Privacy Policy

This Privacy Policy explains how Hill Tribe Solutions, Inc., a California corporation ("Hill Tribe Solutions," "Hmong Memorial," "we," "us," or "our"), collects, uses, discloses, retains, and protects information when you use the Hmong Memorial website at https://hmongmemorial.com, Memorial Studio, related applications, and associated services (collectively, the "Services"). It also explains choices and rights that may be available to you.

Hill Tribe Solutions, Inc. is the business responsible for the information practices described in this Privacy Policy. Our contact information is in Section 17.

1. Our Privacy Commitments

Hmong Memorial is designed for private family memorial work. In particular:

• we do not sell personal information;
• we do not share personal information for cross-context behavioral advertising;
• we do not use family photographs, memorial details, or generated artwork to serve advertising;
• we do not make memorial projects publicly searchable through the Services;
• we limit access to family photographs and memorial projects to authorized users and service providers that need the information to perform services for us;
• generated previews may be watermarked, while reviewed downloads may be provided without a watermark; and
• when photograph safety review applies, an upload that is not accepted is not retained as active project content.

We use personal information to provide, secure, support, and improve the Services; comply with law; and protect families, Hill Tribe Solutions, and others. We do not use photographs to authenticate identity or create facial-recognition profiles.

2. Scope

This Privacy Policy applies to information processed through the Services and to related support, safety, and administrative interactions. It does not apply to:

• third-party websites or services that you visit independently, even if the Services link to them;
• information processed by a printer, funeral home, social network, or other recipient after you download or provide a memorial file to that recipient; or
• Hill Tribe Solutions products or services that display a different privacy policy.

The Services are intended for adults. A memorial project may contain information about a deceased person and photographs of living people, including minors, submitted by an authorized adult. Section 13 explains our approach to children and minors.

3. Notice at Collection

The following table summarizes the categories of personal information we collect, why we collect them, and the criteria used to determine retention. "Service providers" means vendors and contractors that process information for us to provide functions such as hosting, authentication, storage, content safety, content generation, communications, security, and support. Provider identities and material processing details may be provided in separate subprocessor information or another appropriate notice.

We do not currently collect payment-card or bank-account information through Memorial Studio because the Services are offered without charge. If paid features are introduced, we will provide additional notice before collecting or directing a payment processor to collect payment information.

Some memorial content can be highly personal and may reveal or suggest racial or ethnic origin, religious or philosophical beliefs, or health or disability. We process that content only to provide, secure, and support the Services and for the other compatible purposes described here. We do not use or disclose it to infer characteristics for advertising.

4. Information We Collect

4.1 Information you provide

We collect information you choose to provide, including:

• your email address, name, and account or invitation information;
• memorial names, dates, family-used titles, family messages, and other display text;
• family photographs and associated file information;
• your photograph, scene, style, cultural, revision, review, and download choices;
• any previously saved legacy family notes; and
• support, privacy, safety, and legal communications.

Please do not upload government identifiers, financial information, medical records, or other information that is not needed to create the memorial.

4.2 Information collected automatically

When you use the Services, we and our infrastructure and authentication service providers may automatically process device, request, session, and security information. This may include IP address, browser type, device type, operating system, timestamps, referring or requested URLs, response and error information, cookie or session identifiers, and events used to authenticate users, maintain availability, prevent fraud, and diagnose problems.

Memorial Studio also uses limited browser storage as described in Section 9.

4.3 Information generated through use of the Services

We create service-related information when you use the Services, including project activity, generation and revision activity, review and download history, safety outcomes, usage information, diagnostic information, and audit records.

Some of this information can be linked to your account or project. We use it to provide requested functions, secure the Services, maintain reliability, prevent unauthorized or duplicate activity, investigate problems, and fulfill deletion and legal obligations.

5. Family Photographs and Other People’s Information

Family photographs may identify living people and may include children. Memorial details may also concern family members or other people. If you submit information about another person, you represent that you are authorized to do so and that you have provided any notice and obtained any permission required by law and your family’s circumstances.

You control which photographs are uploaded and which photograph is designated as the primary likeness. Family reference photographs are kept private within the memorial project and are made available only to authorized users and service providers as needed to provide the Services. They are not intended for public access through the Services.

A selected file may be prepared on your device before it is uploaded. We receive the resulting image and associated file information. We do not intentionally extract precise location or device metadata embedded in the original file, but file and browser behavior can vary. Remove sensitive metadata before selecting a file if this is a concern.

6. Photograph Safety Review

We may use automated tools to help assess whether uploaded photographs comply with our safety and acceptable-use requirements. An upload may be declined or unavailable when it cannot be accepted under those requirements or when the review cannot be completed. Automated tools can make mistakes.

If an upload is not accepted, we do not retain it as project content. We may retain limited, non-image information as reasonably necessary for security, service reliability, legal compliance, and enforcement.

Service providers may process photographs for this purpose under our applicable service arrangements and as described in any subprocessor information we make available.

This review is a content-safety measure. It is not used to create facial-recognition profiles or make decisions about employment, credit, housing, education, insurance, legal services, or other similarly significant services.

7. Automated Artwork Generation

To create or revise memorial artwork, we may provide service providers with family photographs, project choices and instructions, relevant cultural-reference materials, and prior artwork when you request a revision. We limit these disclosures to information reasonably necessary to provide the requested service.

We process memorial names, dates, titles, messages, and other project content as needed to create, display, review, revise, and provide the completed memorial.

We may store generated artwork, previews, project selections, review history, and download-related information while a project is active. Previews may be watermarked, while a reviewed download may be provided without a watermark.

Service providers may return generated content and service-related status information. We do not use family photographs, memorial details, or generated artwork to train a general-purpose model owned by Hill Tribe Solutions. Provider-specific processing and retention are governed by our applicable service arrangements and may also be described in subprocessor information we make available.

8. How We Use Information

We use personal information to:

• provide and administer accounts, invitations, memorial projects, uploads, artwork, review, and downloads;
• validate content, manage authorized access, and apply service limits;
• create and revise memorial artwork based on family photographs and direction;
• apply photograph-safety and acceptable-use requirements;
• authenticate users, maintain sessions, and secure accounts and projects;
• communicate about service operations, support, safety, privacy, and legal matters;
• maintain reliable operations, usage controls, diagnostic records, and deletion processes;
• detect, prevent, and investigate fraud, abuse, unauthorized access, prohibited content, and security incidents;
• enforce our Terms and Conditions and other policies;
• comply with law, legal process, and valid governmental requests; and
• establish, exercise, or defend legal claims and protect the rights, safety, and property of families, Hill Tribe Solutions, service providers, and others.

We may create aggregated or deidentified information for operational measurement, reliability, safety, and product improvement. We take reasonable measures to prevent deidentified information from being associated with a person or household, publicly commit to maintain and use it only in deidentified form, and do not attempt to reidentify it except as permitted by law to test our deidentification methods. If we disclose deidentified information, we contractually require the recipient to maintain it in deidentified form and comply with these restrictions.

9. Cookies, Authentication, and Browser Storage

The Services use authentication and session technologies that may include cookies and limited local or session browser storage. We use these technologies for secure sign-in, session continuity, user preferences, fraud prevention, and reliable operation of requested features. Hmong Memorial does not use them for behavioral advertising.

Some browser storage may remain until it is cleared by you, your browser, or the Services, while session-based storage ordinarily clears when the relevant session ends. Blocking required authentication or browser storage may prevent sign-in or other features from functioning correctly.

We do not currently use third-party advertising pixels or cross-site behavioral analytics in Memorial Studio. Other parties are not authorized by us to collect personally identifiable information about your online activities over time and across unrelated websites through Memorial Studio for advertising purposes.

Legacy “Do Not Track” signals do not change how the Services operate. Global Privacy Control and similar legally recognized signals communicate an opt-out from sale or cross-context behavioral-advertising sharing. Because we do not currently engage in either activity, receiving such a signal does not require a different processing result. If those practices change, we will recognize qualifying signals as required before the changed practice begins.

10. How We Disclose Information

We may disclose personal information to the following categories of recipients for the purposes described in this Privacy Policy:

10.1 Service providers and contractors

We use or may engage providers for:

• application hosting, databases, storage, and content delivery;
• authentication, account security, and service communications;
• content-safety services;
• content generation and related processing;
• security, diagnostics, and technical support; and
• professional services such as legal, accounting, insurance, and audit support.

These providers receive information reasonably necessary to perform their functions. We seek to require providers acting on our behalf to process personal information for specified purposes and to protect it appropriately. Provider identities may change as the Services evolve. We intend to maintain a separate subprocessor list for provider-specific transparency rather than embedding provider names in this Privacy Policy.

10.2 Legal, safety, and rights protection

We may disclose information when we reasonably believe disclosure is necessary to comply with law, regulation, legal process, or a valid governmental request; protect a person from harm; investigate security incidents, fraud, or abuse; enforce our agreements; or establish, exercise, or defend legal claims.

10.3 Corporate transactions

We may disclose information in connection with a proposed or completed merger, financing, acquisition, reorganization, bankruptcy, receivership, sale of assets, or similar transaction. A recipient would be permitted to use personal information only as allowed by applicable law, this Privacy Policy, or notice provided in connection with the transaction.

10.4 At your direction

We may disclose information when you direct us to do so or provide consent. Downloading a memorial export places a copy under your control. Any later printing, posting, messaging, or sharing of that copy is directed by you and is outside our control.

10.5 No sale or behavioral-advertising sharing

We have not sold personal information or shared personal information for cross-context behavioral advertising in the preceding 12 months. We do not have actual knowledge that we sell or share the personal information of people under 16. We do not use or disclose sensitive personal information for purposes that would require a right to limit under the California Consumer Privacy Act.

11. Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Services, maintaining security and system integrity, completing deletion and reconciliation, complying with law, resolving disputes, and enforcing agreements. The Notice at Collection in Section 3 provides category-specific criteria.

11.1 Removing a photograph

When you remove a family photograph, we remove it from the active memorial project and schedule deletion from our storage. Limited non-content records may remain as reasonably necessary to complete and verify deletion, maintain security and service integrity, comply with law, and resolve disputes.

11.2 Deleting a memorial project

When you delete a memorial project, we remove its content from active project systems and schedule stored photographs and artwork for deletion. We may retain limited non-content records as reasonably necessary for security, accounting, legal compliance, dispute resolution, enforcement, and service integrity.

A request that is still being processed may temporarily delay self-service deletion. If self-service deletion is unavailable, contact us using the methods in Section 12. We handle verified privacy requests within the time and subject to the exceptions required or permitted by applicable law.

11.3 Account closure and privacy requests

Memorial Studio does not currently provide a self-service account-deletion control. You may request account closure or deletion of personal information as described in Section 12. We may retain information when required or permitted by law, including records needed for security, fraud prevention, accounting, dispute resolution, enforcement, and legal claims.

Deletion from active systems may not immediately remove residual copies. Residual copies may remain in service-provider backups or limited operational systems under the provider’s documented retention practices. We handle deletion requests as required by applicable law and our applicable service arrangements.

We may retain aggregated or deidentified information that cannot reasonably be linked to you. We may also retain information you have made public outside the Services or that another person lawfully provided to us, subject to applicable law.

12. Your Choices and Privacy Rights

You can review and update memorial details and project choices within Memorial Studio while a project is active. You can remove individual family photographs and delete a memorial project, subject to the operational limitations described above.

Depending on where you live and the law that applies, you may have the right to:

• confirm whether we process your personal information;
• request access to or a portable copy of personal information;
• request correction of inaccurate personal information;
• request deletion of personal information, subject to exceptions;
• obtain information about categories of information, sources, purposes, and recipients;
• opt out of a sale, cross-context behavioral-advertising sharing, or targeted advertising;
• limit certain uses or disclosures of sensitive personal information;
• withdraw consent where processing is based on consent;
• appeal a decision on a privacy request; and
• receive equal service and not be retaliated against for exercising a privacy right.

Some of these rights do not apply in every jurisdiction or circumstance. Because we do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, there is no sale, sharing, or targeted-advertising activity to opt out of at this time.

12.1 How to submit a request

Submit a privacy request by:

• emailing [email protected] with the subject “Privacy Request”; or
• writing to the postal address in Section 17, Attn: Hmong Memorial Privacy.

Describe the right you wish to exercise and provide the email address associated with your account. Do not send family photographs, government identification, or other sensitive documents with your initial request. We may ask you to verify control of the account email or provide information reasonably necessary to match you with our records. We will use verification information only to process the request.

If your request concerns information that another account holder submitted about you or your child, describe the information and, if known, the project or submitting family member. You do not need a Hmong Memorial account to submit the request. We may request information reasonably necessary to authenticate your identity, parental or guardianship authority, and connection to the information. We will not disclose another user’s personal information while processing your request.

An authorized agent may submit a request where applicable law permits. We may require proof of the agent’s authority and may ask you to verify your identity or confirm the request directly, unless an exception applies. If we deny a request, you may reply to the decision to request an appeal where applicable law provides that right.

We will respond within the period required by applicable law. We generally do not charge a fee, but may charge a reasonable fee or refuse a request if permitted by law because the request is manifestly unfounded, excessive, repetitive, or fraudulent.

12.2 California privacy disclosures

The California Consumer Privacy Act ("CCPA") applies only to covered businesses. If and to the extent Hill Tribe Solutions is subject to the CCPA with respect to your personal information, California residents have the rights and disclosures described in this subsection. Where the CCPA does not require us to honor a request, we may nevertheless consider the request under this Privacy Policy, subject to appropriate verification and other applicable law.

Subject to applicable exceptions, California residents may request the categories and specific pieces of personal information we maintain; the categories of sources, purposes, and recipients; deletion or correction; and information in a portable format where required. California residents also have the right not to receive discriminatory treatment for exercising CCPA rights. Because we do not sell or share personal information or use sensitive personal information for purposes that trigger a right to limit, those opt-out rights do not currently require a separate request mechanism.

For purposes of California law, the categories of personal information we have collected in the preceding 12 months may include:

• Identifiers, such as name, email address, account, device, online, IP, project, and service-related identifiers;
• California customer-record information, such as name and contact information;
• Characteristics of protected classifications, when revealed by photographs, memorial content, family direction, or communications, such as age, racial or ethnic origin, religious belief, or disability;
• Commercial information, such as records of requested services, generations, revisions, exports, and associated usage or cost records, even when the Services are provided without charge;
• Internet or other electronic network activity, such as interaction, request, session, security, and diagnostic information;
• Geolocation information, limited to approximate location that may be inferred from an IP address; we do not request precise location for Memorial Studio;
• Audio, electronic, visual, or similar information, including family photographs, generated artwork, previews, exports, and communications;
• Inferences, such as project preferences needed to provide scene, style, cultural-element, safety, and generation functions; and
• Sensitive personal information, when supplied or revealed, such as racial or ethnic origin, religious or philosophical beliefs, personal information collected and analyzed concerning health, account-authentication information that permits access, and personal information of a person we actually know is under 16. We do not process photographs to create biometric identifiers or to uniquely identify a person.

We collect these categories from you, your browser or device, your use of the Services, people acting for or with your authorization, and our service providers. We use them for the purposes listed in Sections 3 and 8. We may disclose the relevant categories to the recipient categories in Section 10 for business purposes. In the preceding 12 months, those business-purpose disclosures may have included identifiers, customer-record information, protected-class or sensitive information included in submitted content, commercial information, internet activity, approximate geolocation, visual information, inferences, and sensitive personal information.

We have not sold these categories or shared them for cross-context behavioral advertising in the preceding 12 months. If a future practice materially changes that statement, we will update this Policy and provide any notice and opt-out mechanism required by law before the change applies.

13. Children and Minors

The Services are not directed to children under 13 or to persons under 18, and minors may not create accounts. We do not knowingly collect personal information online directly from a child under 13.

An adult account holder may submit a family photograph depicting a minor only when authorized as described in our Terms and Conditions. Information about a child submitted by a parent, guardian, or other adult is treated as project content. If you believe a child under 13 created an account or submitted personal information directly to us without appropriate authorization, contact us so we can investigate and delete the information as required.

We do not knowingly sell or share for cross-context behavioral advertising the personal information of consumers under 16.

14. Security

We use administrative, technical, and organizational safeguards designed to protect personal information appropriate to its nature and the risks involved. These safeguards include measures addressing access control, account and session security, protection of stored and transmitted information, service monitoring, provider management, incident response, and deletion. We review and update safeguards as the Services and relevant risks evolve.

No method of transmission, processing, or storage is completely secure. We cannot guarantee that unauthorized parties will never defeat safeguards or that information will never be lost, altered, or disclosed. You are responsible for keeping access to your email account and devices secure and for promptly notifying us of suspected unauthorized access.

15. U.S. Processing

The Services are intended for use in the United States and are operated from the United States. Service providers may process information in the United States or other locations identified in any subprocessor information we make available. If we intentionally offer the Services in another jurisdiction, we will provide any additional notice and transfer protections required for that offering.

16. Changes to This Privacy Policy

We may update this Privacy Policy as the Services, our providers, or applicable laws change. We will post the updated version with a revised “Last updated” date. If a change materially affects how we use personal information, we will provide reasonable advance notice through the Services, by email, or by another appropriate method, unless an immediate change is required for legal, security, or safety reasons.

We will not apply a materially different use of previously collected personal information without the notice or consent required by law.

17. Contact Us

For privacy questions, requests, or complaints, contact:

Hill Tribe Solutions, Inc. Attn: Hmong Memorial Privacy 8465 Elk Grove Florin Rd, Ste 100 #2121 Elk Grove, CA 95624 United States Email: [email protected] Telephone: (916) 287-8805

If you have an unresolved privacy concern, you may also have the right to contact the privacy or data-protection authority where you live.