Legal

Privacy policy

Last updated: 10 October 2026

Who we are

Northstar Keep is operated by Northstar Keep Ltd, a company registered in England and Wales (company number 17140276), registered office 49 High Street, Sutton Courtenay, Abingdon OX14 4AT. We are registered with the Information Commissioner's Office (ICO) under registration reference ZC233917 and pay the annual data protection fee. We are the controller for the personal data described here.

If you have questions about your data, contact us at hello@northstarkeep.com.

Who this policy covers

This policy is for everyone whose personal data we handle:

–people with a Northstar Keep account, including memorial owners, editors and funeral professionals
–people who visit a memorial, contribute to it, comment, react, reply to a funeral invitation or ask to see it
–people who are named or shown on a memorial
–people who contact us or report something to us

People who have died

UK data protection law protects living people. Information about someone who has died is not personal data in law, but we treat it with the same care, because it matters to the people who loved them and because it can also say something about their living family.

What we do with personal data, and why

For each thing we do, this section sets out why we do it, what we hold, the lawful basis we rely on under UK GDPR, how long we keep it, and who else receives it.

Where we rely on legitimate interests, we have weighed those interests against your rights and expectations. You can object at any time; see “Your rights”.

Your account

Why: To let you sign in, create and manage memorials, and contact you about your account.
What we hold: Your name and email address. If you register as a funeral professional, your funeral home name and phone number. When you sign up, how you reached our sign-up page: the website that linked to it (its address only, not the page) and any campaign tags in the link. We also record any ?ref= code in the link and the date you signed up. We read this from the page as you sign up and store nothing in your browser to do it.
Lawful basis: Contract: we need your account details to provide the service you signed up for. How you found us: legitimate interests, so we can understand which introductions to Northstar Keep work.
How long we keep it: Until you close your account. Closing your account deletes it, the memorials you own, the photos you uploaded as covers, messages sent to you through Northstar Keep, and anything you kept as "Just me". What you added to memorials other people own stays there as part of that family's record; see "Your rights". Deletion is refused only while an investigation into a memorial you own is open, because we must keep the evidence; see "Your rights".
Who else receives it: Supabase, which hosts our database in London and sends sign-in emails through Resend, and Vercel, which hosts the website.

Memorials

Why: To create, store and show a memorial page to the people its owner chooses.
What we hold: What the owner and their editors add: the name, dates, biography, photos and music of the person being remembered; funeral details and places that mattered to them; and the email address of the person the owner names to take the memorial over. Memorials often mention or show living people, such as family and friends.
Lawful basis: Contract with the memorial owner. For living people named or shown on a memorial, and for the named successor: legitimate interests, which are the owner's and their family's interest in remembering someone together, and in the memorial carrying on if its owner can no longer look after it. Anyone named or shown can ask us to remove something about them; see "Your rights".
How long we keep it: Until the memorial is deleted by its owner, or removed by us. After that, photos and other media stay in our media backup for up to 90 days, and the rest in our database backups for up to 7 days. If you stop helping run a memorial, for example because the owner removes you or a family takes it over, anything you kept there as "Just me" stays yours to download from your account settings for 90 days. We email you when this starts and again 14 days before we delete it. If the memorial is suspended, you cannot download them, we do not send these emails and we do not delete them while it is suspended, and the 90 days start again once it is restored. If a memorial is deleted, everything on it is deleted, including things people kept as "Just me". If a memorial's owner closes their account, we email anyone who kept something there as "Just me".
Who else receives it: Whoever the owner lets see the memorial, according to its privacy setting. Owners and editors can keep things as "Just me". Only the person who kept something as "Just me" can see it on Northstar Keep. They are still checked for child sexual abuse imagery like every other upload, and we can see and remove them if they are reported or break our rules. Supabase (storage), Cloudflare (backups). Mapbox, if a visitor chooses to show the memorial's places on a map. Spotify, if a visitor chooses to play its playlist.

Contributions, comments and reactions

Why: To let people share memories, photos, messages and reactions on a memorial, and to let the family see who contributed and thank them.
What we hold: Your name, your email address, what you contributed and, if you were signed in, which account you used. We keep that account link so that you can change your words later. If you leave a reaction or message as a guest, your name and email address are also saved in your own browser so you do not have to type them again, until you close the tab.
Lawful basis: Legitimate interests: sharing remembrance of someone, and letting the family reply to and thank the people who contributed. We do not use your email address for anything else, and we never market to you through a memorial you contributed to.
How long we keep it: For as long as the memorial exists. If you were signed in when you contributed, we record which account it came from. Closing your Northstar Keep account removes that record but not the contribution. Ask us, or the memorial's owner, if you want something you added taken down.
Who else receives it: The memorial's owner and editors can see your name and email address. When you add a message, photo, video, recording or guestbook entry, you choose who can see it: everyone who can see the memorial, or only the family and the people helping run it. Your name is shown with what you add, to whoever can see it. Flowers, candles and donations are always shown on the memorial. The owner and editors receive a daily summary email that includes contributors' names. Emails are delivered by Resend.

Messages, access requests and funeral replies

Why: To pass on messages to a memorial's creator, handle requests to see a memorial that needs approval, and let the family know who is coming to a funeral.
What we hold: Your name, email address and message. For an access request, whether it was approved, declined or blocked, and by whom. For a funeral reply, your name, how many people are coming and any message you add; we do not ask for an email address.
Lawful basis: Legitimate interests: letting people reach the family, and letting the family decide who can see a memorial and plan a funeral.
How long we keep it: For as long as the memorial exists.
Who else receives it: The memorial's owner and editors. Emails are delivered by Resend.

Invitations and handing a memorial over

Why: To invite someone to help edit a memorial, and to pass a memorial from the person who created it, such as a funeral director, to the family.
What we hold: The email address of the person invited or named as successor, who sent the invitation, and when it was accepted. An invitation link works for 7 days and a handover link for 14 days.
Lawful basis: Contract with the memorial owner, and legitimate interests for the person invited or named.
How long we keep it: For as long as the memorial exists. If an invitation expires without being accepted, we delete the email address 30 days later.
Who else receives it: The person invited. When a memorial is handed over, its other editors are told, including the email address of the person who took it over. Emails are delivered by Resend.

Reports, moderation and removal requests

Why: To keep memorials safe and lawful: to receive reports about content, review them, remove content where needed, and keep a record of what we did.
What we hold: The content reported and why. If you report something, a coded version of your internet (IP) address, so the same person cannot report one item repeatedly. We store the coded version, not the address itself. If you give us an email address or a note with a report, it is sent to our moderation inbox and is not stored in our database. A record of each moderation decision and who made it.
Lawful basis: Legal obligation, under the Online Safety Act 2023, and legitimate interests in keeping the service safe.
How long we keep it: Moderation records are kept for 6 years, including after the content they describe is deleted, so that there is an accurate record of what was reported and what we did. Report emails are kept in our inbox for up to 2 years, or longer only while a case is open or a legal claim needs them.
Who else receives it: Where the law requires it, the National Crime Agency or other authorities. When content is hidden after a report, the memorial's owner and editors are told that it was hidden, but not who reported it or why.

Importing from Facebook

Why: To let a memorial owner bring photos and posts from a Facebook download into a memorial.
What we hold: The Facebook download file the owner uploads, and the photos and posts in it. These can include posts and photos by other people. Photos and posts imported from Facebook can be seen by whoever the person importing them chooses, with only the family selected to start with. To change this, remove them on the import page and add them again, within 30 days of the last time anything was added to or removed from that import. Their dates are the dates they were posted.
Lawful basis: Contract with the memorial owner. For other people in the download: legitimate interests, as for memorials above.
How long we keep it: The uploaded file is deleted once it has been read. Anything the owner does not add to the memorial is deleted 30 days after the upload, or 30 days after they last added or removed items from that import, if that is later. Anything they add is kept as part of the memorial.
Who else receives it: Supabase (storage). We do not connect to Facebook; we only read the file you upload.

Payments

Why: To take payment for paid plans and keep the records the law requires.
What we hold: Which plan you bought, its status and renewal dates, and the reference numbers Paddle gives us. We never receive your card details, and we do not store your name or billing address.
Lawful basis: Contract, and legal obligation for tax and accounting records.
How long we keep it: 6 years from the end of the financial year in which the payment was made, as tax and accounting law requires.
Who else receives it: Paddle.com Market Ltd, 30 Old Bailey, London EC4M 7AU, which sells our paid plans as the merchant of record and processes your payment. When you go to checkout we give Paddle your email address and a reference to your account or memorial. Paddle holds the invoices as merchant of record. It is an independent controller for your payment data, and handles it under its own privacy policy.

Emails we send

Why: To send the emails the service depends on: sign-in links, invitations, notifications about contributions and access requests, replies, and daily summaries. And, only if a memorial's owner has turned them on, anniversary reminders: once a year on the birthday and the anniversary of the death of the person remembered, an email to the memorial's owner and editors inviting them to add a memory. Every reminder has a link to stop them for that memorial, and the owner can turn them off for everyone in the memorial's settings.
What we hold: Your email address and name, and what the email is about.
Lawful basis: Contract for account holders; legitimate interests for everyone else, as described in the sections above.
How long we keep it: In our email provider's records for the provider's standard period, typically days to a few weeks. For anniversary reminders we also keep a record of which reminder went to which account on which date, so that none is sent twice, for 400 days, and a record of anyone who stopped them for as long as the memorial and their account exist. Emails you send to hello@northstarkeep.com are kept for up to 2 years, or longer only while a case is open or a legal claim needs them. To stop our contact forms being misused, we keep a one-way coded version of the sender's IP address for 30 days.
Who else receives it: Resend, which delivers our emails. Sign-in emails are sent by Supabase, through Resend.

Keeping the service secure

Why: To prevent abuse, such as spam, repeated uploads or someone returning after being banned.
What we hold: One-way coded versions of IP addresses, and of the email addresses of people banned from the service. Upload records are deleted after 24 hours.
Lawful basis: Legitimate interests in keeping the service secure and available.
How long we keep it: Upload records for 24 hours; contact form records for 30 days; ban records for as long as the ban applies.
Who else receives it: No one.

Backups

Why: To recover photos and other media if something is lost.
What we hold: Copies of the photos and other media on memorials.
Lawful basis: Legitimate interests in not losing what families have entrusted to us.
How long we keep it: Media is copied to an encrypted backup once a week, and backup copies are deleted automatically within 90 days. If you ask us to remove something, we can delete its backup copy straight away. Our database is backed up daily by Supabase, and each backup is kept for 7 days.
Who else receives it: Cloudflare, which stores the media backup, and Supabase, which holds the database backups in London.

Understanding how the site is used

Why: To see which pages are visited, so we can improve the site.
What we hold: We use Vercel Web Analytics, which does not use cookies. It records the page visited, including a memorial's web address, the website you came from, your browser, your type of device and your country.
Lawful basis: Legitimate interests in running and improving the service.
How long we keep it: By Vercel for the provider's standard period, typically days to a few weeks.
Who else receives it: Vercel.

Running Northstar Keep

Why: To keep an eye on the service day to day.
What we hold: Once a day we email ourselves a summary that includes the names and email addresses of people who registered that day and the names of new memorials.
Lawful basis: Legitimate interests in running the business.
How long we keep it: In our own inbox for up to 2 years.
Who else receives it: Resend delivers the email.

We do not sell personal data, use it for advertising, or use anything on a memorial to train software.

Our service providers

Within Northstar Keep Ltd, personal data is available only to a small number of authorised people who need it for their work. These companies handle personal data for us, only as far as needed to provide their part of the service:

–Supabase: our database, file storage and sign-in. The database and files are held in London.
–Vercel: website hosting and site analytics. Our server code runs in London, although Vercel's worldwide network and build systems may still process data in other countries.
–Resend: email delivery
–Cloudflare: encrypted backup of photos and other media
–Mapbox: maps and place search. Maps load only if you choose to show one. When you do, or when you search for a place, your browser connects to Mapbox, which receives your IP address and what you searched for, and stores an anonymous identifier and a record of map use in your browser, which it uses to count how often its maps are loaded, and caches map tiles
–Spotify: a memorial's playlist, if it has one. Spotify is not our service provider: it decides for itself what it does with data from its player, under its own privacy policy. The playlist only loads if you choose to play it; your browser then connects to Spotify
–Paddle: sells our paid plans. Like Spotify, Paddle is not our service provider: it is an independent controller for your payment data, as described above.

International transfers

Some of our service providers are based in, or process data in, countries outside the UK, including the United States. Where a provider is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), we rely on that; otherwise we rely on the UK Addendum to the EU standard contractual clauses in the provider's data processing terms. You can ask us for a copy of the safeguards that apply by emailing hello@northstarkeep.com.

Special category data

We do not ask for, and do not intend to collect, special category data: information about someone's health, religion or beliefs, ethnic origin, sexual orientation, sex life, political opinions, trade union membership, or genetic or biometric data. Our own forms do not ask about health or religion.

The family can add their own question to the form for replying to a funeral invitation, and it may ask about things like food allergies or dietary needs. Answering is up to you. Your answer is shown only to the memorial's owner and editors. It is not shown on the memorial, sent by email, or included in any download. We keep it for as long as the memorial exists; after the memorial is deleted, it is gone from our database backups within 7 days.

A memorial is about a person's life, so what people write can sometimes include it, such as the illness someone died of or their faith. If special category information about a living person is added to a memorial, that person, or someone acting for them, can ask us to remove it, and we will.

Children and removal requests

Anyone pictured as a child on a memorial, or their parent, can ask us to take a photo down. Use the report control on the photo, or email hello@northstarkeep.com. We decide these requests ourselves, without needing the agreement of the memorial's owner, and when we remove a photo we also delete its backup copy.

Cookies and browser storage

Why there's no reject button

Most websites ask you to accept or reject cookies because they use them to track you, show you adverts or measure your visits. We don't do any of that, so there is nothing to reject.

The only cookies we set are the ones the site cannot work without, such as the one that keeps you signed in. The law does not require us to ask about these, because the site would not work without them.

We count visits using Vercel Web Analytics, which Vercel says does not use cookies and cannot recognise you from one day to the next.

Maps, Spotify playlists and payments come from other companies. They only load when you choose to use them, and maps and playlists show a short notice first.

Cookies and browser storage on Northstar Keep
Name	What it does	How long it lasts	Set by
sb-…-auth-token	Keeps you signed in.	Up to 400 days, renewed while you use the site.	Northstar Keep
sb-…-auth-token-code-verifier	Links an emailed sign-up or password reset link to the browser that asked for it.	Until the link is used, or up to 400 days if it is not.	Northstar Keep
ns_access_<memorial>	Remembers a private memorial's share link. It is sent only to that memorial's pages.	400 days from your last visit.	Northstar Keep
cookie_consent (browser storage)	Remembers that you have seen the cookie notice.	Until you clear it.	Northstar Keep
ns_guest_identity (browser storage)	Remembers the name and email address you gave when reacting or leaving a message, so you need not retype them.	Until you close the tab.	Northstar Keep
Mapbox identifiers and tile cache (browser storage)	Set only after you choose Show map.	Decided by Mapbox.	Mapbox
Spotify cookies	Set only after you choose Load playlist.	Decided by Spotify.	Spotify
Paddle cookies and storage	Set only when you open checkout.	Decided by Paddle.	Paddle

We do not use advertising or tracking cookies, and we do not use cookies to measure how the site is used.

Your rights

Under UK GDPR you have the right to:

–get a copy of the personal data we hold about you
–have it corrected if it is wrong
–have it deleted
–ask us to restrict how we use it
–object to how we use it, where we rely on legitimate interests
–receive data you gave us under a contract in a format you can take elsewhere; account holders can download their memorials from their account settings

Some of these rights have limits. For example, we may need to keep a record of a report or a payment even if you ask us to delete it. While we are investigating a memorial you own, we will not delete your account, because the evidence may be needed for a legal claim (UK GDPR Article 17(3)(e)). Once the investigation is closed, your request goes ahead. Where content is part of a memorial someone else owns, we will weigh your request against the family's. We will explain if we cannot do what you ask.

To make a request, email hello@northstarkeep.com. We will respond within one month.

You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk or on 0303 123 1113. We'd like the chance to put things right first, so please tell us at hello@northstarkeep.com, but you don't have to contact us before going to the ICO.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows the most recent update. We will tell account holders about significant changes by email where possible.