This is the plain-language version. The formal Terms cover the contract details. If anything below feels unclear, write to hello@keptandkin.com and we'll explain.
01The short version
We don't train AI on your photographs. We don't sell, license, or share them with third parties for any purpose other than the print/frame/voice workflow you've explicitly hired us to do. We delete the working files ninety days after delivery unless you ask us to keep them. We are registered with the UK Information Commissioner's Office (ICO).
02Who we are, in UK GDPR terms
[BUSINESS NAME] is the data controller for the information you provide to us. Our ICO registration number is [ICO REGISTRATION NUMBER]. Our registered office is [REGISTERED OFFICE]. Our company number with Companies House is [COMPANIES HOUSE NUMBER].
03What we collect
From you, when you submit the intake form:
- Your name and contact details
- The photographs you upload or post to us
- The context you write about the people in them (your intake note)
- Payment information processed by Stripe (we never see your card number)
- If applicable, the consent paperwork for voice-clone work
From your browser, when you visit the site: basic analytics (pages viewed, referring site, country). We do not run a marketing retargeting pixel. We do not run third-party advertising scripts. We do not sell email lists, and we don't put you on a newsletter without an explicit opt-in.
04Our lawful basis under UK GDPR
We process your personal data on two lawful bases under Article 6 of the UK GDPR:
- Performance of a contract (Article 6(1)(b)) — for the data we need to fulfil your order, deliver your restored photographs, and contact you about the work.
- Legitimate interest (Article 6(1)(f)) — for limited operational purposes (fraud prevention, internal recordkeeping for legal-limitation periods).
We do not rely on consent as a lawful basis for the core order fulfilment — you don't need to "agree" to a privacy notice for us to ship your bundle. We do rely on explicit, specific written consent for voice-clone work (see Section 06).
05How long we keep your photographs
We retain the high-resolution digital scans and restored files in your private order folder for ninety days after delivery, so we can fulfill reprints or fix anything you ask us to fix after the fact. After ninety days, the working files are deleted from our active systems. The final deliverable copy remains in our offline backup for one year, then is deleted from that as well.
If you'd like us to delete your photographs immediately on delivery, tell us in the intake note. If you'd like us to keep them indefinitely as an archival service (we offer this for £20/year per order), tell us and we'll add it to your invoice.
The signed contract, invoice, and any voice-clone consent paperwork are retained for seven years in line with the statutory limitation period under the Limitation Act 1980 for contract claims.
06We do not train AI on your photographs
Our restoration workflow uses third-party tools (currently a combination of MyHeritage Reimagine, VanceAI, and Adobe Photoshop). These tools have their own data-handling policies, which we audit and document. Where a tool reserves training rights on uploaded data, we do not upload your identifiable photographs to that tool; we either turn off the relevant retention setting, use the tool in a no-retention mode, or use a different tool altogether. The current list of tools used and their retention setting is available on request.
07Voice-clone work — the consent framework
Voice-clone work is materially different from photograph restoration and requires a separate consent framework. We do not do any voice-clone work without:
- A signed Voice Clone Use Agreement specifying the exact use (length, text, intended audience)
- Documented family position from the commissioning relative — including confirmation that no other close family member objects
- A specific source recording for which the commissioning relative has the lawful right to provide, of which we keep a copy alongside the agreement
- A 48-hour cool-off between signed agreement and beginning work
The audio output of voice-clone work is delivered only to you, the contracting customer. We do not retain the trained voice model after delivery (it is deleted within 30 days). We do not reuse the voice model for any other order. If a dispute arises within your family about the voice clone, we'll immediately pause delivery and ask for written confirmation from all parties before resuming.
We note that UK GDPR does not apply to the personal data of deceased persons (Recital 27); however we still treat recordings of deceased relatives with the same care and confidentiality as if they did. The lawful basis for our processing of any *living* relative's data in connection with voice-clone work is the contract between you and us (Article 6(1)(b)) plus the explicit consent you provide in the Voice Clone Use Agreement (Article 9(2)(a) where biometric processing is involved).
08Payment, security, and Stripe
Payments are processed by Stripe Payments UK Limited. We never see, store, or transmit your credit card number. Stripe's privacy notice applies to that piece of the transaction. Refunds are handled through the same channel.
09Subprocessors
A short list of the third-party services that touch your data, and what they do with it:
- Stripe Payments UK Limited — payment processing (UK)
- Formspree (USA) — intake form submissions; transferred under standard contractual clauses
- Cloudflare (USA, EU, UK) — website hosting; UK GDPR Schedule 2 (UK addendum) applies to international transfers
- Google Workspace (Ireland for EEA/UK customers) — email, calendar, file storage
- Dropbox — private delivery links for your finished files
- MyHeritage Reimagine (Israel) / VanceAI (USA) / Adobe Photoshop (UK) — restoration tooling, in the audited configuration described above
- ElevenLabs (USA, or successor) — voice-clone tooling, only for memorial concierge orders, only after a signed Voice Clone Use Agreement
- Loxley Colour (Glasgow, UK) / theprintspace (London, UK) — print and frame fulfillment, white-labelled drop-shipped to you in plain packaging
- Royal Mail / DPD — shipping
10Your rights under UK GDPR
You have the right to:
- Be informed about how we use your data (this notice)
- Access the personal data we hold about you
- Correct anything inaccurate
- Erase your data (the "right to be forgotten"), subject to our obligation to retain contract records for seven years
- Restrict our processing
- Data portability — we'll send your files in a standard format if you want to move
- Object to processing based on legitimate interest
- Lodge a complaint with the ICO at ico.org.uk
To exercise any of these rights, write to hello@keptandkin.com with the subject "Subject access request" and we'll respond within one calendar month, as required by UK GDPR.
11Children
This service is not intended for use by anyone under 18. We do not knowingly collect data from minors. Photographs that depict minors are fine; the contracting customer must be an adult.
12How to reach us
[OWNER NAME], trading as [BUSINESS NAME]
Registered office: [REGISTERED OFFICE]
Company number: [COMPANIES HOUSE NUMBER]
ICO registration: [ICO NUMBER]
hello@keptandkin.com