Privacy Policy | RetURN.org

Who we are

RetURN.org helps families understand their options for cremated remains, find organizations that can help, and permanently identify the remains in their care with a RetURN.org ID. It's an initiative of Buried in Work Charitable and the Cremation Association of North America. Buried in Work operates the website, and “we” in this policy means Buried in Work.

What we collect

When you create an account. Your email address, your name if you give it, and a password. We store the password only as a one-way scrambled value, so nobody here can read it. If you sign in with Google instead, Google tells us your email address, your name and an account number that lets us recognize you next time. We never see your Google password.

When you activate a RetURN.org ID. The ID and its activation code, the date you activated it, and a link between the ID and your account.

When you fill in an ID's page. What you choose to enter: the person's name, their years of birth and death, a photo, their first wish for the remains and a fallback, and the company that performed the cremation (its name, city, state and website).

When you pay. Activation and ID purchases are paid at the Buried in Work shop, which runs on Shopify. Shopify handles your card details; we never see or store them. We receive the order: your name, email address, billing details, what you bought and, for an activation, which ID it was for.

When you contact us. What you send through a form: your name, email address, organization and phone number if you give them, your message, the page you sent it from, and the internet (IP) address it came from. The same applies when you join a waitlist or ask for an activation code you don't have.

If you're a provider or other partner. Your organization's name, type, locations and public business details, the people you invite and their roles, your orders, and any corrections you make to your organization's directory listing.

When someone scans an ID. We count how many times each ID's page is opened, by day. We don't record who scanned it.

How the site is used. Google Analytics records which pages are visited, roughly where from, and on what kind of device and browser. It uses cookies to do this.

What's public

A RetURN.org ID exists so that anyone who finds an urn can learn whose remains they are and what that person wanted. So once an ID's page has a name and a first wish, anyone who scans the label or types the ID can see what you entered on it: the name, years, photo, wishes and cremation company. The page also names the provider that supplied the ID, if there was one, using that business's public details.

The page never shows your name, your email address, your account or the activation code. Until an ID's page has a name and a first wish, a visitor only sees that the ID is registered.

Think about what you put on the page with that in mind. You can change or remove anything on it, including the photo, at any time from your account.

How we use it

To run your account, keep you signed in, and let you manage the IDs in your care.
To show an ID's page to whoever scans it.
To confirm your activation payment and switch your ID on.
To answer your messages and connect you with providers.
To send the emails the service needs: verifying your address, resetting a password, confirming an activation or an order. We don't send marketing email from RetURN.org.
To run the partner program: setting up organizations, filling label orders, and keeping directory listings accurate.
To keep the site secure, stop abuse, and understand how it's used so we can improve it.

Who we share it with

We don't sell your personal information, and we don't sell leads.

Service providers who run parts of the site for us: our hosting provider, Resend (which delivers our email), Shopify (payments and orders), Google (sign-in, if you use it, and Analytics).
Buried in Work's directory. The provider finder on RetURN.org is Buried in Work's directory, shown inside our page. It's served by buriedinwork.com, which counts visits with its own analytics; advertising and social-media tracking are switched off inside our finder. Its privacy policy covers what it collects. When a partner corrects their organization's listing, we send that correction to Buried in Work's directory.
The provider that supplied your ID can see that it has been activated, so it can support you and earn a replacement label. It doesn't see your account details or what's on the page beyond what's public.
When the law requires it, or to protect someone's safety or the site's security.

If you contact a provider you found through the directory, you deal with them directly and their own privacy practices apply.

Cookies

We set one cookie of our own: it keeps you signed in, lasts up to 30 days, and is removed when you sign out. Google Analytics sets its own cookies to count visits. The directory inside the finder is buriedinwork.com and sets its own cookies. You can block or clear cookies in your browser. If you block ours, you won't be able to stay signed in.

How long we keep it

We keep your account and the IDs you manage for as long as you have the account. We keep messages, waitlist sign-ups and order records for as long as we need them to answer you and keep accurate business records.

An ID is meant to stay with the remains for generations, so an ID's public page doesn't disappear when an account closes. If you ask us to close your account, we remove your access and personal details. The ID's page stays, unless you ask us to take it down.

Your choices and rights

You can change your name, email address and password, and everything on your IDs' pages, from your account at any time. You can also ask us what we hold about you, ask us to correct or delete it, or ask us to take an ID's page down. Depending on where you live, the law may give you further rights, and we'll honor them. Email info@buriedinwork.org or use our contact page.

Keeping it secure

The site only works over an encrypted connection. Passwords are never stored in readable form, activation codes never appear on a public page, and access to the admin area is limited to the few people who run the site. No system is perfectly secure, but we take care to protect what you give us.

Children

RetURN.org is for adults. It isn't directed to children under 13, and we don't knowingly collect their information.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects what's public on an ID's page, we'll email account holders before it takes effect.

Contact

Questions about this policy, or requests about your information, can go to info@buriedinwork.org or through our contact page.