Privacy notice

Who we are

myvalentine.to is run by Creative Syndicates Tech Ltd, company number 17003909, registered in England and Wales. We decide how and why your personal information is used, which makes us the “controller” under data protection law.

Registered office: Castle House, High Street, Ammanford, SA18 2NB, United Kingdom. Email: support@myvalentine.to.

What we collect

• Names in a free link. The names you type become part of the link. Anyone with the link can see them. They can also appear in browser history, in link previews, and in our hosting and analytics records of page visits.
• Your account. Your email address and a sign-in session. We email you a sign-in code or link, so there is no password.
• Your letters. Names, messages, dates, places, answers, any photos you add, and a voice note if you record one. A draft, including photos and a recording, may stay in this browser until you save it.
• What happens to a live letter. Whether it was opened and how many times, whether the person tapped yes, how many times they tapped no, and which option they picked. We show you this in your dashboard. We do not record who opened it.
• Payments. Stripe takes your payment and shares your order details with us: your name, email, billing details such as your country or address, what you bought, the amount, and whether it worked. We keep a payment reference with your account. We never see or store your full card number.
• Messages to us. Anything you email us, and any feedback you send from the dashboard, including the page you were on.
• Technical data. Your IP address, browser and device type, and the page address. These appear in server logs, in sign-in records, and in our cookie-free visit counts, which also record where you came from, your approximate location, and a few simple events such as which occasion you chose.

Cookies and browser storage

We do not use advertising cookies. We use the cookies and browser storage the site needs to work: your sign-in session, your draft letter and any photos or recording until you save them, small choices such as sound on or off and whether the sidebar is open, a note of where to return after you sign in, and a temporary note so a visit to a live letter is counted once. Stripe and Cloudflare may also set cookies or similar tools for payment security and bot checks.

You can clear these in your browser settings. That signs you out and deletes any unsaved draft.

Why we use it

• To give you the service you ask for: free links, the editor, saving and sharing letters, and showing you when a letter is opened or answered. The legal basis is contract.
• To take payment and help you: payments, refunds, support and feedback. The legal basis is contract. We also keep tax and accounting records, because the law requires it.
• To keep the site safe: bot checks, limits on misuse, security logs, and dealing with reported letters. The legal basis is our legitimate interest in keeping the site and the people who use it safe.
• To understand and improve the site: cookie-free visit counts and fixing problems. The legal basis is our legitimate interest in making the site work better.

We do not sell personal information, and we do not use advertising cookies. We do not make decisions about you using only automated means that have legal or similar effects.

Who else sees it

Anyone you send a live link to can read that letter, see its photos and hear its voice note. Other companies handle some of this for us, or in their own right:

• Stripe sells the unlock to you as merchant of record and takes your payment. It collects payment, billing and tax details for itself and uses them under its privacy policy. It shares your order details with us. If you create or use a Link account at checkout, that is between you and Stripe.
• Supabase stores accounts, letters, photos and voice notes, and handles sign-in.
• Vercel hosts the site and keeps server logs.
• Cloudflare runs the bot check (Turnstile) when you sign in or start checkout.
• Umami counts visits without cookies.
• An email service sends your sign-in emails.
• Messaging apps and social networks. If you paste a link into one, it may fetch the page to show a preview. A preview can include names.

We may also share information with advisers, where the law requires it, or if the business is sold or merged. The new owner would use it as described here.

Moving information outside the UK

Some of these companies are based in, or store information in, other countries, including the United States. When that happens, we make sure a lawful route applies, such as a UK or EU adequacy decision or approved standard contract terms.

If someone sent you a link

The sender chose to put your name in it. We did not ask you for it. When you open a live letter, we tell the sender that it was opened and what you tapped, such as yes, no, or which option you picked. We do not ask for your name or email. The legal basis is our legitimate interest, and the sender’s, in letting them know their letter arrived. If you want a name removed from a link or letter, email support@myvalentine.to with the link and we will look at it.

Photos and voice notes

A photo is optional. Until you save the letter, it stays in this browser. After you save, we store it in private storage with the letter, and anyone with the live link can see it through a temporary link that expires. We do not scan photos or use them to recognise anyone. We do not remove the hidden details your phone adds to a photo, such as the date or location. If you do not want those shared, remove them before you upload.

A voice note is optional, and it can be up to 60 seconds. Until you save the letter, the recording stays in this browser. After you save, we store the audio file with the letter. It is not written into the letter text. Anyone with the live link can press play and hear it.

We keep it so they can hear the message you chose to send. We do not analyse the recording, turn it into a voiceprint, or use it to identify you or anyone else.

A voice is personal information. Under the UK GDPR and the Data Protection Act 2018, and under the EU GDPR (in Poland, RODO), a voice file is biometric data only when it is processed to uniquely identify someone. We do not do that. We treat the recording as part of the letter, not as special category biometric data.

Record only your own voice, or a voice you have permission to use. You can delete the note in the letter. Email us if you want the account deleted, and the recording with it.

How long we keep it

• Your account, letters, photos, voice notes, and their opened and answered details: while your account is open.
• A draft in your browser: until you save it or clear your browser data. We do not hold a copy.
• Payment and order records: for as long as the law requires, usually up to six years.
• Server logs and sign-in records: for a short time, set by the companies that run them.
• Emails and feedback: for as long as we need them to help you, and a reasonable time after.
• If you start checkout but do not pay: the email you entered stays with that unfinished account until we clear unused accounts, or you ask us to delete it.

Email us to delete your account. We delete it, with its letters, photos and recordings, within one month, apart from records the law makes us keep. Copies in backups are removed when the backups expire.

Your rights

You can ask us for a copy of your information, to correct it, to delete it, to restrict how we use it, to move it to another service, or to stop us using it in some ways. Email support@myvalentine.to. We reply within one month, and we may ask you to confirm who you are. It is free.

You do not have to give us your information, but without an email address we cannot create an account or take payment.

If you are unhappy, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk, or to your local data protection authority if you live in the EU or EEA.

Children

Accounts and payments are for adults (18 or older). Free links do not need an account, but a name you type becomes part of the link. If you are under 18, use only a name you are happy to share, and ask a parent or guardian if you are unsure. If you think we have collected a child’s information through an account, email us and we will delete it.

Changes to this notice

We will update the date at the top when this notice changes. If a change matters to you as an account holder, we will email you.