Privacy Policy
in plain English first.

Seven Generations Labs LLC, the company behind 7gens, a New Mexico limited liability company, is the business responsible for the personal information you provide (the "controller"). We process it in accordance with applicable U.S. federal and state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and, where it applies to you, other applicable data-protection law. You can reach us about any privacy matter at privacy@7gens.me.

We collect: (i) account data (name, email, authentication identifiers); (ii) billing data (processed by Stripe; we never store full card numbers); (iii) family material you upload (photographs, documents, audio, transcripts, names, dates, places, correspondence); (iv) material generated for you (AI drafts, citations, research notes); (v) workshop and security logs (edits, agent invocations, IP address, device and session data); (vi) how you found us (the campaign link or website that referred you, the page you landed on and your device type); and (vii) as you allow, analytics and advertising-measurement data (pages viewed, key steps such as sign-up and purchase, and the identifiers set by those tools). We do not buy personal data from data brokers. If, before creating an account, you ask us to email you a link to continue on another device, the sample book, or reminders before the holiday order-by dates, we also collect (viii) your email address, language, time zone and how you found us. Your cookie choices are never carried to the other device: each browser asks you for them itself. If you share a family archive or are invited to one, we also collect (ix) the email addresses an archive owner gives us to invite people, with each invitation's role, message, sender and status; membership records — your role, who invited you, when you joined, the person in the family tree linked to you and the version of our Terms of Service you accepted; the contributions members send; and a record of who in the archive added, changed, approved or shared what, and who started each action charged to the owner (see “Shared family archives”). If you ask for a Studio demo, we collect (x) your name, your agency's name, your email address, your website, roughly how many books a year you make, any message you write and how you reached the form; if you subscribe to Studio, (xi) the business name, billing address and tax identification number you enter at checkout — collected and held by Stripe and shown on your invoices — and the imprint you set (a name, a mark, a place, a website and a logo); and (xii) the messages you send us through Studio's direct line.

Genealogical material can reveal information treated as sensitive or special-category under some laws, including racial or ethnic origin, religious belief, health, and data about family relationships. You decide what to upload. Where the law requires consent for sensitive information about you, your upload of it together with your acceptance of this policy constitutes that consent, which you may withdraw by deleting the material or closing your account. For sensitive material about living relatives or other third parties, you confirm that you have a lawful basis, or any consent the law requires, to upload it and have us process it.

We process personal information to: (a) provide the Service and produce your book (performance of our contract with you); (b) take payment and prevent fraud; (c) provide support and service communications; (d) secure and improve the Service (our legitimate interest in a safe, working product); (e) comply with legal, tax, and accounting obligations; (f) with your consent — or, in the United States, unless you opt out — measure how the Service is used and whether our advertising works (see “Analytics and advertising measurement”); and (g) understand, from the first-party record of how you arrived, which of our campaigns bring people to 7gens (our legitimate interest in knowing what our marketing achieves). Where consent is the lawful basis, you may withdraw it at any time. We also (h) email you the link to continue on another device when you ask for it; and (i) with your consent, confirmed by email for requests made before you have an account, send you reminders before the holiday order-by dates, a note when a draft of your book is waiting or an order was left unfinished, and occasional offers — at most one such email a day and three a week, never at night in your time zone, each with a one-click unsubscribe. We also (j) answer Studio demo requests and messages sent through Studio's direct line, and print your imprint on your books (steps taken at your request before entering into a contract, performance of our contract with you, and our legitimate interest in answering business enquiries).

We will not (a) sell or rent your personal information for money; (b) use your family material as training data for any machine-learning or foundation model, our own or a provider's; (c) disclose your family material — uploads, trees, documents, drafts, or books — to advertising networks; (d) grant other 7gens customers or unrelated third parties access to your material, except as you direct — such as the people you invite to your family archive (see “Shared family archives”) or the QR code beside a recording printed in your book (see “Recordings printed in your book”). The limited measurement data described in “Analytics and advertising measurement” is shared only as you allow there.

With your consent — or, for visitors in the United States, unless they opt out where US law permits — we use analytics (Amplitude and Google Analytics) and advertising measurement (the Meta Pixel and Conversions API, and Google Ads). These receive on-site events such as page views, a completed registration, a started checkout, or a purchase and its value; identifiers such as cookie IDs and device and browser data; and, for measurement sent from our server, a one-way hash of your email address (Meta only) and an internal account identifier. Meta and Google may use this data under their own terms, including to measure and improve the delivery of ads, and US state privacy laws may treat this as a “sale” or “sharing” of personal information. We never share your family material for these purposes. Details, including the cookies involved, are in our Cookie Notice. The Russian service at 7gens.ru does not use these tools.

To research, draft, translate, and fact-check your book we send relevant material to AI providers acting as our processors under terms that prohibit using your content to train their models: currently Google, for Gemini models, and TypeSafe AI, for the Jev decision model, which receives short text excerpts from your tree (for example, a sentence and a fact to compare) to check facts and match records. AI output can be incomplete or wrong and is reviewed before it becomes part of your book. See our AI & Data Processing notice for detail.

We share personal information with sub-processors who help us operate the Service, each bound by a data-processing agreement: Stripe (payments), Google including Google Cloud and Gemini (hosting, storage, and AI processing), TypeSafe AI (fact checking), Resend (transactional email), and Lulu (print fulfilment and shipping). Only as described in “Analytics and advertising measurement”, we also share limited data with Amplitude (product analytics), Google (Analytics and Ads) and Meta (Pixel and Conversions API). To produce genealogical research we may also query third-party archives and genealogy databases (such as FamilySearch, WikiTree, and Wikidata). Our current list is at /en/legal/subprocessors. Within a family archive, its owner and the members they invite see its content as their roles allow (see “Shared family archives”). A Studio demo request, and a message sent through Studio's direct line, reach our own inbox by email through Resend; the alert our team receives about each carries no personal data.

Seven Generations Labs LLC is organized in the State of New Mexico, USA; our operations may be located in Israel and other countries. Our providers may process personal information in the United States and other countries. Where personal information is transferred from a region with data-export rules (such as the EEA, the UK, or Israel), we rely on recognised transfer mechanisms (such as Standard Contractual Clauses) or another lawful basis.

Genealogical material necessarily concerns people other than you, including living relatives and third parties. You confirm that you have a lawful basis to upload it and to have us process it, and that you have obtained any consent required by applicable law (for example, from living relatives). If someone asks us to remove information about them, contact us at privacy@7gens.me and we will act on valid requests.

Where your book reproduces a voice recording made or uploaded in the Service — by you or by a member of your archive (see “Shared family archives”) — and approved for your book, the printed page carries a QR code that opens a page on our website playing that recording. The code contains a random identifier that cannot practically be guessed; the page is not linked from anywhere else, is excluded from search engines, and shows only that recording together with the names of the people it concerns, the date it was recorded and its length — what the printed page already shows. Anyone who has the book, or a copy or photograph of the code, can use it, so share a book that prints recordings as you would share the recordings themselves. You decide which recordings your book prints, and you can switch a code off at any time by deleting the recording, setting it to “Ignored”, or closing your account; copies already printed cannot be recalled. Codes never appear on the public sample pages of our website. As for all material about other people, you confirm that you have any consent the law requires from each person whose voice or words the recording contains.

An archive's owner — the account that created it, or to which it was transferred — can invite people to it for free: by email, in any role, or with a shareable link, as a contributor or reader only. An editor helps the owner run the archive and its books and sees all of it, including members' names and roles but not their email addresses, which only the owner sees. A contributor adds photographs, voice recordings and written memories, suggests captions and answers the owner's questions. A reader reads the books the owner shares with members — sharing a book is the owner's decision alone, and a shared book is shown in full, including what it says about living relatives (the owner is told how many it names and confirms before sharing). Contributors and readers read those books only inside the Service, as preview pages, with no download and no link that can be passed on, and see the family tree and the archive's photographs — not its documents, recordings or scans, and never a photograph's location data, the text recognised in it or AI suggestions about it. Book pages shown to anyone but the owner carry that person's email address and the date. People who may be living — with no recorded death, and born within the last 110 years or on an unknown date — appear to contributors and readers with their names and relationships but without dates, places, maiden names, notes or life events, unless the owner lets that member see living people's details; a member always sees their own entry in the tree once the owner has confirmed it, and people who have died are shown in full. Contributions are held apart until the owner or an editor approves them: until then only the contributor, the owner and editors can see them, nothing reaches the archive or a book, and a voice recording is transcribed only after approval. We remove location data (GPS and similar metadata) from contributed photographs on upload, and contributors and readers are shown only copies of the archive's photographs without location data. The owner and editors see each contributor's name beside what they added. Approved contributions become part of the owner's archive and may be used in the owner's books — including a voice recording, which a printed book may play through the QR code described in “Recordings printed in your book”. They stay when the contributor leaves; if the contributor deletes their account they stay, shown as added by a former member instead of by name; and they are deleted with the archive. Invitations are emailed on the owner's behalf, naming the owner; any message the owner adds is shown only on the invitation page, once its link is opened. We send at most fifty (50) invitation emails a day for each owner and three (3) a day to any one address, and never write to an address that has bounced, reported our email as spam or asked, through the link in every invitation email, never to receive invitations. An invitation, and a shareable link, expire after thirty (30) days; a link lets up to ten (10) people join — whoever holds it — until it expires, is replaced (as it is when a member who joined by it is removed) or is revoked. The invitee's email address and the invitation are kept until ninety (90) days after the invitation ends, and are then deleted (see “How long we keep it”). We email members about their archive — for example, when a book is shared with them or the archive closes — and the owner and editors about new contributions, emails they can switch off. If the owner deletes the archive or closes their account, the archive closes for its members, who are told by email, and contributions awaiting approval are deleted. If the owner transfers the archive to a member, the new owner has the owner's access, including members' email addresses, and what the previous owner added is labelled with their name. We process this information to provide the shared archive the owner asks for and to perform our contract with each member; an invitee's address is used only to deliver and manage their invitation, never for marketing. The owner chooses whom to invite and what to share, and confirms that they have a lawful basis, or any consent the law requires, to share information about living relatives (see “Material about other people”).

The Service is not directed to children, and you must be an adult to create an account. You may upload material concerning minors only where you are a parent or guardian, or otherwise have a lawful basis to do so. We do not knowingly collect personal information directly from children under 13 (or the minimum age in your jurisdiction).

We retain account and family material while your account is active. On closure, personal data is deleted within thirty (30) days, except: tax and accounting records (retained up to seven (7) years as required by applicable law); security and audit logs (limited periods); and backups (purged on their normal cycle). A deletion certificate is issued by email. For requests made without an account: the email carrying a link to another device is deleted thirty (30) days after it is sent and the request itself (which holds no plaintext address) after ninety (90) days unless an account was created from it; a reminder request that is never confirmed is deleted thirty (30) days after the last request, and one you unsubscribe from thirty (30) days after you unsubscribe, keeping only a one-way fingerprint (hash) of the address so that we never write to it again. In a shared family archive: an invitation — the invitee's email address, the role offered, any message, who sent it and its status — is deleted ninety (90) days after it ends by being accepted, declined, revoked or expiring, by which time our log of the emails sent for it has been deleted too; a membership is kept until the member leaves, is removed or closes their account, or the archive is deleted; a declined or withdrawn contribution has its files deleted at once and the rest of its record, which keeps its status visible, after ninety (90) days; and approved contributions are kept and deleted with the archive they became part of. A Studio demo request is deleted twenty-four (24) months after it was last updated, and our log of its acknowledgement email after thirty (30) days; the requests a person made are also deleted with their account. A message sent through Studio's direct line is not stored in the Service: it is emailed to our inbox and kept there as business correspondence. Business billing details are kept by Stripe and in our tax and accounting records as long as the law requires. Your imprint is kept while your account is open, also after your Studio plan ends, and is deleted with your account.

We use encryption in transit and at rest, access controls, and staff access limited to those who need it. No system is perfectly secure. If a breach affects your personal information we will notify you and the relevant authorities where the law requires, and we will notify any affected provider (such as Stripe) as required by our agreements.

You control optional analytics and advertising measurement through “Cookie preferences” at the foot of every page and in your account settings; you can change your choice at any time, and withdrawing consent does not affect processing that took place before. Visitors in the United States can also use the “Do Not Sell or Share My Personal Information” link, which switches advertising measurement off immediately in that browser and, if you are signed in, on your account; we also treat a Global Privacy Control signal from your browser as a valid opt-out of sale and sharing. You can also opt out by writing to privacy@7gens.me. We do not charge more or provide a lesser service to anyone who opts out. Every reminder or offer email carries a one-click unsubscribe link, and you can switch these emails on or off at any time under Email settings in your account; unsubscribing never affects emails about your own orders and account.

Under the CCPA/CPRA you have the right to know, access, correct, delete, and port your personal information, and to opt out of its sale or sharing; we do not discriminate against you for exercising them. Where other laws apply, you may also have rights to object, restrict, or withdraw consent. If you are invited to a family archive, you can decline from the link in the invitation, without an account, or ask us to delete your email address. A member can leave an archive at any time, and a contributor can withdraw a contribution while it awaits approval; once approved, it is part of the owner's archive, so ask the owner to remove it, or write to us. Anyone whose information appears in an archive can contact us, and we will act on valid requests. Write to privacy@7gens.me; we respond within forty-five (45) days. You may complain to the California Privacy Protection Agency, your state attorney general, or your local supervisory authority.