Privacy Policy

Last updated: August 13, 2026

1. Introduction

Petra, owned and operated by LarkTek, LLC ("we," "our," or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our monument and vault operations software platform (the "Service").

We are a data processor. Monument and vault businesses that subscribe to Petra collect and control the information they enter and that they collect from their customers. We process and store that information on their behalf to provide the Service. Those businesses remain responsible for it. See Section 3.

By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Personal Information

We may collect the following types of personal information:

  • Name, email address, and contact information
  • Business information (company name, address, license numbers)
  • Payment and billing information
  • Account credentials and preferences

2.2 Operations Data

As a monument and vault operations platform serving funeral homes and cemeteries, we process data including:

  • Customer, purchaser, and contact information
  • Order, production, inventory, and delivery records
  • Cemetery, location, and plot-related information entered by your business
  • Financial and payment records
  • Documentation and records
  • Media files, photographs, monument inscriptions, and design content

2.3 Technical Information

We automatically collect certain technical information:

  • IP addresses and device information
  • Browser type and version
  • Usage patterns and analytics data
  • Cookies and similar tracking technologies
  • AI-powered feature usage statistics and token consumption

3. When You Interact with a Business Using Petra

We are a data processor. Petra is software that monument and vault businesses subscribe to. Those businesses own and control the information they collect and enter into the Service, including information about their customers, orders, and related contacts. We process and store that information on their behalf, as their service provider, solely to provide the Service. We do not decide why they collect it or how they use it with the people they serve.

The monument or vault business is responsible. Each subscribing monument or vault business (or other business using Petra) remains solely responsible for that information, including obtaining any required consents, the accuracy and lawfulness of what they enter, their notices to customers, and responding to privacy requests from the people they serve. Our customer agreements confirm that the customer retains ownership of that data and sole responsibility for it, and that we use it to process and store it in order to provide the Service.

If you are a customer of a business using Petra, contact that funeral home, cemetery, or monument or vault business about how they collect, use, or share your information—including that business's own privacy policy. We generally cannot handle those requests ourselves except as that business instructs us or as the law requires. Each account may have its own privacy policy and terms and conditions governing the data they collect from you.

4. How We Use Your Information

We use information we collect about you (such as staff account details) and information we process on behalf of subscribing businesses for the following purposes:

  • Providing and maintaining our Service
  • Processing monument, vault, and related orders and services on behalf of subscribing businesses
  • Managing user accounts and authentication
  • Processing payments and billing
  • Communicating with you about our Service
  • Improving our Service and developing new features
  • Complying with legal obligations
  • Protecting against fraud and security threats
  • Providing AI-powered features, including monument design, inscription drafting, production assistance, and reporting tools

5. Google User Data

When Google Calendar or Gmail OAuth features are enabled, our Service may integrate with Google APIs to provide those features. This section describes how we access, use, store, and share Google user data obtained through Google OAuth authorization when those features are enabled.

5.1 What Google User Data We Access

With your explicit consent, and only when those features are enabled, we may request access to the following Google user data:

  • Google Calendar (read-only): Calendar event data, including event titles, dates, times, and descriptions, to display your calendar events within the Petra platform.
  • Gmail (send only): The ability to send emails on your behalf from your connected Gmail or Google Workspace email address. We do not read, scan, or access the contents of your inbox or existing emails.
  • Basic Profile Information: Your Google account name and email address, used solely to identify your connected account within the Service.

5.2 How We Use Google User Data

Google user data is used exclusively to provide and improve the specific user-facing features described above:

  • Calendar data is used only to display and synchronize your calendar events within the Petra platform's calendar feature.
  • Gmail send access is used only to send emails that you explicitly compose and initiate through the Service on behalf of your business location.
  • Profile information is used only to display which Google account is connected and to facilitate the OAuth authorization flow.

5.3 Prohibited Uses of Google User Data

We do not use Google user data for any purpose other than providing or improving the user-facing features described above. Specifically, we do not:

  • Use Google user data for advertising, including retargeting, personalized advertising, or interest-based advertising
  • Transfer or sell Google user data to third parties for advertising purposes
  • Use Google user data to train artificial intelligence or machine learning models (including our AI-powered design and document features)
  • Use Google user data for creditworthiness assessments or lending purposes
  • Use Google user data to build user profiles for purposes unrelated to the application's functionality
  • Share Google user data with third parties except as necessary to provide the Service, comply with applicable laws, or as part of a merger/acquisition with adequate data protection obligations

5.4 Google User Data Storage and Security

Google OAuth tokens (access and refresh tokens) are stored encrypted at rest using industry-standard encryption. We retain Google user data only for as long as necessary to provide the connected features. You may disconnect your Google account at any time through the Service, which will revoke our access and delete stored tokens.

5.5 Google API Services User Data Policy Compliance

Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Information Sharing and Disclosure

We do not sell your personal information. We do not share personal information for cross-context behavioral advertising. We may disclose information to the following categories of recipients, who process it as our service providers (or, where you enable an integration, as processors for your business) only as needed to operate, secure, and provide the Service:

  • Cloud infrastructure and hosting providers in the United States and, for some accounts, Canada
  • Payment processors for charges, refunds, and related billing
  • Electronic signature providers when you send documents for signature
  • Communications providers for email, SMS/MMS, and voice delivery
  • Maps and address-lookup providers when you use location features
  • Accounting and other business integrations that you choose to connect
  • Enterprise AI providers when you use AI-powered features (see Section 6.5)
  • Professional advisors under confidentiality obligations, when reasonably necessary

We may also disclose information when required by law, to protect our rights or users, in connection with a merger, acquisition, or sale of assets, or with your consent. We require service providers by contract to use personal information only to provide services to us (or to you), and not for their own independent marketing.

6.5. AI-Powered Features and Third-Party AI Service Providers

The Service includes optional AI-powered features. When you use them, content you submit may be sent to third-party enterprise AI providers over private, enterprise connections (not consumer chat products) so they can generate output for that feature. The providers and models we use may change over time. Features may include monument design, inscription drafting, production assistance, reporting, summaries, and data insights.

Important Distinction: Google user data obtained through OAuth authorization (such as Calendar events, Gmail access, and profile information described in Section 5) is never sent to AI providers or used for AI/ML processing.

Data Sharing with AI Service Providers: When you use AI-powered features, certain information you provide may be shared with third-party AI service providers to generate output. This includes:

  • Document dimensions and layout specifications
  • Monument inscription and memorial design content (names, dates, epitaphs, and related text) that you choose to include in designs or documents
  • Photographs of memorials or of the deceased that you select for inclusion in designs
  • Design preferences, instructions, and iteration requests
  • Content placeholders and field mappings
  • Prompts or instructions used for document drafting, reporting, summaries, or data insights

PII Protection Measures: We implement technical safeguards and automated processes designed to prevent sensitive personally identifiable information (PII) from being shared with third-party AI service providers, including:

  • Automated redaction of living persons' personal information (names, addresses, phone numbers, email addresses)
  • Filtering of Social Security Numbers, credit card numbers, bank account numbers, and other highly sensitive identifiers
  • Removal of passwords, authentication credentials, and security tokens
  • Content sanitization processes before data is sent to AI service providers

Your Responsibility: Despite our safeguards, you are ultimately responsible for ensuring that you do not include sensitive PII in content submitted to AI-powered features. You acknowledge and agree that:

  • You must not include Social Security Numbers, credit card numbers, bank account numbers, passwords, or other highly sensitive information in any prompts, inputs, or content provided to AI features
  • You must not include living persons' personal information unless you have obtained proper consent and authorization
  • You are responsible for reviewing all content before submitting it to AI features to ensure it does not contain sensitive information
  • Our automated safeguards may not catch all instances of sensitive information, and you bear the ultimate responsibility for protecting sensitive data
  • You understand that monument inscription content, memorial design text, and photographs of memorials or of the deceased may be shared with AI service providers as this information is typically appropriate for monument and memorial design work

How AI providers handle this information: We access these providers under enterprise agreements and data-processing terms, not consumer chat terms. Where those agreements so provide, customer content is not used to train public foundation models. You should not submit information you do not want processed by those providers. An example of enterprise processing terms is the Google Cloud Data Processing Addendum.

Usage tracking: We may keep records of AI feature use (such as volume and associated cost) for billing, accounting, and operating the Service. We do not use AI to make solely automated decisions that produce legal or similarly significant effects about individuals.

Internal development: Tools our staff use internally to build and maintain the Service do not receive your customers' personal information.

No Guarantee of Data Protection: While we implement safeguards to protect sensitive information, you acknowledge that:

  • No method of data transmission or processing is 100% secure
  • We cannot guarantee that all sensitive information will be prevented from being shared with AI service providers
  • You use AI-powered features at your own risk regarding data privacy and protection
  • You should exercise caution and good judgment when deciding what information to include in AI feature inputs

Opt-Out: You may choose not to use AI-powered features if you have concerns about data sharing with third-party AI service providers. Use of AI-powered features is optional, and you can perform tasks using other tools and methods available in the Service.

6.6. SMS / MMS Text Messaging and Mobile Numbers

Funeral homes, cemeteries, and monument and vault businesses using Petra may send customer-care SMS and/or MMS (text and multimedia) messages to customers and contacts who have opted in. This section describes how mobile numbers collected for SMS/MMS are handled.

  • Consent required: SMS/MMS messages are sent only after the recipient opts in (for example, by checking an SMS consent box on a website or portal form, giving verbal or written consent that staff record in Petra, or texting an opt-in keyword such as START). Consent checkboxes are unchecked by default.
  • Message types and frequency: Messages are customer-care / account-related (order updates, appointment and delivery reminders, portal or document notices, payment notices, media such as photos or documents when sent as MMS, and two-way replies to inbound texts). Message frequency varies.
  • Message and data rates may apply. Carrier charges may apply to the recipient for SMS and MMS.
  • No sharing of mobile numbers for marketing: Mobile phone numbers collected for SMS/MMS are not shared with third parties or affiliates for marketing or promotional purposes. Numbers may be processed by our messaging delivery provider solely to transmit messages you or your business have authorized.
  • Opt-out: Recipients may reply STOP at any time to opt out of SMS/MMS. Reply HELP for help. Opt-out is honored for that messaging number.

7. Data Security

We implement appropriate technical and organizational measures to protect your information:

  • Encryption of data in transit and sensitive data at rest
  • Regular security assessments and updates
  • Access controls and authentication
  • Employee training on data protection
  • Incident response procedures
  • PII redaction processes for AI feature inputs

Important Disclaimer: While we strive to maintain the highest standards of data security and protection, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your information, and you acknowledge and agree that you transmit information to us at your own risk.

8. Data Retention

We retain information while your account is active and as needed to provide the Service, meet legal and recordkeeping requirements, resolve disputes, enforce agreements, and maintain security. Different categories of information may be kept for different periods. When we no longer need information, we delete or de-identify it, except where a longer period is required by law. AI usage and billing records, when applicable, are kept for accounting and operating the Service.

9. Your Rights

We serve customers in the United States and Canada. Depending on your location, you may have rights under applicable privacy law, including to:

  • Access your personal information
  • Correct inaccurate information
  • Delete your information, where the law provides
  • Receive a copy of your information, where the law provides
  • Withdraw consent, where processing is based on consent

If you are in California, you may have additional rights under the CCPA/CPRA, including to know, delete, and correct personal information, and to opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes other than those permitted to provide the Service.

If you are in Canada, you may have rights under PIPEDA and applicable provincial privacy laws, including access and correction.

To exercise these rights, contact us as described in Section 15. We will verify requests as required by law. Authorized agents may submit requests where the law allows. We will not discriminate against you for exercising your rights. Customers of a funeral home, cemetery, or other business using Petra should contact that business (see Section 3).

Note: If information was sent to an AI provider through a feature you used, we may not be able to retrieve or delete it from that provider's systems, as it is subject to their own retention and deletion practices.

10. Cookies and Tracking

We use cookies and similar technologies on our marketing website:

  • Strictly necessary — first-party cookies that keep the site working and remember your cookie choice. Always on.
  • Analytics and advertising — optional technologies (including Google Ads / Consent Mode) that help us measure site use and marketing performance. These load only after you choose to accept them.

When you first visit, a cookie banner lets you accept or decline optional technologies. You can change or withdraw your choice at any time using the Cookie Preferences link in the site footer, or through your browser preferences.

Until you accept optional technologies, advertising and analytics tags are not loaded. If you decline, those tags remain unloaded.

11. Third-Party Services

The categories of service providers described in Section 6 have their own privacy policies. When you use a feature that relies on a provider, information is handled according to that provider's terms and our contract with them.

12. Where Information Is Processed

We serve customers in the United States and Canada. Information may be stored in the United States and, for some accounts, in Canada. The service providers described in Section 6 may process information in those countries and, where needed to provide the Service, elsewhere, using contractual and other safeguards designed to provide a comparable level of protection.

13. Children's Privacy

Our Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. We do not sell or share personal information of consumers we know are under 16.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

15. Contact Us

Privacy inquiries, including requests to exercise your rights, may be sent to the Privacy Officer at LarkTek, LLC:

Email: support@larktek.com