Privacy Policy

Last updated 2026-10-08

MyStoryStays helps families keep the story of someone they love: a memorial page, opened from a QR code on a printed card or an engraved marker. People trust us with personal and often painful details, so we collect as little as we can, keep it in Canada, and never sell it or use it for advertising.

Who we are

MyStoryStays is run by MyStoryStays, in Ontario, Canada ("we", "us"). We're responsible for the personal information described here, and we follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Our privacy contact is reachable at hello@mystorystays.ca or [MAILING ADDRESS].

What we collect, and why

When you place an order

Your email address: to send your order confirmation, the link to set up your account, and updates about your order.
For engraved markers, your name, shipping address and phone number: to deliver the marker. The phone number is for the delivery carrier to reach you if there's a problem; it stays with our payment processor, Stripe, and we only look it up if a delivery needs it.
Payment details are entered on Stripe's secure checkout page. We never see or store your card number.
What you bought and paid, including taxes, as business and tax records.

Your account

Your name and email, and your password, stored only in a scrambled, one-way form (we can't read it).
If you turn on two-factor login, its secret key is stored encrypted, and your recovery codes only in scrambled form.

What you add to a memorial page

The name, dates, story, epitaph, photos and captions you add. These are about the person who has died, and sometimes about family and friends. When you upload a photo, we automatically remove hidden details such as the location where it was taken. Please only add photos and stories you have the right to share (see information about other people).

Guest book messages

Visitors who sign a guest book give a name and a message, which are shown on the memorial page (see what's public). To stop spam, we also keep a scrambled form of the visitor's internet (IP) address. It can't be turned back into the address, and it's only compared with other scrambled addresses to limit how often one person can post.

Keeping accounts safe

When someone tries to log in or reset a password, we briefly keep a scrambled form of the email address and IP address used, to stop people guessing passwords. In the same way, when someone starts a checkout or opens a memorial address that doesn't exist, we briefly keep a scrambled form of their IP address, to stop automated abuse. Like our web server's logs (the pages requested, IP address and browser type), these are used only for security and fixing problems.

Emails we send

Only emails about your orders, your account and its security, such as a link to set up your account, or an alert that your password was changed. No newsletters or marketing unless you ask for them.

Cookies

We use one cookie, named GT. It keeps you logged in as you move between pages and protects our forms from being submitted by other websites. It's deleted when you close your browser. Because the site can't work without it, it doesn't need your consent, and there's no cookie banner.

We don't use analytics, advertising or tracking cookies, and there are no third-party trackers on our pages. Everything our pages need, fonts included, comes from our own website, so visiting a memorial page doesn't send your information to anyone else.

When you pay, you're on Stripe's checkout page, which uses its own cookies to prevent fraud, under Stripe's privacy policy.

What's public on a memorial page

A published memorial page can be seen by anyone who has its QR code or link. That's what lets visitors at a grave or a service open it. Memorial pages are kept out of search engines: we ask Google, Bing and others not to list them or their photos, so a page won't turn up in a search for the person's name, even if its link is shared publicly. We don't list them anywhere on our site either. The family can unpublish a page at any time, and it then shows only "being prepared" to visitors.

Guest book messages appear publicly on the page: straight away if the family has turned on automatic approval, otherwise once they approve them. The family can remove any message.

We never sell or rent personal information, and we don't use it for advertising. We share it only with the service providers we need to run MyStoryStays, only as much as they need, and under agreements that protect it:

Stripe: processes payments and keeps the details you enter at checkout.
Our hosting provider: stores the website, its database and photos, in Canada.
Our email delivery provider: sends the emails described above.
The shipping carrier: receives your name, address and phone number to deliver a marker.

We may also disclose information if the law requires it, for example under a court order.

Where it's stored

The website, its database, uploaded photos and backups are stored in Canada. Some of our providers, including Stripe and our email delivery provider, may process information outside Canada, mainly in the United States and the European Union, where it can be subject to the laws there.

How long we keep it

Your account and memorial pages: for as long as you keep them. Memorial pages stay online for as long as MyStoryStays operates, unless you ask us to remove them.
Guest book messages: with their memorial page, unless the family deletes them.
Order and payment records: at least six years, as Canadian tax law requires, even if you close your account.
Security records (login, password reset, checkout and page-lookup limits): deleted automatically, normally within a day.
Web server logs: up to 30 days.
Backups: encrypted. Information you delete is gone from them within 35 days, as old backups are replaced.

How we protect it

Everything you send us is encrypted in transit (HTTPS). Passwords are stored with a modern one-way hash (Argon2id), the site limits repeated login attempts, and two-factor login is available to everyone and required for our own staff accounts. Only the people who run MyStoryStays can access customer information, and only when they need to. If a breach ever creates a real risk of significant harm to you, we'll tell you and the Office of the Privacy Commissioner of Canada, as the law requires.

Your rights and choices

See and download your information. Your memorial pages can be downloaded in full from your dashboard at any time: story, photos, guest book and QR code. For anything else, ask us.
Correct it. Edit your memorial pages yourself, or ask us to correct anything else.
Delete it. Ask us to close your account or remove a memorial page. We'll delete it, except records the law requires us to keep, such as order and tax records.
Withdraw consent to anything that isn't needed to provide the service.

Email hello@mystorystays.ca and we'll reply within 30 days. We may need to confirm it's really you first. If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

Information about other people

Memorial pages are usually made by family members. If you add a story or photos that include other people, please make sure you have the right to share them. If you find information about you or someone in your family on a memorial page and want it changed or removed, contact us. We'll review every request with care and respond.

Children

You must be 18 or older to buy from us or create an account. Anyone may sign a guest book. If a child has posted something they shouldn't have, the family or a parent can ask us to remove it.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects how we use information you've already given us, we'll email you first.

Contact us

MyStoryStays
[MAILING ADDRESS]
hello@mystorystays.ca