Privacy Policy

1. Information We Collect

We collect the following categories of information:

1.1 Registration information

• Your name, email address, and phone number (optional)
• A password you set (stored only as a cryptographic hash)
• Your subscription plan and billing preferences

1.2 Grave-tag information

• The name and identifying details of the deceased loved one
• Your relationship to them
• The approximate area (a coordinate and radius) you have designated on the cemetery map
• Any identification mark, notes, or photograph of the deceased you optionally add

1.3 Payment information

• We do not store full credit card numbers on our servers.
• Payment tokens and transaction references issued by our payment gateway partners are stored for record-keeping.

1.4 Communication data

• Support enquiries you send us (email, WhatsApp, or in-app messages)
• Feedback you submit through the "Report an Issue" screen

1.5 Device and usage information

• Log data: IP address, device type, browser, operating system, and the pages you visit within the Service
• Cookies and local storage entries used to keep you signed in and remember your preferences

1.6 Location data (surveyors only)

• Real-time GPS location while our surveyors are actively capturing cemetery layout data using the mapping tool. Users of the general Service are not tracked in real time.

2. How We Use Your Information

We use the information described above to:

• Create and maintain your account, verify your identity, and secure your access;
• Locate the graves you have tagged and coordinate on-ground work;
• Process subscription and Add-On Service payments;
• Prepare, review, and deliver Virtual Visit clips;
• Send you transactional emails (verification, invoices, service updates) and respond to support requests;
• Improve the Service, diagnose issues, and prevent abuse;
• Comply with legal obligations under Pakistani law.

We do not use your information for behavioural advertising and we do not sell your personal information to third parties.

3. How We Share Your Information

3.1 With our on-ground team (Grave Admins)

Grave Admins receive the information necessary to locate a specific grave: the cemetery, the tagged area, the name expected on the grave, the approximate burial date (if provided), and any identification mark you added. Grave Admins do not receive your personal contact details (name, email, phone).

3.2 With Content Admins (video review)

Content Admins review Virtual Visit clips (with audio enabled) to ensure the content is appropriate. After approval, audio is removed from the clip server-side before it is delivered to you.

3.3 With service providers

• Payment gateway partners (for processing subscription and Add-On payments)
• Email delivery services (for verification, receipts, and support)
• Map and satellite imagery providers (Mapbox, OpenStreetMap contributors)
• Cloud infrastructure providers (server hosting, backups)

Each provider is contractually bound to process personal information only on our instructions and to maintain appropriate security measures.

3.4 For legal reasons

We may disclose your information if required by law, court order, or a lawful request by a public authority, or if we believe disclosure is reasonably necessary to protect the rights, property, or safety of any person.

3.5 Business transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and honour any promises made in this Policy.

4. Data Security

We use technical and organisational measures to protect your information, including:

• Encryption in transit (HTTPS/TLS for every request to the Service)
• Password hashing using bcrypt at cost factor 12
• Role-based access controls in our backend so team members can only see the data they need to do their job
• Server-side rate limiting to deter brute-force attacks
• Regular backups and access auditing

No system is perfectly secure. We encourage you to use a strong, unique password and to notify us immediately at info@grave-care.app if you suspect any unauthorised access.

5. Data Retention

• Account data is retained for the duration of your subscription and for twelve (12) months after cancellation, unless earlier deletion is required by law.
• Tagged-grave records and Virtual Visit clips are retained during the same period.
• Support communications are retained for up to seven (7) years for legal, audit, and quality purposes.
• Payment records are retained as required by tax and accounting laws.

6. Your Rights

Subject to applicable law, you have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you;
• Correction — request that inaccurate or incomplete information be corrected;
• Deletion — request that we delete your account and associated personal information (subject to retention obligations);
• Portability — receive your information in a structured, commonly used, machine-readable format;
• Withdrawal of consent — where processing is based on consent, withdraw that consent at any time;
• Objection — object to processing that is based on our legitimate interests.

To exercise these rights, please write to privacy@grave-care.app or info@grave-care.app. We will respond within thirty (30) days.

7. Cookies and Similar Technologies

We use cookies and browser local storage sparingly, only for essential functions:

• Keeping you signed in between visits
• Remembering your preferences (e.g. offline map cache for surveyors)
• Recording basic analytics (page views, error rates) to help us improve the Service

We do not use third-party advertising or cross-site tracking cookies.

8. Third-Party Services

The Service uses third-party services whose privacy practices we do not control. When you interact with these services (for example, following a link to WhatsApp or an external map), their own privacy policies apply.

9. Children's Privacy

The Service is not directed at children under 18. We do not knowingly collect personal information from a child under 18. If you believe a child has provided us with personal information, please contact us and we will delete it.

10. International Data Transfers

Our servers are currently located outside Pakistan. By using the Service you consent to your information being transferred to and processed in the countries where our servers and service providers operate. We take reasonable steps to ensure your information receives an equivalent level of protection wherever it is processed.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be notified to you by email or via an in-app notice at least fifteen (15) days before they take effect. The "Effective date" at the top of this document tells you when it was last updated.

12. Contact Us for Privacy Concerns