1. Data operator

The operator listed below is responsible for processing data in the Hishum service. This policy applies to the website, the Hishum customer app, the Hishum Work field-worker app, and support operations.

Service Provider and Service Operator: Esaart Studio Inc.
Jurisdiction of registration: California, United States of America
Address of activity: 265 W Tujunga Ave, Burbank, CA 91502, USA
Postal address for complaints: 265 W Tujunga Ave, Burbank, CA 91502, USA
E-mail: support@hishum.com
Telephone: +1 747 252 3561

2. What data do we process?

name, confirmed email, phone number and language of communication;
account ID, family roles and settings;
information about the deceased, cemetery, landmarks and the exact point of the place, if the user decided to save it;
photographs and videos of places, documents, instructions, messages and support requests;
order, calculation, history of payment, return and dispute; the full card number and security code are not transmitted to us;
the performer has a profile, permissions, assignments, one-time geolocation of arrival and shooting location, work reports and calculations;
technical security events, push install ID, app version, language, time zone, and diagnostic events without ad tracking.

3. Where does the data come from?

Most of the data is provided by the user himself. Additionally, we receive identity verification from Apple or Google, payment status from Stripe, message delivery status from the email provider, and a system push token from Apple. The Contractor creates materials only within the framework of the assigned task. We do not buy databases of relatives, do not use facial recognition and do not compile advertising profiles from open sources.

4. Goals and reasons

creating an account and fulfilling the contract;
price calculation, appointment and confirmation of departure;
payment, returns, accounting and fraud protection;
report preparation, support, complaints and quality control;
security of the service and performers;
mandatory execution of the law and protection of rights in a dispute;
optional notifications and analytics - only within the limits of this consent and user settings.

The basis is the performance of a contract, legal obligation, informed consent or legitimate interest, when the applicable law allows this and the interests of the user do not take precedence. Consent can be withdrawn, but this does not render illegal the processing already carried out and may render impossible the function that requires this data.

5. Memory location data

The exact coordinates of the grave, survey coordinates and limited contact information are encrypted before storage. They are not published in the catalogue. The contractor receives only the information necessary for the assigned task. Employee access is limited by role and territory, and sensitive activities are logged.

Reports are prohibited from intentionally filming visitors, ceremonies, or reading information from adjacent burial sites. Material with unnecessary data is rejected or edited before publication to the client.

6. Who is the data transferred to?

Convex - application database and server functions;
Stripe - payment acceptance, Apple Pay and refunds;
Apple - Sign in with Apple and push notifications;
Google - login via Google, if the user has selected it;
Posta and its infrastructure - service letters;
Vercel - public site; Cloudflare R2 - private file storage; media verification and processing providers - only to the extent necessary for the function;
appointed employees and performers - only to the extent necessary for the order;
government agencies - when disclosure is required by law.

We require suppliers to provide at least the same level of data protection as described here. We do not sell personal information, use it for cross-service advertising tracking, or share it with third party AI without separate explicit notice and consent where required.

7. Automated solutions

Automated checks can detect technical errors, a dangerous file, a suspicious payment, or a violation of photo requirements. They may temporarily pause an action for manual review, but do not make a final decision that creates legal or comparable significant consequences for the user. This decision is made by an authorized employee, and it can be challenged through support.

8. Transfer to other countries

The operator is registered in the USA, and the physical service is provided in Armenia. Therefore, data is transferred between these countries and may be processed by technology providers in other countries. Before enabling actual processing, the operator checks contractual guarantees, storage territory and the basis for cross-border transfer permitted under Armenian law. You can request up-to-date information on a specific supplier from support.

9. Retention periods

We store data no longer than necessary for ordering, support, accounting, security and legal requirements. Launch deadlines: rejected initial media - up to 30 days; unprocessed originals of the accepted report - up to 90 days; published report - up to 3 years; support and correspondence attachments - up to 1 year after the related issue is closed. Financial and contractual records may be retained for longer periods to the extent required by law. A legal block in the event of a dispute temporarily stops the removal of only related materials.

10. User rights

The user can request access to their data, their correction, a portable copy, termination of unlawful processing or deletion, as well as withdraw consent and change notification settings. Export and delete request are available inside the client application; You can also contact us through support or operator contacts.

To protect your account, before issuing a copy, correction or deletion, we may ask you to log in again or confirm the request using the same method in which the user logged into the service. Instructions and available channels are collected on the Data Management page. We do not degrade the terms of service due to the fair use of these rights.

Account deletion is not replaced by simple deactivation. An active order, a pending return, the transfer of a family space to another owner, or a legal lockout may delay a portion of the removal. The user sees the reason and receives confirmation upon completion. Data required by law to be retained is separated from your regular profile and is not used for marketing.

11. Security

We use access control, re-confirmation of critical operations, encryption of sensitive values, logging, restricted file references, and backup recovery. No system guarantees absolute security; We will notify the user and the competent authority of a significant incident in the cases and within the time limits provided by law.

12. Children

The Service is not intended for independent use by children. We do not knowingly collect data from minors for advertising or profiling purposes. If such data has been transmitted without proper justification, the legal representative may apply for deletion.

13. Users from California

If the operator is subject to the CCPA, a California resident may request information about the categories and sources of data, purposes of processing and recipients, correction or deletion of data, and restrictions on the use of sensitive data as permitted by law. Hishum does not sell or transfer personal information for cross-service behavioral advertising, so a separate opt-out of such sale or transfer is not required. The request can be made yourself or through a duly authorized representative.

14. Complaint and Policy Change

Questions about the data can be sent to the operator through support, by email or postal address. The user also has the right to contact the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia or the court. If there is a significant change in the purposes of processing, we publish a new version and, when required, request new consent.

Privacy Policy