Data Privacy Policy

Classification: Internal, Confidential. Not for external distribution until reviewed by legal counsel.

Drafting note: This is a working draft produced to establish a compliance-ready baseline before Cairn handles real user data. It has not been reviewed by a licensed attorney or a qualified compliance auditor. Sections marked [LEGAL REVIEW REQUIRED] need counsel sign-off before this policy is adopted or published.

1. Information We Collect

Data minimization is enforced in the product itself, not just in policy: Cairn asks only what changes the step in front of you, and several categories of sensitive data described below are deliberately never collected at all (Section 1.10). The categories below reflect the full Cairn product.

1.1 Account and Identity Information

1.2 Information About the Person Who Died

1.3 Documents You Store in Your Case (Document Vault)

(a) Every case includes an encrypted document vault where you can upload and keep the paperwork that follows a death in one secure place: the death certificate, a will or trust, powers of attorney, probate filings, letters testamentary, insurance policies and claim paperwork, bank and brokerage statements, property deeds, and tax records, among others. This is a core part of Cairn, consistent with its purpose of organizing trust and estate documents rather than leaving them scattered across inboxes, drawers, and other people's filing cabinets.

(b) A document you upload may contain highly sensitive information in its own right, including a full Social Security number, financial account numbers, or health information about the person who died. Cairn does not read, extract, or act on the content of an uploaded file beyond what you tell it directly in conversation. Each file is encrypted at rest and in transit and is subject to the same access controls, audit logging, and retention rules described in the companion Data Security Policy.

(c) You choose what to upload, can view, download, or delete anything in the vault at any time, and can revoke a collaborator's access to it independently of their access to the rest of the case (Section 1.8 and Section 6.3).

1.4 Financial and Asset Information

(a) To support inventorying and closing out the deceased's accounts and property, Cairn stores the financial institutions, account types, and approximate asset categories you record (for example, "checking account, First National Bank, notified" or "brokerage account, Fidelity, in probate"), along with the status of each notification or closure task and any beneficiary information you choose to record.

(b) Cairn does not require, and does not store, a full bank account, brokerage account, or payment card number. Where confirming you mean a specific account is useful, only the last four digits are stored. A full account number that appears inside an uploaded document (Section 1.3) is protected by that document's encryption and access controls rather than being separately extracted or indexed.

1.5 Conversation Content

(a) Your messages to Cairn and Cairn's replies, including anything you volunteer about grief, distress, or personal circumstances. When a message is spoken rather than typed, only the words are sent to Cairn once you choose to send them. Speech-to-text conversion happens entirely on your own device. The audio itself is never recorded, kept, or transmitted to Cairn or any vendor.

1.6 Consent and Acknowledgment Records

(a) What you agreed to (the Terms of Use, this Privacy Policy, the AI-guide acknowledgment), the policy version in effect, and when consent was granted or withdrawn.

1.7 Notification Preferences

(a) Which channels you choose (email, text message, in-app, and browser push are all available) and how often, changeable at any time. Every notification email and notification text is sent through Twilio (Section 3.1).

1.8 Collaborator and Case-Sharing Information

(a) Cairn lets you invite a co-executor, spouse, attorney, or professional fiduciary into a case as a collaborator, since real families and fiduciaries rarely handle a death alone. When you invite someone, Cairn collects their name, email, and the role and permissions you grant them (for example, view-only, or full edit access to tasks but not the document vault). A collaborator's own use of the case, once they accept, is governed by this same policy.

(b) You can see who has access to a case, change a collaborator's role, or revoke their access entirely, at any time, from case settings (Section 6.3).

1.9 Usage, Device, and Log Information

(a) Device and browser type, in-app event logs, and crash reports (Usage & device data, Internal).

(b) Who did what, when, and the IP address of the action, kept append-only for security and accountability purposes (Audit & action log, Internal).

1.10 Information We Deliberately Do Not Collect

(a) A Social Security number, in whole or in part, a full financial account or payment card number, and a stored cause of death are never requested by Cairn directly. Cairn does not file anything with a government agency or financial institution on your behalf, so it has no task that needs even the last four digits of a Social Security number, and does not collect them. If you type a full Social Security number, a financial account number, or a card number into a conversation with Cairn, the product masks it immediately, does not save it, and does not repeat it back.

(b) Cairn asks only about the circumstances of a death (sudden, expected, still being determined), never the medical cause, and does not store a cause of death if you volunteer it. A death described as a suicide is treated as a loss, not automatically as a crisis signal, and does not by itself pause intake or trigger the crisis plan described in Section 2.4. Your own risk signals still do.

(c) Distress classifications are not persisted: when Cairn detects signs of acute distress or risk of harm, it changes how it responds in the moment, but that detection is not written to a permanent record beyond the anonymous count described in Section 2.5, and it is excluded from analytics and from any product-improvement use.

2. How We Use Information

2.1 To Provide the Service

(a) Creating and running your case, generating your journey, tracking task status, storing and securing documents in your vault, managing collaborator access, and producing the AI guide's replies.

(b) "Minimum necessary" is an enforced product rule, not just a policy statement: Cairn asks only what changes the journey right now. Full legal name, date of birth, and cause of death are never asked during case creation. They are asked, if at all, just-in-time inside the one task that actually needs them. A Social Security number, in whole or in part, is never asked for at all (Section 1.10).

2.2 To Route You to the Right Jurisdiction and Institution

(a) Storing the deceased's basic details and death-event information to route you to the correct state vital-records office, agency, or institution, and to generate jurisdiction-specific journey content, consistent with the citation practice described in the companion Terms of Use.

2.3 To Process Payment

(a) Billing your subscription through Stripe, Cairn's payment processor. See Section 3.1 for exactly what Stripe receives.

2.4 Crisis Safety Detection and Response

(a) If Cairn's conversation shows signs that you may be thinking about suicide or self-harm, or hurting someone else, Cairn immediately and clearly shares the 988 Suicide & Crisis Lifeline (call, text, or chat) [35], and the Veterans Crisis Line where your case involves a veteran [36]. All account and case logistics stop in that moment, and Cairn does not close, pause, or delete anything from a conversation turn where acute distress or risk of harm is present, even if you asked it to in the same message.

(b) With your explicit, one-time yes, Cairn may send a single check-in message the next day after a high-distress conversation, through whichever notification channels you already chose. That check-in ignores your general frequency preference, including a "no reminders" setting, but still respects quiet hours, and it is the only message Cairn ever sends outside your own notification choices. Cairn never contacts anyone else on your behalf, including family members, emergency contacts, or authorities.

(c) Before you can use Cairn, you are shown a notice and asked to confirm you understand it, telling you that Cairn is an artificial intelligence (AI) guide, not a human, not an attorney, and not a therapist, counselor, or medical professional, and that whenever your situation calls for an attorney, a therapist, or crisis support, Cairn will tell you and point you to one, including the 988 Suicide & Crisis Lifeline.

(d) This notice is provided consistent with the disclosure requirements of California Senate Bill 243 (2025), which requires that you be told clearly that you are interacting with an artificially generated assistant and not a human [22].

(e) California SB 243 (2025) regulates "companion chatbots" and requires, among other things, this clear AI disclosure, break and usage reminders and stricter protections for minors, and a mandated referral to crisis services when a user expresses suicidal ideation. It also creates a private right of action [22]. [LEGAL REVIEW REQUIRED] Whether Cairn is a "companion chatbot" under SB 243, or falls under its exemption for customer-service or productivity-limited bots, has not been formally determined. The notice described above is written to satisfy the disclosure requirement either way.

(f) [STATUS] Cairn's crisis phrase list, escalation protocol, reply scripts, and test scenarios are under review by a licensed clinical reviewer. The packet was first sent for review on 2026-10-02 and a revised version on 2026-10-15. Sign-off is still pending as of this draft.

2.5 Legal and Regulatory Compliance

(a) Starting July 1, 2027, SB 243 requires an annual report to the California Office of Suicide Prevention covering the number of crisis-referral notifications issued in the preceding calendar year, together with a description of Cairn's crisis protocols. The report must not include any user identifier or other personal information [47]. Cairn keeps an anonymous monthly count of crisis-level referrals, with no user or case identifier attached, for this purpose. [OPEN DECISION, pending counsel] How long that anonymous count should be kept is still being decided, with 7 years the figure under discussion.

2.6 Security, Fraud, and Abuse Prevention

(a) Detecting and preventing unauthorized access, account takeover, and misuse of the Service, and maintaining the audit and access logs described in Section 5.

2.7 Product Improvement and Analytics

(a) De-identified usage patterns are used to improve the product. Identifiers are stripped before analysis, and raw identifiable data is never used for analytics.

2.8 We Do Not Use Information for Marketing or Advertising

(a) Cairn never uses your information, or information about the person who died, for marketing or advertising, and never sells it or shares it for advertising purposes. This is a direct, product-level promise shown to every user at signup ("Cairn never uses your information... for marketing or advertising. We do not sell it or share it for ads."), not just a policy-level commitment, and it is required contractually of every service provider (Section 3.1).

(b) This covers phone numbers and notification settings specifically: a phone number is used only to send the notifications you asked for, never for marketing, and never handed to a third party for its own marketing use.

2.9 Automated Decision-Making

(a) Cairn does not make solely automated decisions that produce legal or similarly significant effects for you (for example, it does not autonomously file a probate document or make a binding legal determination) (GDPR Art. 22 [8]). Every point where the product could plausibly cross into legal, tax, or medical advice is flagged for you to take to a real attorney, tax professional, or clinician, consistent with the AI-guide notice in Section 2.4 and the companion Terms of Use.

(b) Funeral and disposition research is informational only: Cairn helps you find and compare funeral homes, cemeteries, and cremation providers, and shows prices only where a provider publishes them online, always with the source and date and a note that prices can differ in person. Cairn does not schedule, book, reserve, or arrange a funeral, and does not contact providers on your behalf. You always do the reaching out yourself. See the Terms of Use for the full disclaimer and its NH RSA 325:43 basis [32].

(c) Cairn never generates a voice, likeness, or simulated conversational presence of the person who died. See the Terms of Use for the explicit prohibition on this use.

3. Third-Party Integrations and Sharing

3.1 Service Providers

The no-marketing-or-advertising-use commitment in Section 2.8 is required in every service-provider contract, not just stated in this policy. A provider that used Cairn user data for its own marketing purposes would break that commitment even if Cairn itself never did.

[LEGAL / OPERATIONAL REVIEW REQUIRED] Data processing agreements with each provider above are still needed. None has been formally contracted with a signed DPA as of this draft, even where the product already depends on them in production. A current, named service-provider list is maintained as a living appendix to this policy and is disclosed to you on request and, proactively, in-product.

3.2 Collaborators and People You Invite

(a) When you invite a collaborator into a case (Section 1.8), Cairn shares with them the parts of the case your chosen role and permissions allow, and nothing more. Inviting a collaborator is your choice and your instruction to Cairn, not a disclosure Cairn initiates on its own.

3.3 Legal Disclosures

(a) Cairn may disclose personal data where required by law, such as in response to a valid subpoena, court order, or other legal process, or where necessary to protect the rights, property, or safety of Cairn, its users, or the public, including in a genuine emergency involving risk of harm. [LEGAL REVIEW REQUIRED] Standard law-enforcement-request procedure, including a presumption of notifying the affected user where legally permitted, should be documented by counsel before this section is finalized.

3.4 Business Transfers

(a) If Cairn Guide, LLC is involved in a merger, acquisition, or sale of substantially all of its assets, personal data may be transferred as part of that transaction, subject to the commitments in this policy continuing to apply. [LEGAL REVIEW REQUIRED]

3.5 We Never Sell Personal Information

(a) Cairn does not sell personal data, your information or information about the person who died, to anyone, for any purpose, and has never done so.

3.6 International Transfers

(a) All current infrastructure is US-based. Cairn does not currently target EU/UK users as a primary market, but the product should not block them by geography without a deliberate decision. If EU/UK users are onboarded, a transfer impact assessment is required before launch [14]. [LEGAL REVIEW REQUIRED]

(b) If a future service provider processes data outside the US, this section needs Standard Contractual Clauses or an equivalent transfer mechanism before that vendor is engaged.

4. Data Storage

4.1 Where Your Data Is Stored

(a) All personal data, including documents in your vault, is stored on US-based infrastructure. See the companion Data Security Policy for the specific technical safeguards (encryption at rest and in transit, key management, and network architecture) that protect it.

4.2 How Long We Keep Information

[LEGAL REVIEW REQUIRED] State-specific record-retention obligations for executors and fiduciaries vary by state and were not re-verified in this draft.

4.3 Decedent Data

(a) Decedent data itself sits outside GDPR's definition of personal data once the individual has died (Recital 27) [15], but because a case's details almost always reveal information about you and any collaborator you invite, Cairn treats decedent data with the same encryption, access logging, and retention discipline as living users' data rather than relying on that carve-out. New Hampshire's RSA 554-A (the Revised Uniform Fiduciary Access to Digital Assets Act) governs a fiduciary's own legal right to access a decedent's separate digital accounts. It does not require Cairn to grant access to a case it did not create, and this policy does not rely on it as a basis for in-product sharing [41].

4.4 Closing, Downloading, and Deleting

(a) You can download or print your case record, your vault documents, and a hand-off summary for someone else, and download your full account data, at any time, for free, whether or not you are subscribed. The case record and hand-off summary are plain text files that contain no Social Security number digits, financial account numbers, or card numbers, and the file name never includes the name of the person who died. This supports the data portability right described in Section 6.1 [24].

(b) Settings also includes a "What Cairn knows" page that shows everything Cairn keeps about you and your case in plain words, including your running conversation summary word for word, and shows exactly what a download would contain.

5. Data Security

5.1 Why HIPAA Informs Our Security Design

(a) Cairn is very likely not a HIPAA "covered entity" (it is not a health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with a covered transaction) or a "business associate" of one, because it does not perform functions on behalf of, or receive protected health information from, a covered entity in the HIPAA sense [1][3]. [LEGAL REVIEW REQUIRED] Counsel should confirm this reading before it is relied upon. Because the document vault (Section 1.3) and conversation content routinely touch health-adjacent information about the person who died, this policy and the companion Data Security Policy are designed to meet HIPAA's Privacy and Security Rule standards regardless.

5.2 Technical and Organizational Measures

(a) Encryption at rest and in transit, access controls, network architecture, and logging are described in full in the companion Data Security Policy, which this policy incorporates by reference. This design is built to the standard expected of an independent privacy and security audit, consistent with NIST's Cybersecurity Framework 2.0 and the OWASP Top 10 for Large Language Model Applications where Cairn's own AI guide is concerned [48][49].

5.3 Personnel Access

(a) Access to identifiable user data is granted on a least-privilege, need-to-know basis and logged. See the Data Security Policy for the technical control.

(b) All personnel and contractors with access to Confidential or Restricted data complete privacy and security training before access is granted and at least annually after.

5.4 Breach Notification

[OPEN GAP] Cairn does not currently store a user's state of residence as a distinct field, which makes it harder to route breach notices to the right state regulator quickly. This is flagged as a design gap to resolve, not yet closed.

Notification to individuals will, at minimum, describe what happened, what categories of data were involved, what Cairn has done and will do about it, and what you can do to protect yourself, matching both GDPR Art. 34's content requirements and HIPAA's [2][13].

5.5 Incident Response

(a) Cairn maintains an incident-response process, described in full in the companion Data Security Policy, that governs how a suspected breach is investigated, contained, and escalated internally before any external notification duty under Section 5.4 is triggered.

6. User Rights and Controls

6.1 Your Rights Under GDPR

Every user can exercise the following rights under GDPR Chapter III [7]. Several of these are already built into Cairn as in-product self-serve actions rather than requests that require contacting support, noted below.

6.2 Your Rights Under US State Privacy Laws

(a) California's CCPA/CPRA and similar state laws (Virginia, Colorado, Connecticut, and others enacted since) grant residents rights that substantially overlap with the GDPR rights in Section 6.1 (access, deletion, correction, opt-out of sale or sharing) [21]. Because this policy already builds to the stricter GDPR standard, and because Cairn does not sell or share data for advertising at all (Section 2.8 and Section 3.5), Cairn is substantively aligned with these state laws by default. The gap to close before launch is procedural, not substantive: publishing a compliant "Do Not Sell or Share My Personal Information" mechanism and a state-law-specific privacy notice. [OPERATIONAL REVIEW REQUIRED]

(b) New Hampshire's RSA 507-H is adopted as the baseline privacy standard for all users regardless of residency, including its 45-day response window for a rights request (extendable once by another 45 days) and its appeal path naming the NH Attorney General [39].

(c) Washington's My Health My Data Act and a similar Nevada law extend consumer-health-data protections to data that is not covered by HIPAA, with no company-size threshold and, in Washington's case, a private right of action [43]. [LEGAL REVIEW REQUIRED] Grief, distress, and crisis-related content you type into Cairn, and health-adjacent documents stored in your vault, may qualify as "consumer health data" under this law. Counsel confirmation of Cairn's compliance posture under this statute is still needed.

(d) California's SB 243 (Section 2.4 and Section 2.5) is a separate, AI-specific statute and is tracked there rather than here. [LEGAL REVIEW REQUIRED]

6.3 Managing Collaborator Access

(a) If you have invited a collaborator into a case (Section 1.8), you can view everyone with access, change their role, or revoke their access entirely, at any time, from case settings. Revoking access is immediate and ends that person's ability to view or edit the case, including the document vault, going forward. It does not retroactively undo anything they already did while they had access, which remains part of the case's audit history.

6.4 Children and Eligibility

(a) Cairn is not directed at, and is not knowingly offered to, anyone under 18. Account creation requires confirming you are an adult. If Cairn later learns an account belongs to a minor, that account and its data are deleted.

7. Cookies and Tracking

7.1 Strictly Necessary Cookies

(a) Cairn uses a small number of strictly necessary cookies to keep you signed in, maintain your session security, and remember basic settings such as your chosen voice style. These are set by Cairn and by Auth0 (Section 3.1) and cannot be disabled without breaking the ability to sign in and use the Service.

7.2 Analytics

(a) Cairn uses limited, privacy-preserving analytics to understand de-identified usage patterns, such as which journey steps are most often paused on, as described in Section 2.7. These analytics do not use third-party advertising networks, do not build a cross-site profile of you, and are never combined with your case or conversation content.

7.3 No Advertising or Cross-Site Tracking Cookies

(a) Cairn does not use advertising cookies, does not use third-party tracking pixels, and does not participate in cross-site or cross-app tracking of any kind, consistent with the commitment in Section 2.8 and Section 3.5 that your data is never used or sold for advertising.

7.4 Your Cookie Choices

(a) Because Cairn does not use advertising or non-essential tracking cookies, there is no advertising cookie preference to turn off. Where your browser offers a Do Not Track or Global Privacy Control signal, Cairn honors it as an opt-out of the limited analytics described in Section 7.2. It has no effect on strictly necessary cookies, which are required for the Service to function.

8. Policy Updates

8.1 How We Notify You of Changes

(a) If this policy changes in a material way, Cairn prompts you to review and acknowledge the update before you can continue using the Service, the same commitment described in the companion Terms of Use. For a non-material change, the updated policy is posted in-product and your continued use of the Service after that point means you accept it.

8.2 Governance and Review

(a) A named Privacy & Security Lead role is responsible for this policy, its companion Data Security Policy and Terms of Use, and coordinating any regulator-facing communication, including the SB 243 annual report described in Section 2.5. [OPERATIONAL REVIEW REQUIRED] This role has not yet been formally assigned beyond a founder.

(b) This policy, the Data Security Policy, and the Terms of Use are reviewed at least annually and immediately after any material change to what data Cairn collects, which service providers it uses, or the regulatory landscape.

(c) A Data Protection Impact Assessment (DPIA) is completed before any new feature that processes special category data at scale, uses a new AI capability against case data, or changes the collaborator and sharing model, consistent with GDPR Art. 35's expectation for high-risk processing.

9. Contact Information

(a) [OPERATIONAL REVIEW REQUIRED] Privacy questions or rights requests not yet self-serve in-product are routed to the Privacy & Security Lead (Section 8.2) until a dedicated privacy inbox is stood up and published. Public contact details are pending.

(b) If you believe your rights have not been respected, you can escalate to your relevant supervisory authority. In the EU/UK, that is your national data protection authority. In the US generally, that is your state Attorney General's consumer protection office. In New Hampshire specifically, that is the NH Attorney General under RSA 507-H. Cairn will provide the appropriate contact on request.

Version History

Regulatory References

This policy was prepared using the primary and near-primary sources below. Citations in the body reference these by number, for example [4]. Because regulatory guidance and enforcement priorities change, verify each citation against the live source before this policy is relied upon operationally, and re-check them at every annual review.

[1] HHS.gov, Summary of the HIPAA Security Rule. https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html (opens in a new tab)

[2] HHS.gov, Breach Notification Rule. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html (opens in a new tab)

[3] HHS.gov, The HIPAA Privacy Rule. https://www.hhs.gov/hipaa/for-professionals/privacy/index.html (opens in a new tab)

[7] EUR-Lex / gdpr-info.eu, GDPR Chapter III, Articles 12 to 23, Rights of the data subject. https://gdpr-info.eu/chapter-3/ (opens in a new tab)

[8] EUR-Lex / gdpr-info.eu, GDPR Article 22, Automated individual decision-making, including profiling. https://gdpr-info.eu/art-22-gdpr/ (opens in a new tab)

[13] EUR-Lex / gdpr-info.eu, GDPR Article 34, Communication of a personal data breach to the data subject. https://gdpr-info.eu/art-34-gdpr/ (opens in a new tab)

[14] EUR-Lex / gdpr-info.eu, GDPR Articles 44 to 49, Transfers of personal data to third countries. https://gdpr-info.eu/chapter-5/ (opens in a new tab)

[15] EUR-Lex / gdpr-info.eu, GDPR Recital 27, Not applicable to data of deceased persons. https://gdpr-info.eu/recitals/no-27/ (opens in a new tab)

[21] California DOJ, California Consumer Privacy Act (CCPA/CPRA) overview. https://oag.ca.gov/privacy/ccpa (opens in a new tab)

[22] California Legislature (via LegiScan), Senate Bill 243 (2025), companion chatbot AI disclosure and safety requirements, chaptered text. https://legiscan.com/CA/text/SB243/ (opens in a new tab)

[23] EUR-Lex / gdpr-info.eu, GDPR Article 17, Right to erasure (the right to be forgotten). https://gdpr-info.eu/art-17-gdpr/ (opens in a new tab)

[24] EUR-Lex / gdpr-info.eu, GDPR Article 20, Right to data portability. https://gdpr-info.eu/art-20-gdpr/ (opens in a new tab)

[32] New Hampshire General Court, RSA 325:43, Funeral directors, embalmers, restrictions on arranging services. https://gc.nh.gov/rsa/html/XXX/325/325-43.htm (opens in a new tab)

[33] CDC / National Center for Health Statistics, Where to Write for Vital Records. https://www.cdc.gov/nchs/w2w/index.htm (opens in a new tab)

[35] 988 Suicide & Crisis Lifeline, Call, text, or chat 988. https://988lifeline.org (opens in a new tab)

[36] Veterans Crisis Line, Dial 988, then press 1. https://www.veteranscrisisline.net (opens in a new tab)

[39] New Hampshire General Court, RSA 507-H, New Hampshire Privacy Act. https://gc.nh.gov/rsa/html/L/507-H/507-H-mrg.htm (opens in a new tab)

[41] New Hampshire General Court, RSA 554-A, Revised Uniform Fiduciary Access to Digital Assets Act. https://gc.nh.gov/rsa/html/LVIII/554-A/554-A-mrg.htm (opens in a new tab)

[43] Washington State Legislature, RCW 19.373, My Health My Data Act. https://app.leg.wa.gov/rcw/default.aspx?cite=19.373 (opens in a new tab)

[47] California Legislature (via LegiScan), Senate Bill 243 (2025), Business and Professions Code 22602 to 22603, annual reporting to the Office of Suicide Prevention. https://legiscan.com/CA/text/SB243/ (opens in a new tab)

[48] NIST, Cybersecurity Framework (CSF) 2.0. https://www.nist.gov/cyberframework (opens in a new tab)

[49] OWASP Foundation, OWASP Top 10 for Large Language Model Applications. https://owasp.org/www-project-top-10-for-large-language-model-applications/ (opens in a new tab)

[50] Stripe, Stripe Tax, automatic tax calculation and collection. https://stripe.com/tax (opens in a new tab)