Privacy Policy

What we collect, what we do with it, how long we keep it, and what we will not do.

1. Who we are

Echoes of Life LLC is a New Jersey limited liability company that creates memorial and celebration films from photographs and other materials provided by customers. You can contact us at contact@echoesoflife.ai. Our website is echoesoflife.ai. Our business mailing address is 21 Broad Street, Denville, New Jersey 07834.

This Privacy Policy applies to our website and to personal information we process when you order, create, revise, receive, or ask us about a film.

2. The short version

• We use the information you send us to make and deliver the film you request, operate our service, process orders, communicate with you, and protect our systems.
• We do not sell personal information.
• We do not use a film or source photograph for promotion unless you separately and affirmatively opt in. Promotional permission does not replace other permissions or rights that may be required for a living person’s image or voice, a child’s image or voice, a deceased person’s likeness where protected, or copyright in a photograph, recording, music, or other material.
• We delete source materials and finished films according to Section 7, subject to the stated exceptions and the technical limits of backups and third-party systems.
• Our hosting provider, GoDaddy, injects a traffic-tracking script into every page at serve time. We did not choose it and we do not use it. It is described in Sections 3 and 10 rather than left unmentioned.

3. Information we collect

Materials you submit

Photographs, videos, audio recordings, names, dates, family relationships, stories, written text, music preferences, and details about the service or occasion, to the extent you choose to provide them.

Order and contact information

Your name, email address, telephone number, order reference, the product or service ordered, and communications with us.

Consent and release records

When you complete an online consent or release form, we record the name you enter, the signature you draw, the date and time, your IP address, browser user-agent information, and a cryptographic fingerprint (SHA-256) of the exact wording presented for signature. These records document the permission given and the terms accepted, and let us prove later precisely what you agreed to.

Technical information

Our host may generate server logs that include IP address, requested pages or resources, timestamps, browser or device information, and related diagnostic or security information. The site sets one cookie: PHP’s default session cookie (PHPSESSID). It is created only on the online consent form, holds a cross-site-request-forgery token used to protect that form, contains no personal information, and expires when the browser session ends. No cookie is set on any other page.

Hosting-provider tracking

Our hosting provider, GoDaddy, injects a traffic-tracking script into every page at serve time. It is not present in any file we author or upload. It loads a tracking script from GoDaddy’s content network, sets two cookies of its own, and reports page requests to GoDaddy. We do not control what it collects or how long GoDaddy retains it, and we do not use its data for advertising or profiling.

4. Photographs, recordings, deceased persons, and children

Customers may submit photographs or recordings of people who have died, living adults, and children. We use submitted materials to create and deliver the film ordered by the customer, subject to the customer’s instructions and the applicable agreement and consent documents.

Different rights may apply to different parts of a submission. Permission relating to a deceased person’s likeness does not necessarily authorize use of a living person’s likeness or voice; a parent’s or guardian’s authority concerning a child is a separate question; and copyright in a photograph, recording, music, or other source material is separate from the rights of the people depicted or heard. One consent or release does not necessarily resolve all of these issues.

The customer is responsible for having the rights and authority needed to submit the materials and request the uses selected. We may ask for additional permission, releases, or evidence of rights before proceeding, particularly for promotional uses.

Submitted materials, signed consent records and order files are stored in a directory outside the public web root, so they are not reachable by browsing the website. Files are served only through an access-controlled script using a single-use private link. We do not represent that any system is perfectly secure.

5. How we use information

We use information to make, preview, revise, and deliver the film; communicate with you; provide customer support; take payment; maintain business and tax records; document consent and permissions; protect the website and our service; investigate errors, abuse, or disputes; and comply with legal obligations.

We do not create customer profiles for targeted advertising, and we do not make decisions about customers solely by automated means that produce legal or similarly significant effects.

6. Service providers and disclosures

Payment processing

Stripe, Inc. processes payment transactions. Payment information is handled through Stripe’s payment flow. We do not store full payment-card numbers on our own systems.

AI and production services

We use Replicate (replicate.com) to restore photographs, add motion, and generate or process audio. Replicate is the only artificial-intelligence production service we send customer materials to. Materials are sent only for the specific production task on your order. We do not grant any provider the right to use your materials to train its models, and we do not permit unrelated reuse. Based on provider behavior we have measured, prediction inputs are purged approximately one hour after the generation job runs. That measurement covers Replicate’s prediction inputs only, not copies held by our hosting, email or storage providers, which are described elsewhere in this Policy. The provider’s own terms govern its handling of data it receives.

Website hosting and storage

GoDaddy hosts the website and may process content and technical information to provide, maintain, secure and support its services, including the traffic tracker described in Sections 2, 3 and 10.

Fonts

The website loads two typefaces, Lora and Hanken Grotesk, from Google Fonts. Google therefore receives visitors’ IP addresses and request information when those fonts are loaded. The fonts are not self-hosted.

Other disclosures

We may disclose information to service providers acting on our behalf, when required by law or legal process, to protect rights, safety, or security, or in connection with a merger, financing, restructuring, or sale of all or part of our business, subject to applicable law. We do not sell personal information.

7. Retention and deletion

• Source photographs, videos, and recordings: retained for up to 90 days after final delivery, then deleted from active systems. For canceled, declined or non-delivered orders, we delete production materials promptly after closure, subject to limited retention needed for consent, payment, security, legal compliance or disputes.
• Finished film: retained for up to one year after delivery, then deleted unless you request earlier deletion or we agree otherwise. We cannot promise recovery after deletion.
• Consent and release records: retained for seven years, aligned with our tax and accounting record retention. Consent records may be retained after source materials and finished films are deleted, with access limited to those who need the records.
• Order and payment records: retained for the periods required by applicable tax, accounting, and other laws, and as reasonably needed to address disputes.
• Server logs and tracker records: generated and retained by GoDaddy under its own default periods, which we do not set and cannot change. We do not copy them into our own systems.

Deletion from active systems may not immediately remove copies in routine backups, disaster-recovery systems, or third-party systems. Where applicable, copies may remain until the system’s ordinary deletion cycle runs, unless earlier deletion is available or retention is required for legal, security, or dispute-resolution reasons. We will not promise immediate deletion from every system unless we can verify that result.

You may request earlier deletion of source materials by emailing contact@echoesoflife.ai. We will review the request and confirm what action we have taken, subject to applicable legal obligations, security needs, disputes, and technical limitations.

8. Your choices and requests

You may email contact@echoesoflife.ai to request access to, correction of, or deletion of personal information we hold about you. We aim to respond within 30 days, subject to identity verification, applicable law, and any permitted extensions or exceptions. This is a service commitment and does not mean every request can always be fulfilled.

If you withdraw a production consent before delivery, we will stop the affected work and handle submitted materials and any payment in accordance with the applicable consent form and Terms of Sale. We may retain limited records where reasonably necessary to document the transaction, comply with law, or resolve a dispute.

Promotional permission is separate and optional. You may withdraw it by contacting us. We will stop future promotional use and remove material from channels we control within 10 days where practicable. We cannot guarantee removal of copies already made by third parties, cached copies, or material outside our control.

9. Promotional use

We will not use your film, photographs, clips, names, voice, or other identifiable material on our website, in advertising, on social media, in a portfolio, or for another promotional purpose unless you separately and affirmatively opt in. Your choice is optional and does not affect whether we make your film or its price.

A customer’s promotional opt-in does not by itself establish copyright ownership in every photograph or recording, authorize every living person’s likeness or voice, establish authority to consent for a child, or settle any rights that may apply to a deceased person’s likeness. We may require separate releases from identifiable living people or their authorized representatives, permission from a parent or legal guardian for a child where appropriate, and permission from the relevant copyright owner.

After a valid withdrawal request, we will remove promotional material from channels we control within 10 days where practicable, subject to the limits described in Section 8.

10. Analytics and hosting-provider tracking

Our hosting provider, GoDaddy, injects a traffic-tracking script into every page at serve time. It loads from GoDaddy’s content network, sets two cookies of its own, and reports page requests to GoDaddy. We do not control what it collects or how long GoDaddy retains it.

We did not choose this tracker and we do not use it. It arrives with the hosting plan. We have disclosed it rather than claim the site carries no analytics.

We do not use analytics for cross-site advertising profiles. We cannot speak for what GoDaddy does with the data its own tracker collects; see GoDaddy’s privacy policy for that.

11. Security

The website is served over HTTPS. Submitted materials, consent records and order files are held outside the public web root and are served only through an access-controlled script. Signed consent records store a SHA-256 hash of the exact wording presented for signature, so the terms a person agreed to can be proven later.

Preview and delivery links are for private delivery rather than public posting. Each order is issued a 128-bit random token, which makes a link infeasible to guess. A preview file is additionally checked against a stored fingerprint before it is served, so a file swapped after watermarking will not play. A download link for a finished film expires three days after you approve the film. A preview link does not expire on a timer, so that a family can keep returning to it, and it can be disabled on request. Anyone holding the link can open it, so please do not post it publicly.

No method of transmission or storage is completely secure, and we do not claim otherwise.

12. Children and people depicted in customer materials

Our website is not directed to children under 13, and we do not knowingly seek to collect personal information directly from children under 13 through the website. If we learn that we have collected such information directly in circumstances where consent is required by law, we will take appropriate steps to address it.

This website-visitor statement is different from photographs, recordings, or other materials depicting a child that an adult customer uploads for a film. An adult submitting material depicting a child must have the authority and permissions required for that submission and the requested uses. An adult’s upload does not mean the child visited the website and does not establish permission for every possible use of the image or recording.

Promotional use of a child’s image, voice, or other identifiable material requires separate, optional authorization and any additional permissions required by law. Copyright in a photograph is separate from rights relating to the person depicted or heard.

13. Changes and contact

We may update this Policy from time to time. We will change the “Last updated” date when we do and provide notice of material changes where appropriate or required by law.

Echoes of Life LLC · 21 Broad Street, Denville, New Jersey 07834 · contact@echoesoflife.ai · echoesoflife.ai
Last updated: 15 October 2026 · See also our Terms of Sale.