Privacy Policy

Nimbus Digital Ltd. ("we", "us", "our") operates My Family Tree App. We are the data controller for account and platform-operation data as described below. For personal data you enter about other people within your family tree (see Section 3), you act as the data controller and we act as your data processor.

Registered office: 11/12 Hallmark Trading Centre, Fourth Way, Wembley, Middlesex, HA9 0LB, UNited Kingdom. Contact for privacy queries / Data Protection queries: [email protected].

1. Scope

This policy explains how we collect, use, and protect personal data when you use My Family Tree App, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect About You (Account Data)

3. Data You Add About Others (Tree Data)

When you build a family tree, you may enter personal data about relatives, including living individuals — names, dates, places, notes, and photographs. You control what you enter and who you share it with. In relation to this data:

• You are the data controller; we process it on your behalf as a processor, under your instructions, solely to provide the Service (storage, display, GEDCOM import/export, the privacy filtering described below).
• We apply automatic restrictions to records marked as belonging to a living person, limiting visibility of dates, notes, and life events to that tree's Owner and Editors only — Contributors, Viewers, and share-link visitors see name and tree position only. This is a technical safeguard we provide, not a substitute for your own judgement about what you upload and who you invite.
• If you are entering data about a living relative, you should have a lawful basis for doing so (typically, this will be a personal/household activity exemption where you're using the Service purely for private family record-keeping, though this exemption has limits — for example, once you invite others or generate a share link, wider GDPR obligations can apply to you as controller). We recommend not entering sensitive information (health conditions, for example) about living relatives without their knowledge and, where appropriate, consent.

4. Cookies & Similar Technologies

We use the following categories of cookies:

We currently use strictly necessary cookies only. If we introduce analytics or marketing cookies in future, we will update this policy and present the relevant consent choices via our cookie banner before any such cookie is set. You can review and change your cookie choices at any time via the "Cookie Settings" link in the site footer.

5. How We Use Your Data

• To provide, maintain, and secure the Service;
• To send transactional and security notifications (password resets, new-device logins, subscription changes) — these cannot be turned off, as they are necessary for account security;
• To send optional activity notifications (invite accepted, contributor suggestions, GEDCOM import status) — you can disable these in your notification preferences;
• To process payments via Stripe;
• To respond to support queries;
• To comply with legal obligations.

We do not sell your personal data, and we do not use your tree data for advertising.

6. Who We Share Data With

Our application hosting, database, and backups are all located in the UK. Where a provider (Stripe, Cloudflare) processes data outside the UK/EEA as part of their own global infrastructure, transfers are made under an appropriate safeguard (e.g. the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, or the provider's own UK GDPR-compliant transfer mechanism) — [confirm exact safeguard relied on for Stripe/Cloudflare once contracts are reviewed].

7. Data Retention

• Account data: retained while your account is active, and for [X] after closure for legal/billing purposes, then deleted or anonymised.
• Tree data: retained while the tree exists; deleted when the Owner deletes the tree or requests account/tree deletion (Section 8).
• Backups: retained per our backup rotation policy (daily backups kept 14 days, thinned thereafter — see internal backup policy), after which older backups are automatically expired.
• Security/audit logs: retained for [X] for security and legal purposes.

8. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data;
• Erase your data ("right to be forgotten"), subject to legal retention requirements;
• Restrict or object to certain processing;
• Data portability — you can export your tree data at any time in GEDCOM format via your account settings, which includes your media files;
• Withdraw consent at any time where processing is based on consent (e.g. optional cookies), without affecting past processing.

To exercise these rights, use the relevant in-app tools (export, account deletion) or contact us at [email protected]. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) if you believe we have not handled your data properly.

9. Cookie Policy

This section, together with Section 4 above, constitutes our full cookie policy — we do not maintain a separate document. Cookies are small text files placed on your device. You can control cookies via the consent banner shown on your first visit, via "Cookie Settings" in the footer at any time, and via your browser settings (which may affect Service functionality if you block strictly necessary cookies).

10. Children

The Service is not directed at children under 16, and we do not knowingly collect account data from them. Family tree content may of course reference deceased or living relatives of any age, including children, entered by an adult account holder — this is a normal genealogical use case and distinct from a child holding their own account.

11. Security

We apply technical and organisational measures including encrypted connections (TLS), password hashing, optional two-factor authentication and passkeys, database-backed rate limiting, encrypted offsite backups, and role-based access control scoped per tree. No system is completely secure; we will notify affected users and, where required, the ICO, in the event of a data breach likely to result in risk to individuals.

12. Changes to This Policy

We may update this policy from time to time; material changes will be notified in-app. The "Last updated" date above reflects the current version.

13. Contact

Privacy queries or to exercise your rights: [email protected].