Privacy Policy
My Heirloom Story | Last updated: June 2026
1. Who are we?
My Heirloom Story is a service provided by:
Peter Van Boom
Pastoor Sabotstraat 29, 9120 Melsele
Company number: KBO 0685.325.190
VAT number: BE 0685.325.190
Email: privacy@my-heirloom-story.com
Website: https://my-heirloom-story.com
If you have any questions about the processing of your personal data, please contact us at the email address above.
2. What data do we collect?
We collect the following categories of personal data:
Account data Name, email address and a secure password (stored as an unreadable hash) that you provide when registering.
Profile data Optional information you add yourself: profile photo, date of birth, biography and gender.
Family data Information about family members you add to your family archive: names, dates of birth, dates of death, relationships and profile photos.
Archive content Photos, documents (PDF, Word, Excel), audio recordings, journal entries, memories and other files you upload or create.
Vault data Sensitive information you store in the secure vault: account details, passwords, URLs and attachments. This data is stored encrypted using AES-256-GCM encryption.
Payment data Payment transactions are processed by Stripe. We only receive confirmation of the transaction and your subscription status. We never store your payment card number.
Technical data IP address, browser type, device type and login timestamps, processed for security and the technical operation of the service.
3. Why do we use your data?
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and managing your account | Performance of contract (Art. 6.1.b) |
| Providing the service (archive, vault, memories) | Performance of contract (Art. 6.1.b) |
| Processing payments and managing subscriptions | Performance of contract (Art. 6.1.b) |
| Sending transactional emails (confirmations, password reset) | Performance of contract (Art. 6.1.b) |
| Security of the service and fraud prevention | Legitimate interest (Art. 6.1.f) |
| Improving the service through usage analysis | Legitimate interest (Art. 6.1.f) |
| Sending newsletters or marketing messages | Consent (Art. 6.1.a) |
We never use your data for automated decision-making or profiling with legal effects.
4. AI processing of your content
My Heirloom Story offers optional AI features:
Photo analysis: uploaded images may be analysed via the Google Gemini API to automatically generate descriptions or tags. This only occurs at your explicit request.
Audio transcription: audio recordings made in the journal are transcribed via the Groq Whisper API. The audio is processed and not retained by the external provider.
You can disable these AI features at any time in your settings.
5. Who do we share your data with?
We share your data only with carefully selected processors bound by strict confidentiality obligations:
| Processor | Service | Location | Basis for international transfer |
|---|---|---|---|
| IONOS | API hosting, database (SQL Server) and file storage (Object Storage) | EU (Germany) | Not applicable (EEA) |
| Stripe | Payment processing | US/EU | EU-US Data Privacy Framework |
| Resend | Transactional email | US | Standard Contractual Clauses (SCC) |
| Google (Gemini) | Optional photo analysis | US | Standard Contractual Clauses (SCC) |
| Groq | Optional audio transcription | US | Standard Contractual Clauses (SCC) |
We have a Data Processing Agreement (DPA) in place with every processor, setting out their obligations under the GDPR. For processing outside the EU, transfers are covered by the Standard Contractual Clauses (SCCs) adopted by the European Commission or the EU-US Data Privacy Framework:
- IONOS — DPA available; processing exclusively within the EU (Germany); ISO 27001 certified.
- Stripe — DPA as part of the Stripe Services Agreement; certified under the EU-US Data Privacy Framework, its UK extension, and the Swiss-US Data Privacy Framework.
- Resend — DPA with SCCs; certified under the EU-US Data Privacy Framework and its UK extension; also SOC 2 compliant.
- Google (Gemini) — DPA with SCCs for transfers outside the EU; processing only on your explicit request.
- Groq — DPA with SCCs; audio is processed and not retained by Groq.
We never sell your data to third parties and do not use it for advertising purposes.
6. Transfers outside the European Economic Area
Some of our processors are based in the United States. We ensure that such transfers take place on the basis of appropriate safeguards, in particular Standard Contractual Clauses (SCC) adopted by the European Commission, or the EU-US Data Privacy Framework.
7. How long do we retain your data?
| Category | Retention period |
|---|---|
| Account data | For the duration of your account + 12 months after deletion |
| Active archive and family data | For the duration of your account; deleted within 30 days of voluntary account deletion |
| Archived family data (after passing) | Permanently preserved — see explanation below |
| Vault data | Sent to designated recipients upon passing; otherwise retained for the duration of the account |
| Payment data (invoices) | 7 years (Belgian accounting legislation) |
| Technical logs | Maximum 90 days |
| Backups | Maximum 90 days after deletion of original data |
What happens to your data after you pass away
My Heirloom Story is built around one core promise: family history must never be lost. When a passing is confirmed in the application, the following takes place:
Allocation of heirlooms Heirlooms you assigned to specific people during your lifetime are released to those recipients. Unallocated heirlooms are passed to the person you designated as your primary recipient.
Archiving of the family Your family is placed in read-only memorial mode. No further edits can be made, but all content remains fully accessible: heirlooms with photos and stories, journal entries with photos and audio recordings, and the complete family history.
New families for surviving members Based on the family relationships recorded in the application, living members are automatically placed into new families — each representing their own branch of the family tree. These new families receive 3 months of free Premium.
Permanent access for future generations The archived family remains readable forever — by the new families and by their descendants. What you leave behind — your stories, memories, photos and voice recordings — becomes a living heritage passed from generation to generation.
8. Security
We take appropriate technical and organisational measures to protect your data:
- All communications are via HTTPS (TLS encryption)
- Files are stored on IONOS Object Storage in the EU with server-side encryption (AES-256)
- Vault data is encrypted with AES-256-GCM before storage in the database
- Passwords are never stored in readable text (PBKDF2 hashing via ASP.NET Identity)
- Access to files requires a valid JWT token at all times
9. Your rights
As a data subject, you have the following rights under the General Data Protection Regulation (GDPR):
Right of access — You can request what data we hold about you.
Right to rectification — You can have inaccurate or incomplete data corrected.
Right to erasure ("right to be forgotten") — You can ask us to delete your data, unless we have a legal obligation to retain it.
Right to restriction of processing — In certain circumstances you can ask us to restrict processing.
Right to data portability — You can request your data in a structured, commonly used and machine-readable format.
Right to object — You can object to processing based on legitimate interest.
Right to withdraw consent — For processing based on consent, you can withdraw it at any time.
To exercise your rights, send an email to privacy@my-heirloom-story.com. We will respond within 30 days.
10. Filing a complaint
If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Belgian supervisory authority:
Data Protection Authority (GBA/APD) Rue de la Presse 35, 1000 Brussels contact@apd-gba.be www.dataprotectionauthority.be
11. Changes
We may update this privacy policy from time to time. For material changes we will notify you by email or via a notification in the application. The date of the last update is shown at the top of this document.