Privacy Policy

Gravely Inc. ("Gravely," "we," "us," "our") operates the Gravely platform and services. This Privacy Policy explains how we collect, use, disclose, and protect information when you use our websites, applications, and services (collectively, the "Service").

This Privacy Policy works together with our Terms & Conditions. If there is a conflict, the Terms & Conditions control except where privacy law requires otherwise.

Company: Gravely Inc.

Contact: support@withgravely.com

Depending on how you use Gravely, we may collect the following categories of information:

2.1 Information You Provide

• Account information: Name, email address, phone number
• Plan content: Tasks, notes, timelines, preferences, checklists
• Documents: Death certificates, legal documents, other uploaded files
• Family/relationship information: Relationships, trusted contacts, roles in planning
• Financial context: Budget ranges, cost preferences, payment information for purchases
• Cultural/religious preferences: Service preferences, traditions, values
• Support communications: Emails, messages, feedback, concierge interaction notes

2.2 Sensitive Information

You may choose to provide sensitive information, including:

• Health-related information (cause of death, medical decisions)
• Government identifiers in uploaded documents
• Religious or cultural preferences

We treat this information with extra care and only use it to provide the Service.

2.3 Information Collected Automatically

• Usage data: Pages visited, features used, actions taken
• Device information: Browser type, operating system, device type
• Log data: IP address, access times, error logs
• Approximate location: City/region level, derived from IP address

2.4 AI Assistant Conversations

When you use our AI assistant, we collect your questions and the AI's responses to provide the service and improve our tools. We do not use your conversations to train third-party AI models.

We use your information for the following purposes:

3.1 Providing the Service

• Creating and managing your account
• Operating plans, checklists, and document storage
• Enabling family sharing with your chosen permissions
• Providing AI assistant guidance
• Delivering concierge support (if purchased)
• Processing payments

3.2 Improving and Protecting the Service

• Fixing bugs and improving reliability
• Understanding how people use Gravely
• Maintaining security and preventing fraud
• Monitoring for misuse

3.3 Communicating With You

• Service notices and updates
• Support responses
• Security alerts
• Account-related messages

3.4 Legal Compliance

We may use information to comply with legal obligations, respond to legal requests, and protect our rights.

We do not sell your personal information.

We share information only in these circumstances:

4.1 With People You Invite

If you share a plan with family members or trusted individuals, they can access the information you share based on the permissions you set.

4.2 With Service Providers

We use trusted third-party services to operate Gravely:

• Vercel: Web application hosting
• Neon: Database infrastructure (PostgreSQL)
• Clerk: Authentication
• Stripe: Payment processing
• Mailchimp: Transactional email delivery (Mailchimp Transactional)
• Sentry: Error tracking and bug reporting
• PostHog: Product analytics
• Google Analytics: Optional web analytics, if enabled and accepted through cookie controls
• Metricool: Optional web analytics, if enabled and accepted through cookie controls
• Meta: Optional campaign measurement, if enabled and accepted through cookie controls
• UserJot: Feedback and feature requests
• Notion and Slack: Support operations when you contact us

These providers process data on our behalf under agreements and access limits designed to protect it.

4.3 With Third-Party Providers (Guide+ and Full Concierge)

If you purchase Guide+ or Full Concierge services and ask us to coordinate with funeral homes, cemeteries, or other providers, we may share relevant information to support that coordination.

4.4 For Legal Reasons

We may disclose information when required by law, to respond to legal process, to protect safety, prevent fraud, or address misuse of the Service.

4.5 Business Transfers

If Gravely is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your information.

5.1 Essential Cookies

We use cookies that are necessary for the Service to function, including authentication and security cookies. These cannot be disabled.

5.2 Analytics

We use analytics tools (like PostHog, Google Analytics, and Metricool) only if you opt in through our cookie controls. This helps us improve the product. For PostHog, consent can also enable selected product lifecycle milestones, such as creating a Guide, publishing a Gather page, or receiving support. Those milestones use pseudonymous subject keys and allowlisted operational fields; they exclude raw plan, registry, payment, and user identifiers as well as names, contact details, narratives, and family content.

We minimize what we send to analytics systems, including avoiding query-string capture in page analytics, limiting third-party page-view tracking to public marketing pages, and redacting sensitive-looking path segments before capture. If you later reject analytics, browser capture and new lifecycle sequences stop immediately. Consent-qualified payment or refund milestones already initiated before withdrawal may still be recorded so the original lifecycle sequence remains accurate.

Session replay and heatmap collection are disabled.

5.3 Campaign Measurement

If enabled, we use Meta Pixel only after you opt in through our cookie controls and only on public marketing pages. We do not sell personal information or show targeted ads inside Gravely.

5.4 Do Not Track

Browser "Do Not Track" signals are not consistently supported across the web, so we do not rely on them alone. Instead, you can use our cookie controls to reject analytics and feedback cookies at any time.

We use safeguards designed to protect your information:

• Authentication and account access: We use Clerk for sign-in and limit operational access to the people and systems that need it to run or support the Service
• Sharing controls: Plans and collaboration access follow the permissions you set, and collaborators only see what you choose to share with them
• Encryption and storage protections: Connections to Gravely use TLS, and the infrastructure providers we rely on support encrypted storage and backup protections
• Monitoring and response: We monitor for errors, suspicious activity, and security events, and we review the security practices of our service providers

No system can be guaranteed 100% secure. If we learn of a security incident affecting your personal information, we will investigate promptly, work to contain it, notify affected users and/or regulators as required by law, and share practical next steps when appropriate.

We keep your information only as long as needed:

• Account and plan data: Kept while your account is active, then handled under the account-deletion policy below
• Payment and service records: Kept as needed for refunds, disputes, fraud prevention, accounting, tax, and legal compliance
• Security and audit records: De-identified where practical and kept when needed to protect the Service or meet legal obligations
• Backups: May persist for a limited period after deletion until secure backups expire
• Legal holds: We may retain data longer when required by law

Account deletion: When account deletion succeeds, we take Gather pages you own offline, revoke access, and delete or de-identify non-required personal data. We retain limited payment and refund ledgers, security and audit evidence, records needed for disputes, fraud prevention, tax, accounting, or legal obligations, and data in secure backups for a limited period until those backups expire. We report success only after sign-in access is removed and local cleanup finishes; a temporary failure is reported so you can retry.

Depending on where you live, you may have rights to:

• Access: Request a copy of your data
• Correct: Fix inaccurate information
• Delete: Request deletion of your data
• Export: Receive your data in a portable format
• Object/Restrict: Object to or limit certain processing

To exercise these rights, contact us at support@withgravely.com. We will respond within the timeframes required by applicable law.

Account deletion: You can delete your account from settings, or contact support if you need help with a deletion or export request. We report success only after sign-in access is removed and local cleanup finishes; a temporary failure remains retryable.

We handle this sensitively:

• Shared plans: People you shared plans with before death may continue to have the access you granted
• Authorized representatives: Executors, administrators, or legally authorized representatives may request account closure, data export, or deletion with proper documentation

To protect privacy, we may require reasonable documentation (such as a death certificate and proof of authority). We will handle these requests with care.

Note: Laws about digital accounts vary by location. We may be legally required to deny or limit some requests.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

Categories of Personal Information We Collect

• Identifiers (name, email, contact details)
• Customer records information (account credentials, support communications)
• Commercial information (purchases of concierge services)
• Internet or network activity (usage logs, device information)
• Geolocation data (approximate location from IP)
• Sensitive personal information (if you provide it): health information, government identifiers in documents, religious/cultural preferences

Your California Rights

• Right to know/access your personal information
• Right to delete your personal information
• Right to correct inaccurate information
• Right to opt out of sale or sharing
• Right to limit use of sensitive personal information

We do not sell your personal information. If we ever engage in "sale" or "sharing" as defined by California law, we will provide opt-out mechanisms.

Non-discrimination: We will not discriminate against you for exercising your privacy rights.

For more information, visit the California Attorney General's CCPA page: oag.ca.gov/privacy/ccpa

If you are in the European Union or United Kingdom, the GDPR (and UK GDPR) applies.

Our Role

Gravely acts as a "controller" of personal data you provide. Our service providers act as "processors" handling data on our behalf.

Legal Bases for Processing

• Contract: To provide the Service you request
• Legitimate interests: To secure, maintain, and improve the Service; prevent fraud; respond to support requests
• Consent: When we ask for it (e.g., certain communications)
• Legal obligation: To comply with law

Your GDPR Rights

• Access your personal data
• Rectification (correction)
• Erasure ("right to be forgotten")
• Restriction of processing
• Data portability
• Object to processing
• Lodge a complaint with a supervisory authority

Cross-Border Transfers

Our service providers may process data outside the EU/UK. We use safeguards designed to support lawful transfers, such as Standard Contractual Clauses.

For more information: EU Data Protection Information

Gravely is not directed to children. You must be at least 18 years old to use the Service.

We do not knowingly collect personal information from children under 13 (or under 16 in jurisdictions where that applies). If we learn we have collected information from a child, we will delete it promptly.

If you believe a child has provided us with personal information, please contact us at support@withgravely.com.

We may update this Privacy Policy to reflect changes in our practices, the Service, or legal requirements.

If we make material changes, we will provide notice (by email or in-app notification) before the changes take effect.

We encourage you to review this policy periodically. Your continued use of the Service after changes take effect means you accept the updated policy.

If you have questions about this Privacy Policy, want to exercise your rights, or have concerns about your data:

Email: support@withgravely.com

We understand privacy matters, especially when dealing with sensitive life moments. We'll respond with care.