This policy explains what information GracePay collects, how we use and share it, and the choices you have. We wrote it in plain language. If something is unclear, email us at info@trygracepay.com.
1. Who we are and what this policy covers
GracePay is a payments platform for funeral homes. Funeral home staff use it to build invoices, send them to families and track payments. Families use it to view an invoice and, where online payment is available, to pay by card, bank transfer or financing offered by a lending partner. Messages are sent by email, and by text where text messaging is available. In this policy, "GracePay," "we" and "us" mean GracePay, Inc., a Delaware corporation located in Des Moines, Iowa.
This policy explains how we handle personal information about:
- Website visitors: people who visit www.trygracepay.com, contact us, sign up or request developer access.
- Funeral home customers and their staff: the businesses that use GracePay and the people who sign in to it for them.
- Families and other payers: people who receive an invoice from a funeral home through GracePay or pay one.
- Developers: people who use the GracePay API on behalf of a funeral home or a software company.
If you have a separate written agreement with GracePay, that agreement also governs how we handle information you give us under it.
2. Our role for funeral homes
When a funeral home uses GracePay to bill and collect from a family, the funeral home decides what information to enter and why. For that information we act as the funeral home's service provider (sometimes called a processor): we handle it to provide GracePay to the funeral home, under our agreement with it, and not for our own unrelated purposes.
If you are a family member and have a question about an invoice or about how the funeral home uses your information, please contact the funeral home first. Its name and a contact person appear on every invoice and payment page. We will help the funeral home respond, and you can always reach us at info@trygracepay.com.
3. Information we collect
Information you give us on the website
- Contact form. Your name, organization, email address and message.
- Developer access requests. Your name, company, email address, company website, what you are building, the features you are interested in and any details you add.
- Signing up. Our signup page displays a form provided by our payment processor, Client Loop. The information you enter there goes to Client Loop and is handled under its own terms and privacy policy. Client Loop may share information about your application with us so we can set up your GracePay account.
We ask you not to include payment information or sensitive family details in website forms.
Information about funeral home customers and staff
- Account information: name, work email address, phone number, role, the locations you can access, and sign-in details such as your password and authenticator app setup. If your organization turns on Google sign-in, we receive your name and email address from Google.
- Business information: legal and trade names, addresses, phone numbers, logos and photos, text message sender name, help contacts, payment and tax settings, and accounting settings.
- Records you create: cases, invoices, line items, payments recorded from other sources, messages and notes.
- Activity records: which user did what and when, such as issuing an invoice or changing a setting. We keep these to secure the service and to show your administrators an audit history.
- Developer information: API key records (a secret key is shown once and is not stored in readable form), allowed host names and webhook settings.
- Connected services: information that flows in or out when your organization connects GracePay to other software, such as case management information received through Client Loop, or QuickBooks for accounting.
Information about families and other payers
- From the funeral home: your name, email address and phone number; the invoice, including the services and goods selected, amounts and due dates; and information about the person who died that the funeral home includes, such as their name and date of death.
- From you on a payment page: the amount you choose to pay, the payment method you choose, contact details you provide for a receipt, and the name and email address of anyone you invite to pay part of the invoice with you.
- From payment processors and lenders: the result of each payment, such as amount, payment method type, status, date and reference numbers, and, if you apply for financing, whether it was approved and the amount financed. See section 5 for what we do not receive.
- About messages: which messages were sent, to which address or number, and delivery results when the email or text provider reports them. When a payment link is opened, we record when it was first and last opened and how many times. We use this to show the funeral home that an invoice has been viewed.
- Your choices: whether you have agreed to receive messages by email or text, and any request to stop them.
Technical information
Like most websites, our servers and our hosting and content delivery providers receive technical information when you visit, such as your IP address, browser type and the pages you request, to deliver pages and to protect the service from abuse. To limit spam, our website forms keep a scrambled (keyed hash) version of your IP address. Each record is set to expire about two hours after the most recent form submission from that address and is then removed automatically. The website form service keeps its operating logs for 14 days, and those logs do not contain what you typed into the form or your IP address.
Cookies and similar technologies
Our marketing website does not set cookies and does not use analytics, advertising or tracking tools. Our signup page loads Client Loop's form, which may use its own cookies or similar technologies under Client Loop's policies.
The GracePay app and payment pages use cookies and similar technologies that are needed for them to work: to keep you signed in, to keep a payment page session open and to protect against forged requests. We do not use them for advertising. Because they are essential, the app does not work without them.
4. How we use information
- To provide GracePay: building and sending invoices, showing payment pages, taking payments through our processor, sending receipts and reminders, and keeping records and reports for funeral homes.
- To set up and secure accounts, including sign-in, two-step verification and audit history.
- To reconcile payments, refunds and returns with what the processor reports, and to tell staff when something needs attention.
- To answer questions sent through our website, set up new customers and respond to developer access requests.
- To send service messages to customers and staff, such as account security notices and notifications they choose.
- To detect, prevent and investigate fraud, abuse and security problems.
- To maintain and improve GracePay, including fixing errors and understanding how features are used.
- To meet legal, tax, accounting and regulatory obligations, and to enforce our agreements.
We use information about families only to provide GracePay to the funeral home that serves them, as described in section 2. We do not use it to market our own products to families.
5. Payments, financing and card information
Online payments are processed by our payment processor, Client Loop, and the banks, card networks and payment partners it works with. Financing is offered by lending partners made available through Client Loop. Each of these companies handles the information you give it under its own terms and privacy policy.
GracePay is designed so that card and bank details are entered directly into the payment processor's or the lender's own forms, not into GracePay, and so that GracePay does not receive full card numbers or card security codes. Lenders, not GracePay, make credit decisions and may check your credit as part of an application.
7. Email and text messages
Funeral homes use GracePay to send families invoices, payment links, receipts, reminders and notices about their account. These are messages about a transaction, sent on the funeral home's behalf, not marketing.
Text messages. If you receive text messages from a funeral home through GracePay, you can reply STOP at any time to stop them, and reply HELP for help. Message frequency varies with your invoice. Message and data rates may apply. We do not share your mobile number or text message consent with third parties for their marketing.
Email. Invoice, receipt and account emails are part of the service. If we send customers or website visitors marketing email, each one will include a way to unsubscribe. You can also ask the funeral home, or us at info@trygracepay.com, to stop messages about an invoice. The funeral home may still contact you in other ways about an amount owed.
8. How long we keep information
We keep personal information for as long as we need it for the purposes in this policy, including to provide GracePay, to keep accurate financial records and to meet legal, tax and accounting requirements. When information is no longer needed, it is deleted or de-identified as the periods below and the customer's agreement provide.
- Financial records (customer, invoice and payment records) are kept for the term of the customer's agreement and afterwards for seven years, unless the law requires otherwise.
- All other personal information is kept for up to five years, unless the law or the customer's agreement requires otherwise. This includes website form submissions, which are delivered to our team's email inbox, and records about families, which also follow the funeral home's agreement with us. Payment links stop working after a set time (currently six months).
- Scrambled IP addresses used to limit form spam are set to expire about two hours after the most recent form submission from that address and are then removed automatically. Website form logs are kept for 14 days.
9. Security
We use administrative, technical and physical safeguards designed to protect personal information. These include encrypted connections (HTTPS), two-step verification for staff accounts, access controls that keep each funeral home's information separate and limit staff to the locations they are given, audit records, and a design that keeps card and bank entry inside the processor's or lender's own forms.
No system is perfectly secure. If you believe your account or information has been compromised, contact us right away at info@trygracepay.com.
10. Your choices and rights
- Funeral home staff can review and update much of their account and business information in the GracePay app, or through their organization's administrator.
- Website visitors can ask us to access, correct or delete the information they sent through our forms.
- Families can ask the funeral home, or us, to correct their contact details or stop messages, as described in section 7.
U.S. state privacy rights
Depending on where you live, state law may give you rights over your personal information, such as the right to know what we collect and how we use it, to get a copy, to correct it, to delete it, and to opt out of its sale, its use for targeted advertising or certain profiling. As described in section 6, we do not sell personal information or use it for targeted advertising.
To make a request, email info@trygracepay.com. We will verify your request using information we already have, and we will respond within the time the law requires. You may use an authorized agent where the law allows. If we deny your request, you may appeal by replying to our decision. We will not treat you differently for using your rights.
If your request concerns information we handle for a funeral home (section 2), we will pass it to that funeral home, or help it respond. Some information must be kept even after a deletion request, for example payment records that funeral homes are required to keep.
11. Children
GracePay is meant for businesses and adults. It is not directed to children, and we do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will take steps to delete it.
Invoices may include information about a person who has died, who may be a child. That information is provided by the funeral home and handled as described in section 2.
12. Other companies' sites and services
GracePay links to and works with services run by other companies, such as Client Loop's signup and payment forms, lenders' financing applications, Google sign-in and QuickBooks. Their own privacy policies govern the information you give them. We are not responsible for their practices.
13. Changes to this policy
We may update this policy as GracePay changes. We will post the new version here and change the "Last updated" date. If we make a material change, we will tell customers by email or in the app before it takes effect.
14. Contact us
Questions or requests about privacy:
- Email: info@trygracepay.com
- Mail: GracePay, Inc., 204 12th St STE 81199, Des Moines, IA 50309