Who is responsible for your data
(company number , ) is the data controller. Contact: . We are registered with the UK Information Commissioner's Office.
What we collect, and why
Account data: your email, a hashed password, your country (used only to show the right crisis helpline), and your confirmation that you are 18 or older. Optional intake answers about your loss: used only to personalize your support, encrypted at rest with AES-256-GCM. Subscription state: which plan you have, so we know what you have access to; payment details themselves are held by our payment provider, not by us. Minimal usage counters: how many messages you have sent, to operate the free allowance and the daily limit.
What we deliberately do not do
We do not store your conversations on our servers. We do not use advertising trackers, and we never use grief data for advertising or sell it to anyone. We do not use your location; your country comes only from the setting you choose.
Processors we use
Messages you send are processed by Anthropic to generate responses and to run the safety check, under commercial terms that do not permit training on your data. Transactional email (such as password resets) is sent by our email provider. Payments are handled by our payment provider as merchant of record. Each processes only what it needs for its function.
Legal bases
Performance of contract (providing the service you signed up for), legitimate interests (service security and the safety layer), and consent where required. Intake answers about bereavement may reveal information about your health or emotional state; we treat them with the protections owed to special category data and process them on the basis of your explicit consent, which you can withdraw by deleting them or your account.
Your rights
You can export everything we hold about you and delete your account, both in one click from Settings, at any time. You also have the rights of access, rectification, erasure, restriction, portability, and objection under UK GDPR, and the right to complain to the ICO (ico.org.uk).
Retention and security
Data is kept only while your account exists; deletion is immediate and permanent. Sensitive intake fields are encrypted at rest, transport is encrypted, and access is restricted.