Privacy policy

1. Who we are

WhoWasThisGuy (“we”) is operated by Pavel Valynets PR Beograd, a sole trader (preduzetnik) based at Jurija Gagarina 231, 11070 Beograd (Novi Beograd), Serbia, registration no. (MB) 67436644, tax ID (PIB) 114255826. We are the controller responsible for your personal data. Contact for privacy matters: [email protected].

2. What this policy covers

This policy explains how we handle personal data when you visit whowasthisguy.com, create an account, buy a memorial page, add memories or contact us.

3. What data we process

• Visitors: IP address, browser and device information, pages requested and timestamps, which Cloudflare processes to protect the site, and anonymous page-speed measurements. With your consent, Google Analytics also records the pages you view, how you arrived, your device and browser, and an approximate location; Google does not log or store the IP addresses of visitors from the EU, Switzerland or the UK, and Google signals and advertising features are off (see section 11).
• Account holders: email address, name (optional), password (stored only as a hash), language and account settings. You need an email address to create an account; everything else is optional. If you arrived through a link that carries campaign parameters (such as utm_source or an advertising click ID), we store those parameters with your account.
• Buyers: our merchant of record, Creem, processes your name, email address, country, payment method and billing details. We receive the order status, amount, country and the email address you used. We never receive your full card number. When you pay, we also record that you accepted the terms and asked for your page to be published at once, and the campaign parameters of the link you came from, if any.
• Memorial content: the text, photos, dates, places and relationships you add. This can include information about the person who died and about living relatives and friends. If a page is reported, it also includes any proof of the death you send us, such as a link to a notice or an image of a document, and the results of our automatic checks.
• Page passwords: if you protect a page with a password, we store the password only as a hash. A visitor who enters it receives a cookie that remembers this for 30 days (see the Cookie policy).
• Recordings: the sound files you or an editor add to a page. We convert each one into a new file without the tags and pictures it carried; the original file is not kept. Before visitors can hear a recording, Gemini listens to it and writes a transcript for the automatic check; the transcript is not stored.
• Contributors: the name, the relationship to the person, and the memories and photos you submit to a page. We do not ask contributors for an email address.
• Editors: if a page owner invites you to help edit a page, we record which pages you edit and since when. The page owner sees your username, never your email address.
• Support: the messages you send us by email or through our forms, and our replies.
• Error monitoring: when something breaks in your browser or on our servers, technical details of the error, including IP address, browser and the address of the page, on our own error-monitoring server (GlitchTip), hosted by Hetzner in the EU.
• AI features: the answers and text you give the writing assistant, and the text we translate.
• Help chat: when the help chat is available on our site, the questions you type into it and its answers.
• Child safety: if an image is suspected to show child sexual abuse, the record of the case and the evidence we must preserve (see section 9).
• Old condolence comments: the name, email address and text that visitors left on memorial pages before we closed this feature.

4. Why we process data, and on what legal basis

5. People who have died

Data protection law generally does not protect people who have died (GDPR Recital 27), but some countries give relatives rights over such data. Whatever the law, we act on requests from close relatives to correct or remove information about someone who has died.

6. Living people mentioned on a memorial page

If a page mentions you, you can ask us to correct or remove that information using our report form. Please don’t add sensitive information about living people (such as health, religion or contact details) without their permission.

7. Who receives data

We never sell personal data and we show no ads. We use the following service providers, under contracts that limit how they may use the data:

• Creem (Armitage Labs OÜ, Tallinn, Estonia): payments, invoices and tax, as merchant of record and an independent controller for payment data.
• Cloudflare: content delivery, security and bot protection, photo storage (R2) and cookieless website statistics.
• Hetzner Online GmbH: server hosting in Germany.
• Google: Google Analytics, only with your consent; the Gemini API for translation and content moderation; Gmail, which hosts our support mailbox; and YouTube, only when you play a video on a memorial page.
• Anthropic: the Claude API for the writing assistant and, when it is available, the help chat; it also serves as a second check and a backup for the automatic checks and the translations.
• Resend: sending account and order emails, and receiving the emails sent to our addresses and passing them on to our support mailbox. Resend sends our emails from its EU region but stores their content and its logs in the United States.

We may disclose data where the law requires it.

8. International transfers

Our servers are in Germany (Hetzner). Photos, export files and backups are stored with Cloudflare R2, set to its Eastern Europe location, which Cloudflare treats as a preference, not a guarantee. Some providers process data in the United States: Cloudflare, Google and Resend are certified under the EU–US Data Privacy Framework, which the European Commission recognises as giving adequate protection; Anthropic is not, so for Anthropic we rely on the standard contractual clauses in its data processing terms. Google may process the text sent to Gemini in any country where it has facilities, under the same safeguards. Creem is in Estonia. We, the controller, are established in Serbia, which has no EU adequacy decision, and we reach the data stored in the EU from there. As no EU standard contract exists yet for a controller that is itself subject to the GDPR, as we are (Art. 3(2) GDPR), we apply the GDPR and the Serbian Personal Data Protection Law, which follows it, to all our processing.

9. How long we keep data

• Account data: while your account exists. When you delete your account, we delete its data within 30 days, except what the law requires us to keep, such as order records.
• Memorial pages: while the page is online. A page you delete disappears from the site at once and is deleted for good, with its photos, after 30 days. A refunded page becomes a private draft again. If a draft you have not paid for is not changed for 180 days, we send you a reminder; if it is still unchanged 30 days later, we delete it. Proof of a death sent after a report: 30 days after our decision. Detailed records of our automatic checks (scores and evidence): 90 days after the decision, or longer while a review or a legal claim needs them; the outcome and its reasons stay with the page while it exists.
• Memories that the page owner turns down, or does not approve within 90 days: 30 days after that. Their photos are removed from the site at once.
• Writing-assistant conversations: 30 days after the page is created or, if you do not finish the page, 90 days after you last saved the conversation.
• Order records, including the record of your agreement at checkout: for as long as Serbian accounting and tax law requires, at most 10 years. Campaign parameters are deleted when the account is deleted.
• Support messages, help-chat conversations, complaints and reports: 2 years after we receive them, or longer if we need them for a legal claim.
• Child-safety cases: the preserved evidence until the case is closed and the authorities no longer need it; the record of the case, without the image, for 2 years after it is closed. Digital fingerprints (hashes) of images we removed as suspected child sexual abuse material are kept, with no link to an account or a page, so that the same images cannot be uploaded again.
• Old condolence comments: while the page they were left on exists, or until the person who wrote one asks us to delete it.
• Security logs and abuse-prevention data: up to 30 days, or longer while a safety review or a legal claim needs them.
• Error reports: up to 90 days.
• Analytics: up to 14 months.
• Copies our providers keep: Resend keeps sent emails and their logs for 30 days; Anthropic deletes the text we send it within 30 days; Google keeps the text sent to Gemini for 55 days to detect abuse; Cloudflare keeps request logs for a limited period. Creem keeps payment data under its own privacy policy.
• Backups: daily copies, kept for 30 days, stored with Cloudflare R2 and encrypted at rest. Data you delete leaves the backups when the last copy that contains it expires.

10. Your rights

You can ask for access, correction, deletion, restriction or a portable copy of your data, and you can object to processing based on legitimate interests. You can withdraw consent at any time. Write to [email protected]; we answer within one month, or tell you within that month if a complex request needs up to two more months. You can complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection (Poverenik), or to the data protection authority where you live.

11. Cookies

See our Cookie policy. You can change your choice at any time under “Cookie settings”.

12. Children

Accounts and purchases are for adults (18 or over). We do not knowingly collect personal data from children under 16. If you think a child has sent us personal data, write to us and we will delete it.

13. Security

Encrypted connections (HTTPS); passwords stored only as a hash; photos, export files and backups encrypted at rest by Cloudflare R2; our servers are reached from the internet only through Cloudflare, and administrative access is limited to the operator; regular backups. If a personal data breach happens, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours, and we tell the people affected without undue delay when it is likely to put them at high risk.

14. AI features and automatic checks

The writing assistant and translations send the relevant text to the AI providers named above, which process it to produce a result. Nothing the assistant writes is published until you approve it. We also check every page automatically before it is published and after important changes: fixed rules check the dates, and AI checks look at the text and photos for content our rules do not allow. These checks decide without a person. If a page clearly breaks our rules, it is not published and the payment is refunded in full. If the checks cannot decide, a second automatic check runs; if that cannot decide either, the page is published with limited visibility: search engines do not list it and only people with the link can open it. Pages about a person who was under 18 when they died always get this limited visibility. Reports are handled automatically too: for example, if someone reports that the person is still alive, the page is hidden at once and its owner is asked for proof of the death; without acceptable proof within 7 days, the page is removed. We explain every decision in an email to the page owner. You can ask for a person to review any automatic decision, using the link in that email or by replying to it, and tell us your point of view.

AI disclosure (Article 50 of the EU AI Act): the writing assistant is an AI system, and we tell you so wherever you use it. What it drafts is only a suggestion, and nothing it writes is published until you approve it. Automatic translations are also produced by AI and are labelled as such on the page.

15. Changes

We will notify account holders by email before material changes take effect.

16. Language

This policy is written in English. Translations are provided for convenience; if they differ, the English version applies, unless the law where you live requires otherwise.