Privacy Policy — Hey Love Letters

1. Who we are

Hey Love Letters is an online service for creating personalized digital cards, operated by an individual based in Brazil under the brand name Hey Love Letters. The same operator also runs the Portuguese-language version of the service in Brazil under the brand name Love Cards (lovecards.com.br). Hey Love Letters is the controller of the personal information described in this policy, which applies to the English version of the site. Because Hey Love Letters is operated from Brazil, our handling of personal information is governed by the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, "LGPD" — Law No. 13,709/2018) for all users, wherever they live. Questions: support@heyloveletters.com.

2. Data Protection Officer (DPO)

Pursuant to Article 41 of the LGPD, the channel for contacting our Data Protection Officer is support@heyloveletters.com. Use this channel for any question about your personal information or to exercise the rights described in sections 12 and 13.

3. Information we collect

Account information: name, email address and password (stored only as a cryptographic hash). If you sign in with Google, we receive the name and email address provided by Google.
Profile information: a profile photo, if you choose to upload one.
Card content: the text, names, dates, photos and other material you add to your cards, and the songs you choose. When you search for a song, your search term is sent to YouTube to return results, and the card stores a link to the selected video.
Purchase information: the plan purchased, amount, currency, date and payment status. Payments on the English site are processed by Stripe on its own hosted checkout page. Stripe collects your name, email address, card details and billing information (such as country and ZIP code). We never receive or store your full card number. From Stripe we receive only the information we need to confirm and manage the purchase, such as the payment status, amount and transaction identifiers.
Communications: the content of emails you send us (for example, support or refund requests).
Usage and device information: pages visited, device and browser type, approximate location derived from your IP address, time on site and how you arrived at the site (referring website and campaign parameters), collected through Google Analytics and our own cookie described in section 7. Our servers also process technical data such as your IP address to deliver the site and protect it against abuse.

4. How we use your information

To create and maintain your account and your cards, and to show your cards to the people you share their link or QR code with.
To process payments, unlock the features you purchased and handle refunds and payment disputes.
To send transactional emails (such as purchase confirmations and password resets).
To send operational emails about a purchase in progress (for example, a reminder about a checkout that was started but not completed). These are sent while a payment is pending, regardless of the preferences below.
To send usage tips and product news, unless you turn this option off in Settings.
To moderate uploaded images automatically and enforce our Terms of Use.
To keep the service secure, prevent fraud and abuse, and fix errors.
To understand, in aggregate, how the site is used and improve it.
To comply with legal obligations and respond to lawful requests from authorities.

We do not use your information for automated decisions that produce legal or similarly significant effects on you.

5. Legal bases for processing (LGPD)

Performance of a contract (LGPD Art. 7, V): to provide your account, your cards, the features you purchased and related transactional emails.
Legitimate interests (LGPD Art. 7, IX): for analytics, security, fraud prevention, image moderation, reminders about pending checkouts and usage tips and product news, always respecting your rights and your choice to opt out.
Compliance with legal obligations (LGPD Art. 7, II): for example, keeping sales records required by Brazilian tax law.
Exercise of rights in legal proceedings (LGPD Art. 7, VI): for example, to respond to payment disputes (chargebacks).
Consent (LGPD Art. 7, I): where we ask for it. You may withdraw your consent at any time.

6. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share personal information only with the service providers (data processors) below, to the extent necessary for the purposes described in this policy:

Firebase (Google LLC): user authentication. Policy: firebase.google.com/support/privacy.
Google Cloud Vision (Google LLC): automated moderation of uploaded images. Policy: cloud.google.com/terms/cloud-privacy-notice.
Stripe (Stripe, Inc.): payment processing for purchases made on the English site, in U.S. dollars (USD). Card details are entered on Stripe's payment page and handled by Stripe; we do not store card data. Stripe may also process payment information as an independent controller, for example to prevent fraud and meet its legal obligations, under its own privacy policy. Policy: stripe.com/privacy.
Mercado Pago (Mercado Livre): payment processing for purchases made on the Brazilian (Portuguese) version of the site, in Brazilian reais. We do not store card data. Policy: mercadopago.com.br/privacidade.
Resend (Resend Inc.): sending transactional emails and, unless you turn them off in Settings, tips and news emails. Policy: resend.com/privacy.
Supabase (Supabase Inc.): the database and file storage where your account information, cards and uploaded photos are kept. Policy: supabase.com/privacy.
Google Analytics (Google LLC): site usage and browsing metrics (pages visited, device, traffic source), only with your consent (see section 7). Policy: policies.google.com/privacy.
Render (Render Services, Inc.): hosting of the server that runs the site. Policy: render.com/privacy.
Sentry (Functional Software, Inc.): monitoring of technical errors so we can find and fix problems. Policy: sentry.io/privacy.
YouTube Data API (Google LLC): when you search for a song to add to your card, your search term is sent to the YouTube API to return results. Policy: policies.google.com/privacy.
Hosting and infrastructure providers: companies that host the site and provide database, storage and error-monitoring services on our behalf.

We may also disclose information to competent authorities when required by law or by a valid legal order, or when necessary to protect the rights and safety of our users, the public or Hey Love Letters. Cards you share can be viewed by anyone who has their link or QR code.

7. Cookies, analytics and browser signals

We use Google Analytics to understand how visitors use the site, only if you allow it: it loads after you click "Got it" on our cookie notice, and never if you choose "Essential only". Google Analytics uses cookies and similar identifiers and collects information such as pages viewed, device, approximate location and time on site. We use this information in aggregate to improve the site; we do not use it to identify you individually or for targeted advertising.

We also set our own first-party cookie on your first visit that records how you arrived at the site (referring website, landing page and campaign parameters) for up to 90 days. If you create an account, this information is associated with your account so we can understand which channels bring new users. Essential cookies and local storage are also used to keep you signed in, protect forms and remember your preferences (such as language and the cookie notice).

Your choices: you can block or delete cookies in your browser settings, or install Google's opt-out browser add-on at tools.google.com/dlpage/gaoptout. Blocking analytics cookies does not affect your use of the service; blocking essential cookies may prevent you from signing in.

Global Privacy Control and Do Not Track: if your browser sends the Global Privacy Control (GPC) signal, we treat it as a choice of "Essential only" and do not load Google Analytics. We do not currently respond to Do Not Track (DNT) signals. We do not sell personal information or share it for cross-context behavioral advertising. To change your cookie choice, clear this site's data in your browser and the notice will appear again.

Card open counter: when someone opens a card through its shared link, we add 1 to our own counter, along with the date and the approximate country it was opened from. We do not use cookies and do not store IP addresses or anything that identifies who opened it; these numbers are used only for aggregate site statistics and, where available, to show the card's owner how many times it was opened.

8. International data transfers

Hey Love Letters is operated from Brazil, and our service providers may store and process personal information in Brazil, the United States and other countries where they or their subcontractors operate. Data protection laws in those countries may differ from those where you live. When personal information is transferred internationally, we do so as permitted by the LGPD (Article 33), including where the transfer is necessary to perform our contract with you or at your request, and we choose providers that commit to protecting the information they process for us.

9. Data retention

We keep your information for as long as your account is active. When you delete your account, your personal information (name, email, password, profile photo) is deleted or anonymized immediately, and all of your card content (text, photos, music) is permanently removed from our servers.

Exception: payment history (plan purchased, amount, dates) is kept in anonymized form — with no name or email attached, so that it can no longer be associated with you — for the period required by Brazilian tax law for sales records, and also so that we can respond to payment disputes (chargebacks) opened with the payment processor. The LGPD permits this even after a deletion request, when necessary to comply with a legal or regulatory obligation (Art. 16, I). Stripe keeps its own records of your payment under its privacy policy.

10. Security

We use technical and organizational measures to protect your information, including password hashing (scrypt), HTTPS encryption in transit, CSRF protection, security headers (Content Security Policy), rate limiting against abuse on sensitive endpoints and authentication-based access control. Card payments are handled on Stripe's secure checkout page. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security incident affects your personal information, we will notify you and the competent authorities as required by applicable law.

11. Children's privacy

Hey Love Letters is not directed to children under 13, and you must be at least 13 years old to create an account. We do not knowingly collect personal information from children under 13, consistent with the U.S. Children's Online Privacy Protection Act (COPPA). If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a child under 13 has provided us with personal information, please contact us at support@heyloveletters.com. Users between 13 and 17 may use Hey Love Letters only with the consent of a parent or legal guardian.

12. Your rights (all users)

Under the LGPD, you have the right to: confirm whether we process your personal information; access it; correct incomplete, inaccurate or outdated information; request anonymization, blocking or deletion of unnecessary or excessive information; request portability of your information; obtain information about the entities with which we share it; withdraw consent where processing is based on consent; and object to processing that does not comply with the law. You can also file a complaint with the Brazilian data protection authority (ANPD).

Delete your account and data at any time under Profile → "Delete my account".
Turn off tips and product news emails in Settings.
For any other request, email support@heyloveletters.com.

13. Your privacy rights (U.S. residents)

Whatever state you live in, we honor the following requests from U.S. residents:

Access: ask what personal information we hold about you and receive a copy.
Deletion: ask us to delete your personal information (you can also do this yourself by deleting your account), subject to the exceptions described in section 9.
Correction: ask us to correct inaccurate information. You can update your name and profile photo yourself in your Profile; for other corrections (such as your email address), email us.
Opt out of marketing emails: turn off tips and product news in Settings. Transactional and purchase-related emails will continue while needed.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information to infer characteristics about you. We will not discriminate against you for exercising any of these rights.

How to submit a request: email support@heyloveletters.com from the email address associated with your account, with the subject "Privacy request". To protect your information, we may need to verify your identity before acting on a request. You may use an authorized agent, who must provide written permission signed by you; we may still ask you to confirm your identity directly. We aim to respond within 15 days of receiving a verifiable request (the period set by Article 19 of the LGPD). If we decline your request, we will explain why, and you may reply to ask us to reconsider.

14. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it was last changed. If we make significant changes, we will notify you by email or through a notice on the site.

15. Contact

Questions about this policy or about your personal information: support@heyloveletters.com.