleting it removes your membership of every page. Entries about you in the record of changes stay, as described in section 3.
- A family copy of a page is deleted 7 days after it is made.
- Sign-in records are kept while the sign-in is active.
- Order and payment records are kept for as long as tax and accounting law requires.
- The scrambled IP addresses used to limit requests expire within minutes. Those stored with a memory wall message or a tribute are kept with it.
8. Copies of a page
The family copy
The owner of a page can download a copy of all of its content at any time, as a ZIP file, including sections kept private, because the content is the family’s. We make the file when the owner asks for it, send them an email when it is ready, and delete the file 7 days later. Only the owner can download it, through a link that works for a few minutes. It doesn’t include other people’s personal information that the family doesn’t need, such as the email addresses of people who wrote on the memory wall or scrambled IP addresses.
The public copy
We are building a simple copy of every page’s public sections, kept on plain file storage, so the pages can stay online even if Whole Life Story ever closes or is sold. It will hold public sections only. Sections a family keeps private will never be published there, and when a section stops being public, it will be removed from the copy. We will update this policy when the copy is running.
9. How we protect it
- Connections to Whole Life Story are encrypted.
- Family codes are stored encrypted.
- Invite links are stored only in scrambled form, so a copy of our database can’t be used to join a page.
- IP addresses are stored only in scrambled form, except in sign-in records, which keep your account secure.
- Family codes, sign-ins, memory wall messages and QR scans are all limited in how often they can be tried.
10. Your rights
Under the Data Privacy Act you have the right to:
- be told how your personal information is used, as this policy does;
- see the personal information we hold about you;
- have it corrected;
- object to how it is used, or withdraw consent you gave;
- have it deleted or blocked;
- receive a copy of it in a format you can reuse;
- complain to the National Privacy Commission, and claim damages if your rights were violated.
You can download the information your account holds, and delete your account, from your account settings. For anything else, contact us using the details in section 13. Some things we can’t delete, such as entries in the record of changes and order records the law requires us to keep. We will tell you when that applies.
12. Changes to this policy
When this policy changes in a way that matters, we publish a new version and update the version and date at the top of this page. We record which version each person agreed to, and we may ask you to agree to the new one.
13. Contact us
VirtualCup Solutions
Mabini 3rd, Digos City, Davao del Sur, Philippines
Write to us at the address above about anything in this policy, or to exercise any of the rights in section 10. Privacy questions reach our Data Protection Officer at VirtualCup Solutions, who answers them.