Privacy Policy

This policy explains how [Legal business name], operating as MonumentKit (“we,” “us” or “our”), handles personal information when you visit our website or use our memorial design service. Read it alongside our Terms of Service.

1. Information we collect

• Account details: name, email, protected login credentials, account role, company membership and preferences.
• Workspace content: designs, revisions, thumbnails, proofs, delivery records, catalogs and uploaded images, fonts, artwork, models and materials. These may contain customer information, inscriptions, names and dates relating to people commemorated in a memorial.
• AI requests: prompts, reference images, generated artwork, metadata and generation or conversion status.
• Billing details: billing contact information, subscriptions, seats, invoices, payment status and limited card details such as brand, last four digits and expiry. Stripe collects card numbers and security codes directly; our application does not receive them.
• Communications: support and contact messages and proof recipient addresses.
• Technical records: session identifiers, IP addresses, browser or device details, request and error logs, security events and administrative audit records.

2. How we use information

We use information to provide and secure accounts; save, render and retrieve designs; generate requested artwork; deliver proofs and service emails; process subscriptions; manage company seats; answer support requests; troubleshoot and improve the service; prevent abuse; and meet legal obligations.

Where applicable law requires a legal basis, we rely on performance of our service agreement, legitimate interests such as security and support, legal obligations, or consent where required. Consent may be withdrawn without affecting processing that was lawful before withdrawal.

3. Workspace privacy and sharing

Private designs and proofs are restricted to their owner through the application. Company subscription membership does not let colleagues browse one another’s private workspaces. Company owners can manage membership and billing and see information needed for those functions.

Authorized administrators can manage identities, categories, uploaded assets and catalog content, including private uploads. Administrative roles do not provide a general interface for viewing another user’s private design or proof documents. Authorized service operators may need access to stored information for maintenance, security investigations or legal obligations.

Application-managed public library items are available to other users and persist independently of an administrator’s account. Proof recipients and people you share exports with receive copies that they may retain or forward. Check recipients and avoid unnecessary personal information.

4. Providers and other disclosures

Hosting, storage, email and technical providers receive information needed to operate the service. Stripe processes payments and related fraud-prevention information under its Privacy Policy.

AI features send the prompts and reference files needed for your request to the configured provider. Integrations include Google Gemini for the administrator Artwork Studio and OpenAI for customer AI Art. Provider handling is governed by the applicable service terms and privacy policies: Google and OpenAI. Do not submit unnecessary sensitive or confidential information.

We may disclose information to comply with law or valid legal process, investigate misuse, protect people and the service, enforce our terms, or complete a business transfer subject to applicable privacy protections. We do not sell personal information or share it for cross-context behavioral advertising.

5. Cookies and browser storage

Cookies and similar storage support sign-in sessions, security and essential functions. Browser storage may hold editor preferences, recovery information, company invitations and account-closure receipts. The trial form temporarily holds your name and email in the current tab to prefill signup; the handoff is removed when read and accepted for no more than ten minutes.

Our application does not currently include advertising trackers or marketing analytics cookies. Embedded payment services may use their own technology for payments and fraud prevention. Clearing or restricting browser storage may prevent sign-in, recovery or other functions from working.

6. Retention and deletion

We retain workspace content while needed to provide your account and requested services. Delete supported items in the application or request account closure from Profile & security. Closure removes the account and private workspace records and schedules associated files for deletion; failed cleanup is retried. Company ownership or protected administrative roles may need to be transferred before closure.

Administrator Artwork Studio reference images are single-use inputs, retained while their generation request needs them and then purged. Unused server uploads expire after 24 hours. Provenance hashes and request metadata may remain. Generated artwork and saved assets are separate from these temporary references.

Billing, security, administrative and legal records may be retained as needed for accounting, fraud prevention, disputes or legal requirements. Backup copies may remain until replaced under the applicable backup cycle. Payment providers and recipients retain their own records independently. Deletion is not necessarily immediate across backups or third-party systems.

7. Your choices and rights

You can update your profile, manage billing, export supported work and close your account. Depending on your location, you may have rights to access, correct, delete or obtain a portable copy of personal information; restrict or object to processing; withdraw consent; or complain to a data protection authority. Applicable exceptions may limit these rights.

Submit requests through our contact form or [Privacy contact email]. We may verify your identity and authority and will respond within the period required by applicable law. If a monument business entered your information, contact that business too: it is responsible for its customer records, and we may need its instructions to act on information it controls.

8. Security and international processing

We use access controls and administrative and technical safeguards designed to protect information, but no storage or transmission method is completely secure. Protect your password and devices and report suspected unauthorized access promptly.

Providers may process information outside your country, where privacy laws differ. Where required, transfers must use safeguards recognized by applicable law.

9. Children

The service is intended for adults using business design tools, not for children. We do not knowingly allow people under 18 to create accounts. Memorial content may refer to a child; account holders are responsible for having authority to include that information. Contact us if you believe a child has provided account information without authorization.

10. Changes and contact

We may update this policy as the service or legal requirements change. The updated date appears above. We will provide additional notice of material changes where required by law.

Operator: [Legal business name]
Mailing address: [Business mailing address]
Privacy contact: [Privacy contact email]
You can also use our contact form.