Privacy policy

Draft for review. This page is a starting point and must be checked by a qualified adviser and completed with your company details before launch.

This policy explains what personal data Family Galaxy collects, why, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018). The data controller is [Your company name] (company number [00000000]). Contact us at hello@familygalaxy.example.

What we collect

• Account details: your name, email address and a securely hashed version of your password (we never store your password itself).
• Your family tree file: the GEDCOM you upload. This contains information about you and your relatives, which may include living people.
• Place lookups: place names from your tree are sent, without any names of people, to our mapping provider to find their location. Results are stored so they don't need to be looked up again.
• Messages: anything you send through our contact form, and your email address if you join a waiting list.
• Technical data: a sign-in cookie, and standard server logs (such as IP address and browser type) kept by our hosting provider for security.

Why we use it, and our lawful basis

• To provide the service you signed up for — storing your tree and showing it back to you (contract).
• To keep the service secure and prevent abuse, for example rate-limiting sign-in attempts (legitimate interests).
• To reply to you and to tell you about the Heirloom plan if you've asked us to (consent, which you can withdraw at any time).

Information about your relatives

Family trees naturally contain information about other people. You should only upload information you're entitled to share with us. Your tree is visible only to you, and we use it only to show it back to you. We recommend your family tree software's option to hide details of living people if you'd prefer not to include them.

Who we share it with

We never sell your data or share it with advertisers or genealogy companies. We use these processors to run the service:

• Cloudflare — hosting, database and file storage.
• Open-Meteo — place-name lookups for the map (place names only).
• Resend — sending password-reset emails, if enabled.

Some processors may handle data outside the UK; where they do, we rely on appropriate safeguards such as the UK International Data Transfer Addendum.

How long we keep it

We keep your account and tree until you delete them. When you delete your account, your tree file and account details are removed immediately from our live systems. Contact-form messages are kept for up to two years.

Your rights

You can ask to access, correct, delete or receive a copy of your data, object to or restrict how we use it, and withdraw consent. Email us to make a request. You can also complain to the Information Commissioner's Office at ico.org.uk.

Children

Family Galaxy is for people aged 18 and over.

Changes

If we make important changes we'll update this page and tell signed-up users by email.