Privacy Policy

    Effective Date: April 2026

    Our Core Privacy Promise

    Your stories are YOUR stories. We never use them for machine learning training. We never sell them. We never share them without your explicit permission. They remain yours, always.

    1. Introduction

    This Privacy Policy explains how Ethos (operating as Ethos OÜ, registry code 16972881, located at Kursi tn 3, 10415 Tallinn, Estonia) collects, uses, and protects your personal information through our website at ethosbook.co and our AI-powered life story preservation platform.

    Contact: hello@ethosbook.co

    By using our service, you acknowledge that you have read and understand the practices outlined in this Privacy Policy.

    2. What We Collect

    Information You Provide

    • Account Information: Name, email address, mobile phone number
    • Payment Information: Billing details (processed securely by Stripe - we never see your full card number)
    • Shipping Information: Delivery address for physical books
    • Voice Recordings: Audio stories you record through our platform
    • Photographs: Images you or your family upload to include in the book
    • Profile Information: Details about the person whose story you're preserving

    Information Collected Automatically

    • Technical Data: IP address, device type, browser information, operating system
    • Usage Data: Pages visited, features used, time spent on our platform
    • Analytics Data: Website behavior through Supabase, Meta Pixel, and PostHog (with your consent)
    • Affiliate Tracking: Referral source tracking via Rewardful cookies (with your consent)

    3. How We Use Your Information

    We use your information to:

    • Create your personalized AI-generated biography book
    • Process payments and fulfill orders
    • Send transactional emails (order confirmations, shipping updates)
    • Send service text messages to US mobile numbers (order confirmations, shipping updates, storyteller invitations, story prompts, support replies)
    • Provide customer support
    • Improve our service and develop new features
    • Send marketing communications by email or text message (only with your consent)
    • Detect and prevent fraud
    • Comply with legal obligations

    4. Your Stories Are Sacred

    This section covers everything you give us: your voice recordings, your written stories, and the photographs you upload.

    We NEVER:

    • Use your voice recordings, stories, or photographs to train AI models
    • Share your stories or photographs with third parties for their purposes
    • Include your content in any datasets
    • Access your stories or photographs except when you request support
    • Analyze your stories or photographs for marketing or research
    • Use your photographs as examples, samples, or in any advertising

    How We Process Your Stories:

    • Your voice recordings are transcribed by ElevenLabs (acting as our data processor)
    • The transcripts are used solely to generate YOUR book
    • All processing happens securely and temporarily
    • Your stories remain in your private account, encrypted at rest

    5. How We Share Your Information

    Service Providers (Data Processors)

    We share data with trusted partners who help us deliver our service:

    • Supabase: Hosts and stores all data securely (US and EU regions)
    • Stripe: Processes payments securely
    • Brevo: Sends transactional and marketing emails
    • Twilio: Delivers text messages (SMS) to US mobile numbers
    • ElevenLabs: Transcribes voice recordings
    • Lulu: Prints and ships physical books
    • Meta (Facebook/Instagram): Advertising and conversion tracking (with your consent)
    • Rewardful: Manages affiliate referral tracking (with your consent)
    • PostHog: Analytics and user experience tracking (with your consent)

    All service providers are bound by strict data processing agreements and cannot use your data for their own purposes.

    Legal Obligations

    We may disclose information to:

    • Comply with laws, regulations, or court orders
    • Respond to lawful government requests
    • Protect our rights, property, or safety
    • Investigate fraud or security issues

    Business Transfers

    If we merge with or are acquired by another company, your information may transfer to the new owners under the same privacy protections.

    6. International Data Transfers

    Your data is processed primarily in the United States and Estonia. If you're located elsewhere, your information may be transferred internationally. We protect these transfers using:

    • Standard Contractual Clauses (EU Commission approved)
    • Appropriate technical and organizational security measures
    • Compliance with GDPR and other applicable frameworks

    7. Data Security

    We protect your information using:

    • End-to-end encryption for data in transit (TLS/SSL)
    • Encryption at rest for stored data
    • Regular security audits and vulnerability assessments
    • Access controls and multi-factor authentication
    • Secure backup systems
    • Incident response procedures

    While we use industry-standard safeguards, no system is 100% secure. We will notify you of any data breaches as required by law.

    8. Data Retention

    We keep your data as long as needed to provide our service:

    • Active accounts: Data retained while your account is active
    • Canceled accounts: 90 days (for recovery purposes)
    • Deletion requests: Removed within 30 days
    • Legal requirements: Tax records retained for 7 years
    • Anonymized data: May be kept indefinitely for analytics

    9. Cookies and Tracking

    Essential Cookies (Always Active)

    Required for core functionality:

    • Session management and authentication
    • Shopping cart and checkout
    • Security and fraud prevention

    Optional Cookies (Your Consent Required)

    Analytics:

    • PostHog - User behavior and experience tracking
    • Supabase - Performance monitoring

    Marketing:

    • Meta Pixel - Facebook/Instagram advertising
    • Rewardful - Affiliate referral tracking

    You can manage your cookie preferences through our cookie consent banner. Visit our GDPR Policy for more details about your rights.

    10. Your Privacy Rights

    You have the right to:

    • Access your personal data
    • Correct inaccurate information
    • Delete your data (subject to legal requirements)
    • Restrict processing in certain circumstances
    • Object to processing based on legitimate interests
    • Port your data to another service
    • Withdraw consent for marketing or optional tracking

    To exercise these rights, contact hello@ethosbook.co. We'll respond within 30 days.

    For EU residents, see our GDPR Policy for additional rights and details.

    For California residents, see our CCPA Policy for California-specific rights.

    11. Children's Privacy

    Our service is not intended for children under 13. We do not knowingly collect information from children under 13. If we discover we have such information, we will delete it immediately.

    Users aged 13-17 need parental or guardian consent to use our service.

    12. Marketing Communications

    If you consent to marketing:

    • We'll send updates about Ethos, new features, and special offers
    • You can unsubscribe anytime via the link in emails
    • Service emails (receipts, shipping updates) will continue regardless

    We never sell your email address to third parties.

    Text Messages (SMS)

    Ethos sends text messages to US mobile numbers only.

    How we get your number. You give it to us yourself, on our checkout or signup form, or by texting us first. We never buy phone numbers and we never message a number we were not given directly by its owner.

    What we send. Service messages (order confirmations, shipping updates, storyteller invitations, story prompts, reminders, support replies) and, separately, marketing messages if you ticked the SMS marketing box. Message frequency varies. Message and data rates may apply.

    Marketing texts are never required to buy anything. Agreeing to marketing texts is not a condition of any purchase.

    How to stop. Reply STOP to any message, or email hello@ethosbook.co. Reply HELP for help. Opting out of texts does not cancel your order and you will still receive email.

    Who sees your number. We do not sell phone numbers, and we do not share them with third parties for their own marketing. Our SMS provider handles your number only to deliver our messages, under contract, and cannot use it for anything else.

    The full SMS terms are in section 21 of our Terms of Service.

    13. Third-Party Links

    Our website may contain links to external sites. We're not responsible for their privacy practices. Review their privacy policies before providing them with information.

    14. Changes to This Policy

    We may update this Privacy Policy from time to time. When we do:

    • We'll post the new policy on our website
    • We'll update the "Effective Date" at the top
    • We'll email you about material changes
    • We'll give you 30 days notice for significant changes

    Continued use after changes means you accept the updated policy.

    15. Contact Us

    For privacy questions or to exercise your rights:

    Email: hello@ethosbook.co

    Mail:

    Ethos OÜ

    Kursi tn 3, 10415 Tallinn, Estonia

    Data Protection Officer: hello@ethosbook.co

    We'll respond to your inquiries within 7 business days.

    Your privacy matters to us. We're committed to protecting your family's stories with the same care you put into preserving them.