Privacy Policy

RootsNRites is operated by RootsnRites Ltd, a company registered in England & Wales (company no. [COMPANY NUMBER], registered office [REGISTERED OFFICE ADDRESS]). RootsnRites Ltd is the data controller for the personal data described here. We work with a technology partner, ONINE Innovations Pvt Ltd (India), which processes data on our instructions as our processor.

Family data is among the most personal data there is. Our promises are simple: we never sell family data, we never use it to train AI models, and we show no ads.

What we collect

• Account data — your name, email address, password (stored hashed), date of birth (to confirm you meet our minimum age) and optional profile photo. If you sign in with a provider (e.g. Google), we receive your name, email and avatar from them.
• Family tree data — the names, relationships, dates and notes you add about your family members.
• Memories — voice and video recordings you capture, and their transcriptions (where this feature is available to you).
• Event and marketplace data — ceremonies you plan, RSVPs (including any dietary preferences guests choose to share).
• Usage data — analytics about how the product is used, only if you consent (see Cookies & analytics).
• Technical data — IP address and device/user-agent, used to keep the service secure and prevent abuse.

Our lawful bases (UK GDPR Article 6)

• Contract — to create and run your account and provide the features you ask for (rendering your tree, ritual calendar, events).
• Legitimate interests — to keep the service secure, prevent abuse, and to store information about the family members you add so the product can work. You can object to processing based on legitimate interests (see Your rights).
• Consent — for optional analytics cookies, for any marketing email, and for special-category data (below). You can withdraw consent at any time.

Special-category data (religion, and related information)

RootsNRites is built around family rituals, which can reveal religious or philosophical beliefs, and family records can reveal community or ethnic origin. This is special-category data under UK GDPR Article 9. Where we process it — for example generating a ritual calendar for your family, or storing dietary preferences — we rely on your explicit consent, which you give when you provide that information and which you can withdraw at any time by deleting the data or contacting us.

Family members and others you add

Some people in your tree are not RootsNRites users and their data reaches us from you rather than from them (UK GDPR Article 14). We act as controller for that data. If you are one of those people and want to know what we hold, object to our processing, or have your record removed, contact [email protected] — we will action reasonable requests and respond within one month. Because these records come to us indirectly, we make this notice public rather than contacting each person individually; where we can reasonably do so, we support you in informing your relatives.

How we use it

• To provide the product: render your tree, generate your ritual calendar, transcribe memories, coordinate events.
• To keep your account secure and prevent abuse.
• To email you about your account and rituals you asked to be reminded of, and — only if you have opted in — occasional product updates.

We do not sell or rent your data to anyone, and we do not use your family data to train machine-learning models.

Cookies & analytics

We set essential cookies for sign-in, security and remembering your language. We use Google Analytics 4 to understand product usage, but only after you accept via our cookie banner — analytics cookies are not set until you opt in, and you can change your choice any time via Cookie settings in the footer. We honour the Global Privacy Control browser signal as an opt-out. We show no advertising and use no advertising cookies.

Where your data is stored, and international transfers

Your data is hosted on Amazon Web Services (currently in the United States) and is administered by our team and by our processor ONINE Innovations Pvt Ltd in India. Because the UK has no adequacy decision covering these locations, we protect these transfers using the ICO's International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. You can request a copy of the safeguards from [email protected].

Sharing

We share data only with the service providers needed to run RootsNRites (hosting, email delivery, transcription, our technology partner ONINE) under contracts that limit them to processing on our instructions — and with people you explicitly choose to share a tree or invitation with. We may disclose data where the law requires it.

Public trees and consent

• Trees are private by default. A tree appears in the public directory only when its owner sets it to public and a curator approves the listing.
• Lineage search covers opt-in profiles only, with consent-first matching: nothing is shared until both families say yes.
• Under-18s are not shown in public or shared trees — a family member with a recorded birth date showing they are under 18 has their details hidden from anyone who is not a member of the tree, whether the tree is public, unlisted, or shared by link.
• Every change to a tree's public visibility is recorded in an audit log.

Retention

• Account and family data — kept while your account is active; deleted within 30 days of account deletion, including from backups on their normal expiry cycle.
• Waitlist / marketing leads — kept for up to 24 months from last contact, then deleted or anonymised; IP/user-agent are cleared sooner once they have served their security purpose.
• Security and audit logs — kept for up to 12 months.

Your rights

You have the right to access, correct, export, restrict or delete your personal data, to object to processing based on legitimate interests, and to withdraw consent. You can delete individual people, memories or whole trees in-product at any time, or delete your whole account from your profile. To exercise any right, write to [email protected] and we will respond within one month. If you are unhappy with our response you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

US state privacy rights

If you are a resident of California or another US state with a comprehensive privacy law, you have the right to know what personal information we collect, to access, correct and delete it, and not to be discriminated against for exercising these rights. We do not sell or share your personal information for cross-context behavioural advertising. We treat the Global Privacy Control signal as a valid opt-out. Categories we collect include identifiers, internet activity (analytics, with consent), and — with your consent — sensitive information revealing religious beliefs. To make a request, contact [email protected].

India (Digital Personal Data Protection Act 2023)

If you are in India, or your personal data is processed in connection with offering RootsNRites in India, the Digital Personal Data Protection Act 2023 (DPDP Act) applies. For that processing, RootsnRites Ltd is the Data Fiduciary (it determines the purposes and means of processing your personal data), and ONINE Innovations Pvt Ltd (India) is the Data Processor, engaged by us under a valid contract as required by section 8(2) of the DPDP Act to process personal data only on our instructions. Terms such as Data Principal, Data Fiduciary and personal data have the meanings given to them in the DPDP Act.

Notice and consent (section 5)

Where we rely on your consent, we ask for it through a clear request and give you this notice of:

• The personal data we process — the account, family tree, memories, event, usage and technical data described in What we collect above.
• The purposes — to provide the product (render your tree, generate your ritual calendar, transcribe memories, coordinate events), to keep your account secure, and — only where you opt in — analytics and product-update email, as described in How we use it.
• How to withdraw consent — you may withdraw your consent at any time, and doing so is as easy as giving it was: delete the relevant data in-product, change your choice in Cookie settings in the footer, or write to [email protected]. Withdrawing consent does not affect processing already carried out, and we will stop the relevant processing without undue delay.
• How to complain — you may make a complaint to the Data Protection Board of India in the manner it provides.

This notice is available in English and, on request, in any of the languages listed in the Eighth Schedule to the Constitution of India.

Your rights as a Data Principal (sections 11–14)

• Right to access — to obtain a summary of the personal data we process about you and the processing activities we undertake (section 11).
• Right to correction and updating — to have inaccurate or incomplete personal data corrected, completed or updated (section 12).
• Right to erasure — to have your personal data erased where it is no longer needed for the purpose it was collected, unless we must retain it to comply with the law (section 12).
• Right of grievance redressal — to have a readily available means of registering a grievance with us, which we must answer within the period the law prescribes, before approaching the Data Protection Board (section 13).
• Right to nominate — to nominate another individual who may, in the event of your death or incapacity, exercise these rights on your behalf (section 14).

To exercise any of these rights, contact our Grievance Officer below. You also have the duties set out in section 15 of the DPDP Act, including not raising false or frivolous grievances.

Grievance Officer

For any question, request or complaint about how we handle your personal data under the DPDP Act, contact our Grievance Officer:

[GRIEVANCE OFFICER NAME], Grievance Officer
RootsnRites Ltd, c/o ONINE Innovations Pvt Ltd
[INDIA REGISTERED ADDRESS]
Email: [email protected] · Phone: [PHONE]

We will acknowledge your grievance within 24 hours and aim to resolve it within 15 days of receipt. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Personal data breach notification (section 8(6))

In the event of a personal data breach, we will notify the Data Protection Board of India and each affected Data Principal in the form and manner prescribed under the DPDP Act.

Cross-border transfer (section 16)

Your data is hosted on Amazon Web Services in the United States and is administered by our processor ONINE Innovations Pvt Ltd from India. The DPDP Act permits transfer of personal data outside India, save to any country that the Central Government may notify as restricted. We will comply with any such restriction, and this transfer is also protected by the safeguards described in Where your data is stored, and international transfers above.

Reasonable security practices (SPDI Rules 2011)

For sensitive personal data or information within the meaning of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, we implement and maintain reasonable security practices and procedures through a documented information-security programme with controls aligned to the ISO/IEC 27001 standard, commensurate with the nature of the information and the harm that could result from its compromise.

Children

You must be at least 13 to hold an account, and if you are under 18 you confirm a parent or guardian permits your use. We apply high-privacy defaults to accounts we believe belong to under-18s. Adults may add children as family members; we minimise what we store about them and never show under-18s in public or shared trees.

Changes

If we change this policy in a way that matters, we will tell you by email or an in-product notice before the change takes effect.

Contact

RootsnRites Ltd · [email protected]
Registered office: [REGISTERED OFFICE ADDRESS] · ICO registration no. [ICO REGISTRATION NUMBER]