Privacy

In short

• We keep only what you put into a program, so we can show it, save it and make the files.
• The program’s words and photos are encrypted before they are stored.
• An unpaid draft is deleted 14 days after the last edit; a paid program and its files 90 days after payment. You can delete a program sooner yourself.
• The obituary writer keeps nothing, and names and places are replaced before anything reaches the AI service it uses.
• No accounts, no advertising, no cookies, no analytics. We don’t sell or share your information for marketing.

Who we are

GraceFarewell (gracefarewell.com) is a sister product of ApprovaVisa and is responsible for the information described here. For anything about your information, write to support@approvavisa.com. About us.

When you make a program

• What you type and upload: the name and dates of your loved one, the service details, the order of service, the obituary, the back page, the card texts, and the photos you add. We use it only to show the program, save your draft and make your files.
• How it is stored: on Cloudflare R2 storage, encrypted (AES-256-GCM) before it is written. Photos are resized in your browser before upload and stored encrypted too. Next to each draft we keep a few plain facts for running the service: its status, church tradition, format, product, and the dates it was made, paid, first downloaded and will be deleted. They hold no names.
• The private link: each draft opens with a long random key. The key sits after the “#” in the link, so it is never sent to our server with the page address. If you use “Email me this link”, we send the link to the address you give and don’t keep the address.
• On your device: the browser keeps a copy of your draft and its link, so nothing is lost if the connection drops and you can continue later on the same device. Clear it with your browser’s site data.

When you pay

Payments are handled by Dodo Payments, our merchant of record. We never see your card details. We keep the payment record (amount, date, payment reference and your email) to give you your files, answer questions about your order and for accounting. We send the order email, with your download link, through our email provider, Resend.

The files we make for you (PDFs and images) are stored on Cloudflare R2 and are only reachable with your order’s private link. Our order administration, shared with ApprovaVisa, sees the payment record and the plain facts listed above, not the program’s words or photos.

The obituary writer

• The answers you type are used to write one draft and are not stored, logged or used for anything else.
• The template version is written on our server, without AI. The written draft uses an AI service, DeepSeek, which processes data in China and may use what it receives to improve its models. That is why we never send it who the person was.
• Before your answers leave our server, the names of people, churches and places, dates and years, phone numbers, email addresses and links are replaced with placeholders such as [NAME], [SPOUSE] or [CHURCH]. In free text, every capitalised word that isn’t a common word is masked too. DeepSeek writes with the placeholders; we put the real words back on our side. A name typed all in lower case may not be recognised, so write names with capitals.
• To prevent abuse, the writer may ask for a Cloudflare Turnstile check, and counts written drafts per IP address for one day (five a day). The count is kept only in memory and is not linked to what you wrote.
• “Put it in a funeral program” hands the draft to the editor within your browser tab; it is stored only once it becomes part of a program draft, as described above.

Who helps us run it

Vercel (hosting), Cloudflare (storage and the Turnstile check), Dodo Payments (payments), Resend (email) and DeepSeek (written drafts, pseudonymized as above). They process information only to provide their service to us, and some of them may do so outside the United States. Our hosting provider keeps short-lived server logs, such as IP addresses, for security.

How long we keep it

• Unpaid draft and its photos: deleted automatically 14 days after the last edit.
• Paid program, its photos and its files: deleted automatically 90 days after payment.
• Obituary-writer answers: not kept.
• Payment records: as long as accounting and tax law require.

Your choices

• Delete a program at any time in the editor (“Delete this program now”): the words and photos are removed for good.
• Write to support@approvavisa.com to see, correct or delete what we hold about you, wherever you live. Tell us the email you paid with or the program’s link.
• GraceFarewell is meant for adults arranging a service; we don’t knowingly collect information from children.

Cookies

We don’t set cookies, and we use no analytics or advertising tools. The Turnstile check, when it is shown, is run by Cloudflare under its own privacy policy. See also our terms and refunds.