Privacy Policy

Effective date: 21 October 2026

Google Analytics is not switched on yet: there is no cookie banner and no Google Analytics cookie. The parts about it below describe how it will work once it is.

1. Who we are

Past People Life at pastpeople.life is operated from the United Kingdom by Scifoo Memories Ltd, a private limited company registered in England and Wales under company number [pending registration], with its registered office at [to be published on registration] ("we", "us", "our").

We are the data controller for the personal data described in this policy under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003 (PECR).

We have not appointed a Data Protection Officer. For any privacy question, data rights request, objection, or complaint, please email privacy@pastpeople.life.

2. What the site does today

Past People Life is a service where a family keeps a memorial page for a relative who has died, at a permanent link https://pastpeople.life/p/<code> ("permanent" means an address designed never to change and never to be reused, not a guarantee of how long the service will operate; see section 3 of our Terms of Use). Today, the website is an early preview: the only live memorial page (/p/rz2fx3a8) says "The family is preparing this page" and shows no names or other personal data—only its 8-character code and QR code. There are currently no user accounts, sign-up, payments, comments, user uploads, contact form, newsletter, or advertising.

3. Personal data we process

Below is the personal data we process when you visit the site or write to us. All data comes directly from your browser or device when you use the site (with country or coarse location derived from your IP address by Cloudflare or Google) or directly from you if you email us; we do not collect personal data about you from third-party sources. Your browser must send standard request data (such as your IP address) to load web pages, while language and analytics cookies and emailing us are optional. We do not use your data for automated decision-making or profiling.

a. Hosting, delivery, and security (Cloudflare)

Every request to our site is handled by our server, which runs on the network of our processor Cloudflare, Inc. (United States).

• What is processed: Cloudflare necessarily receives your IP address, browser user agent, requested URL, referrer, and the country Cloudflare derives from your IP address.
• Retention: short-term technical logs in our Cloudflare Worker configuration are kept for up to 7 days to operate and secure the site. We do not build profiles from them.
• Lawful basis: our legitimate interests (Article 6(1)(f) UK GDPR) in operating the site reliably and keeping it secure.

b. Interface language and the ppl_locale cookie

When a page loads, our server checks the country Cloudflare derived from your IP address for that request only: if your connection is in Russia, the site is shown in Russian; otherwise, it is shown in English. We do not store that country.

If you click Eng or Рус to choose a language yourself, we set a first-party cookie named ppl_locale (value en or ru, valid for 1 year) to remember your choice.

• How to delete it: click Forget my language at any time to delete ppl_locale and return to automatic language selection.
• Lawful basis: under PECR (Schedule A1, paragraph 6), no prior consent is needed for a cookie that adapts how the site appears to your preference, provided we inform you and give a simple, free way to object (Forget my language deletes the cookie and returns you to the page). Under UK GDPR, our lawful basis is our legitimate interest (Article 6(1)(f)) in showing an appropriate default language on first load and remembering the language you chose.

c. Recording your analytics choice (ppl_consent cookie)

Outside Russia (when JavaScript is enabled), we show a cookie banner asking whether you agree to analytics. When you press Accept or Reject, your answer is stored in a first-party cookie named ppl_consent (value granted or denied) for 6 months, so you are not asked on every page. Without JavaScript, nothing is set except ppl_locale if you click Eng or Рус.

• Lawful basis: strictly necessary under PECR (Schedule A1, paragraph 4) to remember your selection, and our legitimate interest (Article 6(1)(f) UK GDPR) in respecting your choice.

d. Website analytics — Google Analytics 4 (only with consent, never in Russia)

We use Google Analytics 4 (through a Google Analytics property linked to our site's Firebase project, provided by Google) only if you give consent.

• Consent first: nothing from Google (gtag.js from googletagmanager.com) loads until you press Accept in the cookie banner. Reject is equally prominent.
• No analytics in Russia: for visitors whose connection Cloudflare places in Russia, our server removes the cookie banner and the Cookie settings buttons and does not load Google Analytics. (The Russian-language interface outside Russia, such as in the UK, does show the banner.)
• Cookies when accepted: _ga and _ga_<property-id>, first-party cookies expiring after 13 months.
• What Google receives: pages viewed (including the page address, which on a memorial page contains its 8-character code), referrer, time, browser and device type, screen size, language, approximate location (city, region, country) derived from your IP address, and a random identifier stored in the _ga cookie. According to Google's documentation, Google Analytics uses IP addresses to derive coarse location (and, outside the UK, EEA, and Switzerland, for service security and spam detection) and discards raw IP addresses rather than associating them with user identifiers.
• Settings and retention: we turn off Google signals and ad personalisation, set advertising consent signals to denied, and set user- and event-level data retention in Google Analytics to 2 months.
• Withdrawing consent: you can withdraw consent at any time by clicking Cookie settings in the footer of every page or at the top of the Cookie Policy page (under the title), which reopens the banner, and pressing Reject. Doing so sets ppl_consent to denied, deletes the _ga and _ga_<property-id> cookies, and stops Google Analytics, without affecting the lawfulness of processing based on consent before you withdrew it.
• Lawful basis: your consent (PECR Schedule A1, paragraph 2 and Article 6(1)(a) UK GDPR).

e. Email correspondence

Email to privacy@pastpeople.life passes through Cloudflare Email Routing and is delivered to our mailbox at [our email provider, to be named], which stores it for us as a processor.

If you write to privacy@pastpeople.life, we keep our correspondence to answer you and for up to 12 months after your request is closed, unless a legal obligation or claim requires keeping it longer (up to 6 years under UK limitation law).

• Lawful basis: our legitimate interests (Article 6(1)(f) UK GDPR) in answering questions and objections, and legal obligation (Article 6(1)(c) UK GDPR) for statutory data protection requests or complaints.

4. Data about people who have died and living relatives

Under the UK GDPR, information about someone who has died is not personal data, though we treat it with care. Information about living relatives named on a page would be personal data. Today, no page shows any names. If you want to ask about or object to a page, please email privacy@pastpeople.life.

5. Processors and international transfers

We do not sell your data or share it with advertisers. Our processors are:

• Cloudflare, Inc. (USA) — processor for hosting and delivery under the Cloudflare Customer Data Processing Addendum.
• Google LLC (USA) — processor for Google Analytics 4 under the Google Ads Data Processing Terms (only when you press Accept outside Russia).
• [our email provider, to be named] — processor for our mailbox, which stores email sent to privacy@pastpeople.life.

For transfers from the UK to the USA, both Cloudflare, Inc. and Google LLC are certified under the EU–U.S. Data Privacy Framework and the UK Extension to the EU–U.S. Data Privacy Framework (the UK–US data bridge under UK adequacy regulations). Both processors' published data processing terms also incorporate the European Commission's Standard Contractual Clauses with the ICO's UK International Data Transfer Addendum as a fallback safeguard; you can inspect their certifications on the official Data Privacy Framework list or request links to or copies of these transfer terms from us at privacy@pastpeople.life.

If our mailbox provider stores email outside the UK, it does so in a country covered by UK adequacy regulations or under the ICO's International Data Transfer Agreement or Addendum.

6. Your rights and complaints

Under UK data protection law, you have the right to request access to, correction of, or deletion of your personal data; to restrict or object to processing based on legitimate interests; to request data portability; and to withdraw analytics consent at any time via Cookie settings (without affecting the lawfulness of processing carried out before you withdrew consent).

Because we have no accounts and do not link Cloudflare logs or random _ga identifiers to named people, we usually cannot identify you from browsing data alone unless you give us extra details. You can delete cookies anytime via Cookie settings, Forget my language, or your browser.

Complaints to us first: if you have a concern about how we handle your data, please contact us first at privacy@pastpeople.life so we can put it right. Under section 164A of the Data Protection Act 2018, we will acknowledge your complaint within 30 days and reply without undue delay (and respond to rights requests within one month, or up to two further months for complex or multiple requests as allowed by law).

Regulator: you can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk (0303 123 1113), or to the data protection authority where you live.