Privacy Policy

---

1. Who we are

FamilyCrests™ is operated by FamilyCrests Studio LLC, a limited liability company registered in Wyoming, USA. We sell through myheritagestories.com. We run the business and read the inbox ourselves.

This policy explains what we do with personal information when you visit the site, request a free report, buy a report, or order a physical product.

Our only contact channel is email: customer@myheritagestories.com. There is no phone line and no live chat. We answer within 48 hours. Our Contact page has the details.

---

2. What we collect

What you give us

What we collect automatically

• IP address, browser type, device type and operating system.
• Pages viewed, links clicked, and the site or ad you arrived from.
• Cookies and similar identifiers. They are summarised in Section 8 and listed one by one, with what each does and how long it lasts, in our Cookie Policy.

What others tell us

• Stripe tells us that a payment succeeded and the email address used with it.
• Google Sign-In, if you choose it to open your report portal, gives us your name, email address and profile picture.
• ParcelPanel and the carriers give us delivery status for physical orders.

What we do not collect

• No genetic material, DNA samples or DNA test results of any kind.
• No Social Security numbers, government ID numbers, financial account numbers, precise location, health information, or information about your race, religion, politics, union membership or sexual life.
• No account. Checkout is as a guest, and we do not ask you to create a login.

---

3. The surname you search, and free reports

The surname you type is what our system uses to build a volume. Three things are worth being clear about.

It is produced by a system, not by a person. Part of your volume is drawn from public reference material — the U.S. Census Bureau surname file, digitised newspaper pages held by the Library of Congress, and open structured records — and the rest of it, including the coat of arms, is generated by the same system from the surname itself. The same surname always produces the same volume, for everyone, every time. Where a surname is not in a public source, the system completes that section rather than leaving it blank, so your volume arrives whole and part of it is reconstruction rather than record. Naming an archive is not a claim that we searched it on your behalf. It is not proof of ancestry, not a grant of arms and not a DNA test. The full method is on How your report is made.

Why that matters for your privacy. Because the volume is generated rather than researched, we do not look you up anywhere, we do not buy data about you, and we do not build a profile of your family. The surname is the only thing about your family that the system uses. We do not ask for, and do not want, the names of your relatives, birth records, or documents about your ancestors.

We do keep a record of the surname. It is stored with your order so we can find that order, answer your emails and keep your access link working, and it is part of the report file itself. Because it sits next to your email address and your order, we treat the surname as personal information about you, covered by every right in Sections 10 and 11 — even though the volume itself is about a name, not about you. We do not use it to guess your ethnicity or ancestry, and we do not share it with advertisers.

Free reports. Some of our reports are free: you enter a surname and an email address and the system sends you a report without any purchase. The method is the same, the limits are the same, and the same surname produces the same result. We keep the surname and the email address, and we send you marketing email afterwards — see Section 7, including how to stop it.

---

4. Why we use your information

These are the purposes we use it for:

1. To deliver what you asked for — generate the volume, send the PDF, keep your access link working, and ship physical items.
2. To take payment, and to find your order if you write to us about it.
3. To answer your emails, and to handle refunds and reshipments.
4. To keep the site working and secure — hosting, bot filtering, fraud prevention and diagnosing problems.
5. To send marketing emails, if you asked for them or bought from us (Section 7).
6. To advertise and to measure advertising — showing our ads on other platforms and understanding which ads led to sales (Sections 6 and 8).
7. To meet legal and tax obligations, including keeping records of sales.

If we ever want to use your information for something outside this list, we will update this page first.

About automation. Your volume is written by software, automatically. That is the product. It does not decide anything about you: it has no effect on your credit, your job, your insurance, your rights or your access to any service.

---

5. Payments: we never see your card

Stripe, Inc. is the only payment processor we use. Your card number, expiry date and security code are typed into Stripe's own form and go straight to Stripe. Your card number never reaches us. What comes back to us is confirmation that the payment worked and the email address used with it.

Stripe uses that data under its own privacy policy, including for fraud prevention. You can read it at https://stripe.com/privacy

---

6. Who we share information with

We share personal information with the companies that help us run the business, and each one gets only what it needs. We do not sell your personal information for money, and we do not rent or trade our customer list.

Our checkout software (FunnelKit) and the tool that records which ad or site you arrived from (Sourcebuster) run on our own site. They set cookies, which the Cookie Policy lists, but they do not hand your data to another company.

We may also disclose information when the law requires it — a subpoena, a court order or a valid government request — or to protect our rights, to investigate fraud, or in connection with a sale or transfer of the business. If the business is ever sold, this policy travels with your data.

Where your data is held. We are a U.S. company and our own systems are in the United States. If you are in Canada, your information is transferred to and stored in the United States, where it can be reached by U.S. authorities under U.S. law. Physical products are made by partners in the United States and in China, so a physical order sends your name and shipping address to one of those partners. Digital reports involve no manufacturing partner at all.

---

7. Marketing emails, and how to stop them

If you buy from us, request a free report, or leave the newsletter box ticked at checkout, we add you to our marketing list in Klaviyo and send you occasional emails about our reports and products. Those emails carry a small tracking image that tells us whether the email was opened and which links were clicked.

Said plainly: the checkout box is pre-ticked. The box labelled "Email me with news and offers" arrives already ticked. You can untick it before you pay. If you leave it ticked, you can still unsubscribe from any email later, and we will not treat you differently for it.

To stop the emails: click Unsubscribe at the foot of any marketing email, or write to customer@myheritagestories.com and ask us to remove you. We act on the request for the email address that asks. Every marketing email also carries our mailing address in its footer, as U.S. and Canadian law require; the address is in Section 20.

Unsubscribing from marketing does not stop the emails you need — your report delivery, your receipt and your shipping notices. Those are part of the order.

If you are in Canada. Canada's anti-spam law (CASL) is stricter than the U.S. rule, and a pre-ticked box is not valid consent there. So we do not rely on that box for Canadian customers. We rely on the implied consent that comes from buying from us, which CASL limits to 24 months from your purchase; after that we need you to opt in, or we stop. You can withdraw at any time, by the unsubscribe link or by email. The law allows up to 10 days to process an unsubscribe; if you unsubscribe and an email still reaches you inside that window, write to us and we will make sure it is done.

---

8. Cookies, advertising, and what you can turn off

Cookies are small files stored by your browser. This site uses a modest number of them, in four groups:

• Needed to run the site and your order — bot filtering, the Stripe fraud check, the key that opens the report you bought, and the checkout's own settings.
• Analytics — Google Analytics, and the tool that records which ad or site you came from.
• Advertising — Meta and TikTok.
• Marketing email — Klaviyo.

Our Cookie Policy is the page that owns this subject. It names every cookie, says who sets it, what it does and how long it lasts, and it is the list we keep up to date. This section is a summary.

There is no cookie banner. Advertising and analytics cookies are set as soon as a page loads, before you do anything. We work on an opt-out basis, which is what the U.S. and Canadian rules we sell under generally allow — so instead of a banner, here is what you can turn off.

Blocking "third-party cookies" is not the full answer. Several of the advertising and analytics cookies are set by another company's script but stored under our own domain, so a browser setting that blocks third-party cookies does not remove them. Deleting cookies and using your browser's privacy settings still helps, and the Cookie Policy sets out, step by step, the controls that actually work — in your browser, and in your Meta, TikTok and Google account settings.

One thing no cookie setting covers. When a purchase completes, our server also sends the sale to Meta and to TikTok directly, with scrambled versions of your details so the sale can be matched to an ad. It is sent from our side, not from your browser, so cookie settings do not affect it — and today we do not have a per-person switch that stops it. We would rather say so than offer you an opt-out we cannot carry out.

What we can do if you write to us. Email customer@myheritagestories.com and ask us to opt you out of advertising. We do it by hand: we remove you from our marketing list, we remove you from the advertising audiences we control on Meta and TikTok, and we stop using your details for advertising as far as that is under our control. We will tell you plainly what we could and could not change. What we cannot do from our side is clear cookies already sitting in your browser — only you can do that.

Do Not Track and Global Privacy Control. Some browsers can send a "Do Not Track" or "Global Privacy Control" signal to every site you visit. Our site does not detect or respond to either signal today. There is no code on the site that reads them. Until that changes, use the controls in the Cookie Policy, or email us and we will act on your request by hand.

Our Your Privacy Choices page brings these choices together in one place. The Cookie Policy is the document that governs; if the two ever differ, the Cookie Policy is the accurate one.

---

9. How long we keep things

We keep information only while we have a reason to.

• Order and payment records are kept for as long as tax and accounting law requires us to keep them, and then removed or stripped of anything that identifies you.
• Your report and your access link are kept while we offer access to what you bought. If we ever have to stop offering it, we will tell the people who bought it by email. If you ask us to delete your data, that access ends with it — we will say so before we do it, so the choice is yours.
• Marketing list data is kept until you unsubscribe. After that we keep a suppression record — your email address on a do-not-contact list — for the sole purpose of not emailing you again by accident.
• Support emails are kept while they may still be needed for your order, a delivery problem or a payment dispute, and are removed once they are not.
• Analytics and advertising data live inside those platforms and expire on their own schedules and on the cookie lifetimes listed in the Cookie Policy. We do not keep separate copies of that browsing data.

---

10. What you can ask us to do

Wherever you live, you can ask us to:

• Tell you what personal information we hold about you and where we got it.
• Send you a copy of it.
• Correct anything that is wrong.
• Delete it.
• Stop marketing emails.
• Opt you out of advertising and analytics, within the limits set out in Section 8.

We will not treat you worse for asking, we do not charge for it, and you do not need an account.

Limits, stated honestly. Some information we have to keep: sales records for tax purposes, and the suppression record that exists precisely so we do not contact you again. If we cannot delete something, we will tell you what it is and why.

---

11. How to make a request, and how we check it is you

Send your request to customer@myheritagestories.com with the subject line "Privacy request." Tell us what you want us to do.

We do not run a general account system. Almost everyone buys as a guest, and the report portal opens from a private link rather than from a password. So we cannot simply log you in. We have to be sure you are the person whose data you are asking about — otherwise anyone could email us and collect a stranger's details. This is how we do it.

1. Write from the email address you used. That is the strongest signal we have, and in most cases it is enough.
2. If you write from a different address, or if the request covers order details such as your name, shipping address, phone number or purchase history, we will ask you to confirm a few things only the buyer would know — for example the order number, the approximate date and amount of the purchase, the surname you searched, or the shipping postal code.
3. When we send data out, we reply to the email address on the order, not to the address that made the request.

If those details cannot be confirmed, we may not be able to send you the information. That is not us being difficult: handing it to the wrong person would be the worse mistake. Even then we will tell you whether we hold anything at all, and we can still delete on request.

Anything you send us to prove who you are is used only for that check, and deleted afterwards.

Someone acting for you. You can have an authorised agent make a request. We will ask for written permission signed by you, and we may still contact you directly to confirm.

How long we take. We complete privacy requests within 45 days, with one extension where the law allows it — and if we need the extension, we will tell you inside the first 45 days and say why. Ordinary support emails are answered within 48 hours.

---

12. If you live in California

The California Consumer Privacy Act, as amended, gives you specific rights. These are the categories of personal information we collect, and have collected over the past twelve months:

We collect these for the purposes in Section 4 and keep them for the periods in Section 9.

Sensitive personal information. We do not collect it. In particular we collect no genetic information: we never take, sequence or analyse genetic material, and nothing in a report comes from a sample. The surname you search is stored as commercial information about your order. We do not use it to infer your racial or ethnic origin, and we do not use or disclose any category of sensitive personal information for a purpose that would give you an opt-out right.

Your rights: to know, to access, to a portable copy, to correct, to delete, to opt out of sale or sharing, and not to be treated worse for exercising any of them. Section 11 explains how to ask.

"Sale" and "sharing." We do not sell personal information for money. But California defines "sale" and "sharing" broadly, and our use of Meta, TikTok and Google advertising cookies may count as sharing for cross-context behavioural advertising — that is, letting those platforms use what you did on our site to target ads to you elsewhere. To opt out, use the controls in Section 8 or email us and we will do it by hand. As Section 8 says, our site does not process Global Privacy Control signals today.

Minors. You must be 18 to buy from us, which is a condition of sale set out in our Terms of Service. Separately, California uses 16 as the threshold for selling or sharing a minor's data: we do not knowingly sell or share the personal information of anyone under 16, as California defines those terms.

Financial incentives. We do not offer any.

---

13. If you live in another U.S. state

Several states — including Virginia, Colorado, Connecticut, Texas, Oregon, Montana and others — give residents rights similar to those above: to confirm, access, correct, delete, obtain a copy, and opt out of targeted advertising. We extend the same process to residents of every U.S. state. Use Section 11.

One honest note. Some of these states expect a website to recognise a browser-level opt-out signal such as Global Privacy Control. As Section 8 explains, our site does not read those signals today. Until it does, please use the controls in the Cookie Policy, or email us and we will apply your opt-out by hand.

If we turn a request down, you can appeal. Reply to our decision with the words "Privacy appeal" in the subject line. A second look is not a formality: we will read the request again, and we will answer you in writing within 45 days with the outcome and the reasons for it. If you are still not satisfied, you can contact the Attorney General of your state, and we will give you the details for doing so if you ask.

---

14. If you live in Canada

Under PIPEDA and comparable provincial laws, you may:

• Ask what we hold about you, and how it has been used and disclosed.
• Get access to it, and ask us to correct anything inaccurate.
• Withdraw your consent to marketing, and to advertising and analytics, at any time — subject to what we still need in order to complete an order and to meet legal obligations. Section 8 sets out what we can switch off for you and what only your browser can.

Use Section 11 to make the request. The rules that apply to our marketing emails in Canada are in Section 7.

Cross-border storage. We are based in the United States, and your information is stored there by us and by our service providers. While it is in the U.S. it is subject to U.S. law, including lawful access requests by U.S. authorities. A physical order also involves a manufacturing partner in the United States or in China (Section 6).

If you are not satisfied with how we handled your request, you can complain to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca, or to the privacy commissioner of your province. You do not need our permission to do it, and we will not treat you worse for it.

---

15. Customers in other countries

We hold order records for customers in a number of countries, including in Europe. If you are one of them, the rights and the request process in Sections 10 and 11 apply to you in exactly the same way, on the same 45-day timetable: write to customer@myheritagestories.com and we will handle your access, correction or deletion request.

---

16. People named in our reports

Our reports quote public reference material, and some of it names real people — for example individuals recorded in open structured databases such as Wikidata and Wikimedia Commons, or names printed on public-domain newspaper pages held by the Library of Congress. Those entries carry a reference and a link back to the source, so you can open the source and see it for yourself.

None of it is a claim that a customer is related to anyone named, and none of it comes from a customer.

If you are named in one of our reports, or you act for someone who is, and you want to raise a concern about it, write to customer@myheritagestories.com with the surname and the detail in question. We will look at it, reply within 48 hours, and tell you plainly what we can and cannot change.

---

17. Children

Our site and our products are for adults. You must be 18 or older to buy, which is a condition of sale in our Terms of Service. We do not direct the site to children and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, write to customer@myheritagestories.com and we will delete it. The separate California rule about data of anyone under 16 is in Section 12.

---

18. Security

We take reasonable steps to protect what we hold. Traffic to and from the site is encrypted (HTTPS). Card numbers never reach our systems — Stripe handles them. Access to our order records is limited to the people who run the business and to the service providers listed in Section 6, each under its own security obligations. We keep the site's software updated and use bot filtering at the network level.

About your report link. The private link that opens the report you bought works for whoever has it. That is what makes it convenient, and it is also its limit. Treat it like a receipt: fine to keep, but do not post it publicly. If you think your link has been passed around and you want it changed, email us and we will replace it.

We will not tell you your information is perfectly safe, because no company can honestly say that. No website, no database and no transmission over the internet is completely secure. What we can say is that we keep as little as possible, that the most sensitive thing you type — your card — never reaches us at all, and that if a breach affecting your information happens, we will notify you and the relevant authorities as the law requires.

---

19. Changes to this policy

If we change how we handle personal information, we will update this page and change the date at the foot of it. If a change materially affects you and we hold your email address, we will tell you by email. The version on this page is always the current one. If you need to know what this page said on the day you bought, write to us and we will tell you.

---

20. Contact us

Questions, requests or complaints about privacy go to the same place:

• Email: customer@myheritagestories.com
• Subject line: Privacy request (or Privacy appeal, if you are asking us to look again)
• We answer within 48 hours. Email is our only support channel — there is no phone line and no live chat.
• We do not receive post. FamilyCrests Studio LLC is registered in Wyoming, United States, but we have no public postal address and cannot accept letters or parcels. Privacy requests have to come by email.

Our Contact page has everything else.

---

Last updated: August 24, 2026

FamilyCrests Studio LLC, based in Wyoming, USA — FamilyCrests™