Privacy Policy
Last updated: 7 November 2026
This policy explains what personal data we collect through the Epitafy waitlist at epitafy.com, why we collect it, and the rights you have over it. We’ve kept it short because, right now, we collect very little.
1 · Who we are
Epitafy s.r.o., Staňkova 103/18, Ponava 602 00 Brno, Czech Republic (Company ID 24609943, VAT ID CZ24609943) is the data controller. Contact: hello(at)epitafy.com. Our representative in the United Kingdom (Art. 27 UK GDPR) is Milan Madaras, who can be contacted at gdpr-uk(at)epitafy.com (UK postal address available on request). We build a digital time capsule service; this policy covers only the pre-launch waitlist website – the app will have its own policy at launch.
2 · What we collect and why
Your email address – because you asked to join the waitlist. We use it to send one confirmation email, a non-binding invitation to early access, and the launch announcement. Nothing else. Lawful basis: your consent (Art. 6(1)(a) UK GDPR / GDPR), given by double opt-in – you enter your address and then confirm it by clicking a link we email you.
Your country or region – only if you choose to select one when joining. Epitafy opens country by country, and your choice tells us when your invitation should go out. Leaving it blank changes nothing. Lawful basis: your consent (Art. 6(1)(a) UK GDPR / GDPR), given by selecting it.
Consent records – the time of your signup and confirmation, the version of the consent text you agreed to, and the page you signed up from. We keep these to prove your consent was real, which the law requires of us. Lawful basis: legal obligation (Art. 6(1)(c) in conjunction with Art. 7(1) UK GDPR / GDPR) and our legitimate interest (Art. 6(1)(f)) in demonstrating compliance.
Referral data – if you share your invite link, we count signups attributed to it. No contact data of your friends is collected by you sharing a link; they sign themselves up under this same policy. Lawful basis: our legitimate interest (Art. 6(1)(f) UK GDPR / GDPR) in administering the waitlist referral programme.
We do not collect names, phone numbers or anything else at this stage, and we do not store IP addresses: Framer and Brevo necessarily see yours when they deliver the page and the form, Brevo anonymises it, and we never receive it. We do not buy, sell or enrich data, nor do we use automated decision-making or profiling – ever.
3 · Double opt-in, and what happens if you don’t confirm
Entering an email on our site does not add it to any list. We first send one confirmation email. If the link in it isn’t clicked within 48 hours, the link expires; if an address remains unconfirmed for 30 days, we delete it and its signup record automatically.
4 · How long we keep your data
Confirmed waitlist data is kept until the launch sequence completes, and no longer than 6 months after launch (or 18 months from sign-up, whichever comes first), after which the waitlist – including backup copies – is deleted. You can leave at any time before that – every email contains an unsubscribe link, and unsubscribing removes you from all active mailing lists immediately. Minimal consent and unsubscription logs are retained for 3 years solely as evidence of legal compliance.
5 · Who processes your data for us
Your data is stored and emails are sent by our processors: Brevo (Brevo SAS, France, EU) – email delivery, double opt-in confirmation and list management – and Framer B.V. (Netherlands, EU) – website hosting and visitor statistics; Framer hosts on Amazon Web Services infrastructure in the United States. As Epitafy approaches launch, waitlist data may also be processed on our own infrastructure at Amazon Web Services in Frankfurt, Germany (cloud hosting for the Epitafy service), and backup copies of the waitlist may be kept in access-restricted storage on Google Workspace (Google Ireland Ltd). All processors act under data processing agreements, and transfers outside the UK/EEA are protected by the EU-US Data Privacy Framework (including the UK Extension), EU Standard Contractual Clauses, or the UK International Data Transfer Addendum.
6 · Cookies and analytics
This site sets no advertising cookies and no optional cookies at all – so there is no cookie banner to click. To understand how many people visit and which pages they read, we use the visitor statistics built into our website host, Framer: they show us only aggregated numbers, work without cookies or any other identifier stored on your device, and are not used to build a profile of you. Lawful basis: our legitimate interest (Art. 6(1)(f) UK GDPR / GDPR) in knowing how the site is used. Our emails use no individual open- or click-tracking (apart from the technical link required to confirm your double opt-in or unsubscribe). We do not track you across other sites. Only what is technically necessary to serve the page is stored on your device.
7 · Your rights
Under UK and EU data protection law you can: withdraw consent at any time (unsubscribe link, or email us); ask for access to the data we hold on you; have it corrected or erased; restrict or object to processing; and receive a portable copy. Write to hello(at)epitafy.com – we respond within one month. You can also complain to a supervisory authority: the ICO (ico.org.uk) in the UK, or the Czech ÚOOÚ (uoou.gov.cz), or your local authority in the EU.
8 · Children
The waitlist and the Epitafy service are intended for adults. We do not knowingly collect data from anyone under 18; if you believe a minor has signed up, contact us and we will delete the record.
9 · Changes
If we change this policy, we’ll update the date above; if the change affects how we use waitlist data, we’ll email you before it takes effect. The version that applies is always the one at epitafy.com/privacy.
Epitafy complements your will – it does not provide legal advice or replace formal estate planning.