Privacy,
plainly.

Introduction

Passage (“we”, “our”, or “us”) is operated by Octane Limited, a company registered in Jersey, Channel Islands. Our registered address is Old Station House, La Rue de La Corbière, St Brelade, Jersey JE3 8HN.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our bereavement support service at getpassage.co.uk.

We understand the sensitive nature of bereavement and handle your data with the utmost care and respect.

As a Jersey-established business, we comply with the Data Protection (Jersey) Law 2018 (DPJL) and are registered with the Jersey Office of the Information Commissioner (JOIC), registration number 103799. We also comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 for our UK users. Where both laws apply, we meet the requirements of each.

Data Controller

Octane Limited is the data controller responsible for your personal data. If you have any questions about how we handle your data, or wish to exercise your rights, please contact our Data Protection Lead:

• Data Protection Lead: Philip Balderson
• Email: privacy@getpassage.co.uk
• Address: Old Station House, La Rue de La Corbière, St Brelade, Jersey JE3 8HN

Information We Collect

Information You Provide

• Account Information: Name, email address when you create an account
• Bereavement Details: Information about the deceased person (name, date of death), your relationship to them, estate details, and whether there was a will
• Task Information: Tasks you create, complete, or modify
• Messages: Drafts of letters and emails you create using our service
• Check-in Data: Your mood and energy scores, journal entries, and our AI-generated responses
• Communications: When you contact our support team

Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on the service
• Device Information: Browser type, operating system, IP address
• Cookies: We use essential cookies for authentication and session management, plus optional analytics cookies (see below)

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to improve your experience and understand how Passage is being used. You have full control over which cookies we use.

Essential Cookies (Always Active)

These cookies are necessary for the service to function and cannot be disabled:

• Authentication: Keeps you logged in securely (provided by Clerk)
• Session management: Remembers your preferences during your visit
• Cookie consent: Stores your cookie preferences

Analytics Cookies (Optional - Requires Your Consent)

With your permission, we use analytics cookies to understand how people use Passage and make improvements:

• Google Analytics: Tracks page views, user journeys, and feature usage to help us understand what's helpful and what needs improvement
• Google Ads: Measures the effectiveness of our advertising and helps us reach families who might benefit from Passage
• Meta Pixel: Tracks conversions and measures ad effectiveness across Meta platforms (Facebook, Instagram)
• Vercel Analytics: Basic performance and usage metrics to ensure the service runs smoothly

Managing Your Cookie Preferences

You can control analytics cookies in several ways:

• Cookie banner: When you first visit Passage, you can accept or reject analytics cookies
• Change your mind: Clear your browser cookies for getpassage.co.uk to see the banner again and make a new choice
• Browser settings: Most browsers let you block or delete cookies entirely (though this may affect essential functions)

Rejecting analytics cookies does not affect your ability to use Passage — all features remain fully functional. We respect your privacy choices.

How We Use Your Information

We use your information for the following purposes:

• To provide our service: Create personalized task lists, generate AI guidance, and help you manage bereavement-related tasks
• To improve our service: Understand how users interact with Passage to make it more helpful
• To communicate with you: Send service updates, respond to inquiries, and provide support
• To ensure security: Protect against fraud, abuse, and unauthorized access
• To comply with legal obligations: Respond to legal requests and prevent harm

Lawful Basis: Under both the DPJL and UK GDPR, we process your data based on:

• Your consent (which you can withdraw at any time)
• Performance of a contract (providing the service you signed up for)
• Legitimate interests (improving our service, preventing fraud)

Special Category Data

Some information you share with Passage may constitute “special category data” under data protection law. This includes health information about the deceased or yourself that you provide when managing bereavement tasks.

We process this data only with your explicit consent, which you provide when you enter this information into the service. You can withdraw consent at any time by deleting the relevant data or your account. We limit special category data processing to what is strictly necessary to provide the service.

How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

• Service Providers: We use third-party services to operate Passage:
  • Clerk - Authentication and user management
  • Supabase - Database hosting (EU region)
  • Anthropic - AI-powered guidance and responses
  • Vercel - Website hosting and infrastructure
• Legal Requirements: If required by law, court order, or government request
• Protection of Rights: To protect the rights, property, or safety of Passage, our users, or others

International Data Transfers

Some of our service providers are based outside Jersey and the UK. When we transfer your data internationally, we ensure appropriate safeguards are in place:

• Supabase (database) — hosted in the EU, which has an adequacy finding under both DPJL and UK GDPR
• Clerk (authentication), Anthropic (AI), and Vercel (hosting) — based in the United States. Transfers are protected by Standard Contractual Clauses (SCCs) and each provider's data processing agreements
• Google and Meta (optional analytics, with your consent) — based in the United States, operating under SCCs and certified data protection frameworks

We only transfer data to countries or organisations that provide adequate protection for your personal data, as required by the DPJL and UK GDPR.

AI and Data Processing

When you use our AI-powered features (task guidance, message drafting, check-in responses), we send relevant information to Anthropic's Claude AI service. This may include:

• Task descriptions and your questions about them
• Context about your bereavement case (deceased name, relationship)
• Your mood scores and journal entries for check-ins

Anthropic does not train their models on your data. Your information is processed to generate responses and then discarded. See Anthropic's Privacy Policy for more information.

Data Retention

We retain your information for as long as your account is active or as needed to provide you services. You can delete your account at any time, which will remove your personal data from our systems within 30 days.

We may retain certain information for longer if required by law or for legitimate business purposes (e.g., fraud prevention, resolving disputes).

Your Rights

Under the Data Protection (Jersey) Law 2018 and the UK GDPR, you have the following rights:

• Access: Request a copy of the personal data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data (“right to be forgotten”)
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Request we limit how we use your data
• Objection: Object to our processing of your data
• Withdraw Consent: Withdraw consent for data processing at any time

To exercise any of these rights, please contact us at privacy@getpassage.co.uk. We will respond within one month.

Right to complain: If you are not satisfied with how we handle your data, you have the right to lodge a complaint with:

• Jersey residents: The Jersey Office of the Information Commissioner (JOIC) at jerseyoic.org
• UK residents: The Information Commissioner's Office (ICO) at ico.org.uk

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights, we will notify the relevant supervisory authority (JOIC and/or the ICO) without undue delay and where feasible within 72 hours. If the breach is likely to result in a high risk to you, we will also notify you directly.

Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• All data transmitted over HTTPS (encrypted connections)
• Database encryption at rest
• Secure authentication via Clerk
• Regular security updates and monitoring
• Access controls limiting who can view your data

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Children's Privacy

Passage is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

We encourage you to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• General support: support@getpassage.co.uk
• Data protection queries: privacy@getpassage.co.uk
• Post: Octane Limited, Old Station House, La Rue de La Corbière, St Brelade, Jersey JE3 8HN