Trust & Legal

Privacy Policy

Last updated: July 2026

Content currently under legal review — will be validated before official publication.

In this document

01Who we are

HERITA is a digital platform published by Famistore Inc., a company registered in Quebec, Canada. Our head office is located in Montreal, Quebec, Canada. HERITA is the first memorial infrastructure built for the family.

Data Protection Officer (DPO): see HERITA's Contact page

02What we collect

Information you provide directly:

First name, last name, email, encrypted password
Family tree member profiles
La Mémoire content (photos, videos, documents, recordings)
Les Voix and Le Foyer messages
La Lignée messages
Payment information, processed exclusively by Stripe and Flutterwave

Information collected automatically:

IP address (anonymized after 30 days)
Device and browser type
Pages visited (anonymized usage)
Browser language

We never collect the encrypted content of La Mémoire — encryption for this content happens client-side. Access to your data otherwise remains governed by strict permissions and dedicated access control (Row-Level Security).

03Why we collect it

Email and password → authentication (performance of contract)
Profile → personalizing your experience (performance of contract)
La Mémoire content → secure storage and delivery (performance of contract)
IP address → local currency and security (legitimate interest)
Usage data → anonymized platform improvement (legitimate interest)
Payment information → subscription management (performance of contract)
Family tree → production of the Family Book and printed Family Tree on request (performance of contract and consent)

04What we never do

We never sell your data. We never use your data for advertising purposes. We never share your data with advertisers. We never analyze your family memories for commercial purposes. We never use your data to train artificial intelligence models. We never display advertising on HERITA.

Never.

05How we protect your data

Client-side AES-256 encryption for La Mémoire
TLS encryption for all communications
Passwords hashed with bcrypt
Reinforced access control via code confirmation for sensitive areas (Succession Chamber, Health Record, Patrimoine) — an application-level access control, not encryption distinct from what is described above.
Audit log accessible only to you
Row-Level Security — each user can only access their own space

06Where your data is stored

Canada: technical infrastructure notably relies on Vercel and Supabase. European Union: OVHcloud Europe — GDPR compliant (Phase 3). Africa: MainOne (Phase 3).

Your data never leaves your chosen jurisdiction without your consent.

Retention: for the duration of your subscription, then deleted within 30 days of account closure.

07Your rights

Right of access: your data can be obtained on request via HERITA's Contact page
Right to rectification: update your information from your profile
Right to erasure: deletion of your data can be requested via HERITA's Contact page
Right to data portability: an export of your data can be requested via HERITA's Contact page
Right to object
Right to restriction of processing
Right to designate a Successor Guardian

Contact: see HERITA's Contact page — response within 30 days.

If HERITA were ever to cease operating, you would immediately recover all your data. This is a contractual commitment.

08Cookies

Session: keeps you logged in (duration: session)
Authentication: stay signed in (duration: 30 days)
Preferences: language and display (duration: 1 year)
Security: CSRF protection (duration: session)

Zero advertising cookies. Zero third-party tracking.

09Minors

Account creation and Primary Guardian status are reserved for individuals aged 18 and over.

Minors may be added to the family tree by an adult Guardian, with appropriate permissions.

To report a concern: see HERITA's Contact page

10Third parties and partners

Stripe: card payments — payment information only
Flutterwave: mobile payments for African markets
Daily.co: end-to-end encrypted video calls
Brevo: transactional emails — email address and service email content only
Supabase: database, authentication, and content storage
Vercel: web interface delivery (CDN) — IP address and HTTP requests only

None of our providers is authorized to use your data for any purpose other than the one for which they were engaged.

11Transmission after death

Succession Protocol: designation of a Successor Guardian, confirmed by two Trusted Guardians.

La Lignée: messages are delivered according to the trigger you configured, even after death.

Moral Testament: accessible to designated individuals, according to the visibility conditions you set.

Account closure by an heir: upon presentation of legal proof, via HERITA's Contact page.

12Changes

You will be notified 30 days in advance of any substantial change to this policy, by email.

The current version is always available at www.herita.life/confidentialite.

The level of protection of your data will never be reduced without your explicit consent.

13Contact us

Data Protection Officer (DPO), Support, Digital succession: see HERITA's Contact page

Address: Famistore Inc., Montreal, Quebec, Canada

Relevant authorities: Office of the Privacy Commissioner of Canada — priv.gc.ca; Commission d'accès à l'information du Québec — cai.gouv.qc.ca; for EU residents, the data protection authority of your country of residence (GDPR).