Legal
Privacy Policy
Continuum Aftercare. Effective October 25, 2026. Like everything else on this site, this page was written against the code that makes it true, and it changes when the code does.
If you are a family, read this part
If a funeral home sent you a link, the funeral home holds your information — not us. We make the software they are using. We hold their copy of it, and we do not use anything about you or about the person who died for any purpose of our own.
So if you want to know what is held about your relative, or want it corrected, or want it deleted, ask the funeral home. They can do all three themselves, without asking us. They can hand you the whole file as a folder of photographs and plain text, and they can erase it permanently.
Four things that may be worth knowing, plainly:
- Your link is your way in, and there is no account. We did not ask you to choose a password or fill in a registration form, because three days after somebody dies is the wrong moment to be locked out of a form. That means the link works for whoever holds it, so treat the text message as private, and tell the funeral home if it goes somewhere it should not — they can switch it off in one click, immediately. A link that nobody opens for 90 days stops working; every visit keeps it open, and for a family receiving check-ins it lasts a year and a month.
- Nobody sells any of this. Not the photographs, not the obituary, not what you wrote in the message thread. There is no advertising here, no tracking across other websites, and nothing is used to train any artificial intelligence. There is no version of this where your mother’s photographs are somebody’s asset.
- Nothing you write here is published. An obituary written in this portal goes to the funeral home, not to a website. If it appears anywhere public, that is because the home put it there.
- Where a photograph was taken stays private. Phones write the location into every picture. We take that hidden camera data out of every photograph as it arrives, so nothing we store or pass on says where a picture was taken.
The rest of this page is the full detail, and it is mostly about funeral homes because they are our customers.
1. Who is responsible for what
There are two different kinds of information here and they are governed differently. Being clear about which is which is the point of this section.
Information about a deceased person and their family. The funeral home is the controller. They decide what is collected, why, and how long it is kept. We are their processor: we hold it and act on their instructions and have no purpose of our own for it. The home’s own privacy notice governs it, and our Data Processing Agreement is what we have promised them about how we handle it. A copy is available on request — write to help@continuumaftercare.com.
Information about a funeral home and its staff. Here we are the controller. This is our own business record — who our customer is, who works there, and what we bill them. Sections 3 onward are about this.
2. What we hold on behalf of a funeral home
Because we are the processor and not the controller, this is a description rather than a purpose. In full, it is:
- About the person who died. Name, dates, place of birth, parents’ names, marital status, occupation, veteran status, residence — and the full data set a death certificate requires, which includes a social security number and cause-of-death information. The dates are what drive the death-certificate deadline clock, counted from the moment they come into your care and set to your state’s rules, in the console.
- Photographs the family uploads, commonly of the deceased.
- About the family. Names, relationships, phone numbers, email addresses.
- What the family writes. The obituary, messages to the home, hymn and reading choices, memories, eulogies, life stories, answers to the home’s questions about the person who died, recipe cards, a list of their family, a private journal, and texts sent back to the home’s notes.
- The memory book. Where a home makes one, a family is told when they begin that it is made from what they share. A new answer or recipe card goes into it, with its writer’s name, unless they mark it “Keep this private”; anything marked private is kept for its writer alone and the funeral home never reads it. The journal and texts sent back stay private unless their writer chooses to put a copy in the book. A home’s staff see only what is in the book, and may leave something out of it, but never change it.
- The arrangements. Service date and place, the timeline, belongings and their chain of custody.
How it is protected. Photographs and social security numbers are encrypted with AES-256-GCM before they are written, and backups are encrypted as whole files. A social security number is only ever shown back masked to its last four digits — which is all anybody needs to confirm they have the right number — and social security numbers are deliberately left out of exports, because an export gets emailed and copied to a laptop. When a case is opened, the director also records the last four digits from the paperwork as a check: when the family’s nine arrive and do not end in the same four, the console says so before anybody files the wrong person’s number with the state.
Where a photograph was taken. Phones record the location in every photograph. We remove that, and the rest of the hidden camera data, from every photograph as it arrives, so nothing we store or pass on says where a picture was taken.
We do not use any of it for anything. No analytics, no marketing, no research, no training any model, and never combined with another home’s data or with anything from outside. Those are written as prohibitions in the Data Processing Agreement, not as preferences here.
Who at our company can see it. Almost nobody, and never without a record. Access requires both a staff account of ours and membership of an access list that is empty by default, and every single time one of us reads across the boundary between funeral homes it writes a log entry naming who did it and what they looked at — written before the data comes back. A home’s owner can see every entry concerning their home in the console, whenever they like.
3. What we hold about a funeral home and its staff
| What | Why |
|---|---|
| Staff name, work email address, job title | So they can sign in, and so the family knows who they are talking to |
| A hashed password, and session records | To sign them in and keep them signed in |
| The home's name, address, phone numbers, opening hours, logo, brand color | To run the service, and so the family's experience looks like it came from that home |
| Billing contact, subscription state, and how many funerals the home has served | To bill for the service, and because the home's plan is charged per location plus per funeral served |
| Colorado registration and practitioner licensure details, where entered | So the console can show the home where its own deadlines fall |
| Server logs | To keep the service running and to investigate a fault |
Why we are allowed to. To perform our contract with the home, and for our legitimate interest in running and securing a service and getting paid for it.
How long. While the account is open. Invoices and the record that an account existed are kept, for tax and accounting. A home can also erase any case itself, at any time. Sessions expire after 30 days. Server logs are kept for a limited period and hold no case content.
4. Cookies
One cookie: the staff session. It is HttpOnly, Secure, and SameSite=Lax, and it exists so that a signed-in director stays signed in.
There are no analytics cookies, no advertising cookies, and no third-party trackers of any kind. The family portal sets no cookie at all. We do not track anybody across other websites, and there is nothing here to consent to because there is nothing here to refuse.
5. Who else sees anything
The services that run this one, and what reaches each of them. Photographs, messages and vital statistics reach none of them except Prodigi, and only in the book a home asks us to print, which is the point of the order. Some do see the name of the person who died: an aftercare check-in email names them, and so do the obituary fields sent to Anthropic when a director asks for a suggested rewrite.
| Who | What they get |
|---|---|
| Replit | Runs the application and the database, in the United States. Everything, encrypted at rest as described above. |
| Stripe | The home's billing contact and its subscription. Card details go to Stripe directly and are never held by us. No name of any deceased person, no case content, no family data, ever. |
| Namecheap (Private Email) | A recipient address and a message: password resets, staff invitations, address confirmations, trial notices, aftercare check-ins, intake alerts. Our mail is sent through Namecheap's mail servers, from continuumaftercare.com. |
| Twilio | A phone number, the family's link, and the home's name — when a home texts a family their link. Texting only happens where it has been set up; it is off otherwise. |
| Prodigi | A family's name and postal address, and the memory book's print file — when, and only when, a home orders that family a printed memory book. Printing it is the job. |
| Anthropic | One obituary's fields, only if suggested rewrites are enabled and a director asks for one and confirms. Never photographs, messages or vital statistics. |
| Sentry | Error reports, only if we have it switched on: the fact that something broke and where in the code, with personal details scrubbed out first. No request bodies, no addresses, no case content. It exists so that we find out when it breaks. |
| Google Places | Search terms and a ZIP code, only if the home connects its own key and runs a vendor search. No family details. |
There is no analytics provider, no advertising network, no session recording, and no customer-data platform. Nothing about a case is used to train any model.
We will also disclose information if the law requires it. If we receive a demand for a funeral home’s data we will tell them before responding, unless we are legally prohibited from doing so, so that they can object.
If we are ever acquired, your families’ data does not change character on a change of ownership: the prohibitions in the Data Processing Agreement bind whoever acquires us.
6. Where it is, and where it is not
Everything is stored and processed in the United States. We do not transfer it internationally. Our sub-processors are US companies.
7. Your rights
If you are a family, your rights run against the funeral home — see the top of this page. They can honor all of them without us.
If you are a funeral home or a member of its staff, and depending on where you live, you may have the right to know what we hold about you, to correct it, to have it deleted, to get a copy, to object to processing based on legitimate interest, and to appeal a refusal. Under the Colorado Privacy Act you also have the right to opt out of targeted advertising, of the sale of personal data, and of profiling. We do none of those three, so there is nothing to opt out of, and we honor universal opt-out signals regardless.
Write to help@continuumaftercare.com. We answer within 45 days and will not charge you. If we refuse, we will say why and tell you how to appeal; if we refuse the appeal you may complain to the Colorado Attorney General.
8. Consent, where it is actually asked for
One feature in this service asks for consent, and it asks properly.
When a funeral home closes a case it can enroll the family in grief check-ins at 30, 60, and 90 days and on the anniversary, signed in the home’s name. That enrollment starts as pending and sends nothing at all until the family agrees. Before they decide they are shown the actual dates the messages would arrive, and a decline sits next to the agreement with equal visual weight. A decline is final. Consent is checked again at the moment of sending, not just when the schedule was written, and it can be withdrawn from either side at any time — including from the check-in itself, each of which carries the home’s postal address and a link that stops the rest.
This is deliberate, and the reason is that the Colorado Privacy Act is explicit that broad terms-of-service acceptance, a pre-ticked box, or a deceptively designed page is not consent for sensitive data. Accepting a policy page is not consent to be contacted about somebody who died.
Text messaging and your phone number
Continuum Aftercare LLC sends text messages only to families who have opted in through their funeral home. Mobile opt-in information and records of consent are never sold, rented, or shared with any third party or affiliate for marketing or promotional purposes. A phone number given for texting is used only to send the messages the family agreed to receive.
9. Children
This service is not for children and we do not knowingly collect anything from one. A deceased child’s details may appear in a case, entered by an adult arranging the funeral; that is the funeral home’s record, held under Section 2.
10. Deceased people
Most privacy law does not give rights to the dead, and that is not the standard we work to. The information here — a photograph of somebody in an open casket, their cause of death, their social security number — is treated as sensitive throughout, whichever statute happens to reach it.
11. Security, plainly
In short: encryption at rest for the things that would hurt most, TLS everywhere, scrypt password hashing, one funeral home’s records unreachable from another’s account by a rule the build tests, family links stored only as a digest and revocable in one click, and an audit log of every time anyone here looks across that boundary. The measures are listed in full in our Data Processing Agreement.
We do not hold SOC 2 or ISO 27001 certification and do not claim to.
No system is perfectly secure. If something goes wrong with a funeral home’s data we will tell them within 72 hours, with what we know at the time.
12. Changes
If we change this in a way that matters we will tell funeral homes at least 30 days beforehand, at the address on their account, and date this page. We will not change it to permit something the Data Processing Agreement forbids.
13. Contact
help@continuumaftercare.com — a person reads it.