Privacy Policy

Zeitgeist Business Solutions ("ZBS", "the Provider", "we") operates the Mortuary SaaS Platform ("the Platform"). We are a technology company that provides business management software to organizations. We act as a data processor on behalf of our Tenants, who are the data controllers of their clients' personal information.

2.1 Platform Account Data

When a Tenant registers, we collect: business name, email address, phone number, physical address, country, industry type, and payment information. This data is necessary to provide and manage the SaaS subscription.

2.2 User Account Data

For each user within a Tenant organization, we collect: name, email address, role, department, and authentication data (password hashes, login timestamps, IP addresses for security purposes).

2.3 Business Operational Data

The Platform stores data entered by Tenants for their business operations, including but not limited to: client information, service records, financial transactions, invoices, and communications. This data belongs to the Tenant and is processed solely for the purpose of providing the Service.

2.4 Technical Data

We automatically collect: IP addresses, browser type, device information, pages accessed, and interaction patterns for the purposes of security monitoring, error detection, and service improvement.

We use collected data for the following purposes:

• Providing, maintaining, and improving the SaaS Platform
• Processing subscription payments and managing accounts
• Security monitoring, fraud prevention, and abuse detection
• Providing technical support and responding to inquiries
• Complying with legal obligations and law enforcement requests
• Sending service-related communications (maintenance, updates)
• Generating anonymized, aggregated analytics for product improvement

We do NOT use Tenant data for advertising, marketing, or sell data to third parties.

We share data only in the following circumstances:

• With the Tenant's own authorized users within their organization
• With service sub-processors (cloud hosting, payment processing) under strict data processing agreements
• When required by law, court order, or government authority
• To protect the rights, property, or safety of the Provider, Tenants, or the public

The Provider implements the following security measures to protect Tenant data:

• AES-256-GCM encryption for sensitive credentials at rest
• bcrypt (12 rounds) for password hashing
• JWT tokens with HTTP-only, secure, SameSite=strict cookies
• Rate limiting and progressive brute-force lockout on authentication endpoints
• Strict-Transport-Security (HSTS) and X-Frame-Options: DENY on all responses
• Input sanitization against XSS and injection attacks
• Immutable audit logging of all sensitive operations
• Tenant data isolation through session-based access control

Tenant business data is retained for the duration of the active subscription plus thirty (30) days after termination. After this period, all Tenant data is permanently and irreversibly deleted from all systems, including backups. Security audit logs are retained for a maximum of two (2) years. Tenants may request data export at any time during their active subscription.

Each Tenant is responsible for managing data subject rights (access, correction, deletion, portability) with respect to their own clients' data stored in the Platform. The Provider facilitates these rights by providing data export and account deletion functionality. Individuals wishing to exercise data rights should contact the Tenant organization directly, as the Tenant is the data controller.

The Platform uses only essential cookies necessary for authentication (HTTP-only session cookies). We do not use advertising cookies, tracking pixels, or third-party analytics cookies. No data is shared with advertising networks or data brokers.

Data may be processed on servers located in the Caribbean region or other jurisdictions. By using the Service, Tenants consent to the transfer of their data to jurisdictions that may have different data protection laws. The Provider uses appropriate safeguards for international data transfers.

Data Protection Officer
Zeitgeist Business Solutions
Port of Spain, Trinidad and Tobago
Email: privacy@mortuary.saas