Privacy Policy

1. Introduction

At SendLove, we respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and protect your data when you use our virtual gift platform.

2. Information We Collect

We collect the following types of information:

3. How We Use Your Information

We use your information to:

• Provide and improve our virtual gift services
• Process payments and deliver your digital gifts
• Send you important updates about your account and purchases
• Respond to your inquiries and provide customer support
• Ensure the security and functionality of our platform
• Comply with legal obligations

4. Data Storage and Security

Your data is stored securely using:

• Supabase: For user accounts and gift data storage
• Stripe: For secure payment processing
• Resend: For email delivery services

We implement industry-standard security measures to protect your data, including encryption, secure connections (HTTPS), and access controls. However, no method of transmission over the internet is 100% secure.

5. Photos and Media Retention

Photos you upload — notebook images, album pages, puzzle pictures and profile pictures — are stored in Supabase Storage. We keep them only for as long as they are part of something you sent:

• While a gift exists: Photos attached to a gift are kept for as long as that gift exists, so the person you sent it to can open the link years later. We do not delete paid gifts on a timer.
• When you delete a gift: Deleting a gift from your account removes its photo files from storage.
• When you delete your account: Deleting your account removes your photo files from storage along with your profile.
• Uploads you never used: Uploads that are not attached to a gift may be removed.

Deletion from storage is permanent and cannot be undone. Copies already downloaded or screenshotted by a recipient are outside our control.

6. Data Sharing

We do not sell personal information. We share data only with the service providers and optional third parties listed in section 11, and only to operate SendLove.

7. Your Rights

You have the right to:

• Access your personal information
• Have inaccurate personal information rectified
• Request deletion as described in section 13
• Withdraw your consent at any time, including with the Cookie settings button or link
• Request portability under Law 25: a copy of your personal information in a structured, commonly used technological format, or its transfer to another organization

To exercise a right, email sendlovevirtually@gmail.com. We will answer within 30 days and may verify your identity.

8. Cookies and Tracking

Optional services run only after you select Accept: Google Analytics 4; Vercel Web Analytics; HeyCatch; Meta Pixel and TikTok Pixel when enabled; our page-view, blog-view, card-view, and performance measurements; Google Fonts; and the Giphy image inside the Memory Notebook gift, loaded from Giphy's servers. These analytics and third parties may receive your IP address. One exception: when a gift includes a song chosen by its sender, the song plays through YouTube's privacy-enhanced player (youtube-nocookie.com) or Spotify's player when the gift is opened, whether or not you select Accept. YouTube or Spotify may then receive your IP address and store data in your browser. Gifts without a song never load these players. When you open a gift someone sent you, we also count that visit in our own statistics (the kind of gift page, the time, the referring site and your browser type), without cookies and without storing anything in your browser, whether or not you select Accept.

With your analytics consent, HeyCatch measures visits and interactions and can associate them with your account ID, email, name and account creation date when you are signed in. It also records completed email confirmations and payments. Gift text and clicked text are excluded, and private gift links are redacted. Payment reporting uses your consent choice when you start checkout.

Services necessary to operate SendLove always run: sign-in and storage provided by Supabase, payments provided by Stripe, your language preference, the anonymous guest session ID used for gift ownership, and your saved cookie choice.

Reject is the default, applies to visitors everywhere, and does not affect site features. Your choice is stored on this device as sl_consent_v1 for 12 months. You can withdraw consent with the Cookie settings button or link; withdrawal deletes Google, Meta, and TikTok analytics cookies and reloads the page. For privacy questions or to access, correct, or delete your data, contact sendlovevirtually@gmail.com.

9. Children's Privacy

SendLove is not intended for children under 14, and we do not knowingly collect their personal information. A parent who thinks a child provided information should contact us at sendlovevirtually@gmail.com; we will delete it.

10. Data Controller and Privacy Officer (Law 25)

SendLove is operated from Quebec, Canada, under the laws of Quebec, including Quebec's private-sector privacy Act as amended by Law 25. The organization responsible for the personal information described here is the operator of SendLove.

• Data controller: SendLove
• Privacy contact: sendlovevirtually@gmail.com
• Jurisdiction: Québec, Canada

The owner of SendLove is the person responsible for personal information under Law 25. Send requests, questions, and complaints to sendlovevirtually@gmail.com.

11. Service Providers and Third Parties

We use the following providers to operate SendLove:

• Supabase: Database, sign-in with email and password, and photo storage.
• Stripe: Hosted checkout. Card details go to Stripe and are never stored by us. We keep the gift ID, amount, currency, status, the buyer's country, and Stripe references. Gift content (names, message, and other gift details) is also copied into Stripe metadata. These metadata also include your account user ID (ownerUserId), used to link the payment to your account. For a Date Invite, they can also include the guest email address, if entered, and your verified account email. See https://stripe.com/privacy.
• Resend: Transactional email.
• Railway: Hosts our backend API.
• Vercel: Hosts the website.
• Google and Discord: Sign-in, only if you choose to sign in with them. Google also hosts the Gmail mailbox that receives contact and feedback messages.

Optional services run only after you select Accept in the cookie banner (see section 8): Google Analytics 4; Vercel Web Analytics; HeyCatch; Meta Pixel and TikTok Pixel when enabled; our own page, blog, card, and performance measurements; Google Fonts; and the Giphy image inside the Memory Notebook gift. A song added to a gift by its sender plays through YouTube or Spotify when the gift is opened, even without Accept (see section 8).

12. Personal Information We Collect, Why, and Your Consent

We collect and use the following personal information for the stated purposes:

• Account: Email, name, optional bio, phone, location and profile picture, sign-in method, and last login, to create and manage your account.
• Gifts you create: Recipient and sender names, a personal message, photos, and other gift content, to create and deliver the gift.
• Date Invite: An optional guest email address entered by the sender when creating the invite; the sender's verified account email; and the answers the guest gives (date, time, option, place, optional note). They are used to deliver the reply and send the date-chosen emails. An email typed by the person answering is ignored. The guest email address is not used for marketing and is not added to any list.
• Purchases: Gift ID, amount, currency, status, Stripe references, the buyer email address from the Stripe checkout session, and the buyer's country (from the billing address or, when available, the card), to process purchases, send the confirmation email, and keep tax, refund, and accounting records. The country stays with the payment record, including after account deletion. We do not receive or store card numbers.
• Messages to us: Name, email, subject, and message, to respond to you.
• Technical data: Language preference; an anonymous guest session ID stored on your device so guest gifts stay yours; and request data needed to operate and protect the service. Your IP address is used briefly to limit abuse and is not stored in our application tables; our authentication and hosting providers may log it.
• Optional analytics: Only after Accept: page paths, referrer, campaign parameters, browser user agent, performance measurements, and a session ID, to understand and improve use and performance. Without Accept, opening a gift only adds to an anonymous view counter; no session ID, user agent, or referring page is stored.

Optional items require your consent. Reject is the default.

13. Retention and Deletion

Photos and uploads not attached to a gift follow section 5. Paid gifts are not deleted on a timer. Deleting a gift removes its photo files and it stops being available. Text content of deleted gifts may remain in our database but is no longer served. Deleting your account, through the Account page or by email to sendlovevirtually@gmail.com, removes your photo files, favorites, account tokens, profile, and sign-in account; your gifts are marked deleted and are no longer served. Payment records are not deleted with the account. Your cookie choice is kept for 12 months. Contact messages, gift view records, and blog view records are not deleted automatically: we keep them as long as needed for their purpose, and there is no fixed number of days. Other analytics data is kept only as long as needed for the purposes in this policy. To have personal information in these records deleted, email sendlovevirtually@gmail.com.

14. Transfers Outside Quebec

Providers may store or process data outside Quebec and Canada, for example in the United States. We choose providers carefully and will provide more information on request.

15. Emails We Send

We send service emails only: account confirmation; password reset links; password and email change verification; purchase and gift-ready confirmations to the buyer; Date Invite date-chosen emails; and replies to your messages. We do not send marketing or newsletter email. We do not send gift links to recipients; the buyer shares the link. For a Date Invite, when the guest answers we send a date-chosen email, with a calendar file, to the guest email address the sender entered when creating the invite (if any) and to the sender's verified account email. A recipient can receive email from us only if the sender entered that address. An email typed by the person answering is ignored. We use the guest email address only for that date-chosen email, never for marketing, and we do not add it to any list. It is kept with the invitation in our database, as described in section 13. If you have an account, we may also email you about significant changes to these policies.

16. Complaints

Contact us first at sendlovevirtually@gmail.com. You may also complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) and the Office of the Privacy Commissioner of Canada (priv.gc.ca).

17. Changes to Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our website. Your continued use of our service after changes constitutes acceptance of the updated policy.

18. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at sendlovevirtually@gmail.com