What we collect, why, and what you control.

Because You, Legal address available from contact@becauseyou.app, is the data controller. Questions and privacy requests can be sent to contact@becauseyou.app.

Organizers provide account and contact details, recipient and occasion details, project settings, text, optional images, and payment-related contact details. Polar receives card details directly. Because of You does not store full payment card numbers.

Contributors provide a display name when requested, their responses, optional relationship details and images, and their sharing choices. Public-audience Mirrors ask only for confirmation that the respondent is at least 18, not a birth date.

We also process service logs, authentication and security records, error diagnostics, performance timings, device and network information needed to operate and protect the service, private-link tokens, consent choices, and support messages. Error reports exclude request bodies, cookies, authorization headers, query strings, email addresses, private-link identifiers, AI inputs and outputs, and database query values. Anonymous Mirror responses do not show the owner a name or network identifier.

We process organizer account, project, payment, contribution, delivery, and support data to provide the requested service and perform our contract. We process contributor submissions to deliver the response they chose to send and to pursue the legitimate interests of the contributor and organizer in creating the requested private keepsake.

We use limited security logs, salted network hashes, error reports, and performance measurements for our legitimate interests in keeping the service reliable, diagnosing failures, and preventing fraud, abuse, and unauthorized access. We balance this against users' privacy by minimizing, masking, sampling, and scrubbing monitoring data. We keep transaction and tax records where the law requires it. Public quotation, optional analytics, and browser Session Replay rely on consent. A respondent may withdraw public-quote permission through their private receipt link.

Please do not submit health information, political opinions, religious beliefs, sexual-orientation information, or other sensitive personal data unless it is necessary and everyone concerned has agreed to its use.

An external processing service receives only the approved response content and IDs needed to group the material into themes. Names are omitted from anonymous responses. Payment data, email addresses, access tokens, correct quiz answers, network hashes, and storage credentials are excluded. The organizer reviews the result before sharing it. We do not use this processing to make legal or similarly significant decisions about anyone.

We use Clerk for authentication, Polar for payment, Resend for email, Amazon Web Services for private image storage, OpenAI for approved-text processing, Google Analytics, Google Ads and Meta for consented advertising measurement, and Sentry for error diagnostics, performance monitoring, and consented Session Replay. These providers receive only the data needed for their role and act as processors or independent controllers as described in their terms and our service agreements.

Some providers may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, the EU-US Data Privacy Framework for participating US recipients, or the European Commission's Standard Contractual Clauses with added safeguards. Contact us to ask about the safeguard used for a specific provider.

Project content remains available until the organizer deletes the project or the account is closed, subject to backups and legal claims. Permanent deletion removes project database records and private-storage objects. Response receipt and management tokens remain until their associated content is deleted.

Browsing and product-usage events and their random session identifier are removed after 90 days during routine cleanup. Campaign attribution in browser storage expires after 90 days and is removed when you withdraw consent. Payment and refund records are kept separately from browsing analytics. The analytics choice lasts 180 days. Google Analytics and Meta measurement cookies are configured for no more than 90 days, while provider-side event data follows the retention setting in the corresponding analytics account. Sentry diagnostics and consented replay data follow the shortest practical retention configured in the Sentry project and are deleted when no longer needed to investigate reliability or security. Payment, tax, security, support, and legal records remain only for the applicable statutory period or as long as needed to resolve a claim.

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability, or an objection to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. Email contact@becauseyou.app. We may need to verify your identity before acting.

You may also complain to the data protection authority where you live or work, or where you believe an infringement occurred. If you are in the EU, the EDPB member list identifies the relevant authority.

With analytics consent, an approved creator link can save a signed referral cookie for up to 30 days. Rejecting analytics leaves this link tracking off. Withdrawing consent stops its use immediately and the consent endpoint deletes the cookie. You can instead enter a creator code before checkout to request the discount and credit that creator.

We retain the applied code, account and payment-provider identifiers, eligible purchase amount, refunds and commission adjustments to administer the program, prevent self-referrals and duplicate payments, and meet accounting obligations. These financial records survive project deletion. Creators do not receive private stories, respondent identities, or payment card details.

Partner applications submitted through our form are sent to our contact inbox using Resend. We use the supplied profiles, contact details and proposal to review and manage the partnership. We retain limited hashed network and email identifiers to prevent application spam; application answers are not sent to analytics. Where Affonso administers the partner portal, Polar coupon and transaction information is shared with that service for attribution and commission reporting. We do not install an Affonso tracking script or send it private project content. Contact us to withdraw an application or request access or deletion, subject to required financial retention.

Necessary storage supports authentication, security, payments, private-link management, response receipts, and your analytics choice. These functions do not depend on analytics consent.

Google Analytics measures page views on public pages only. The Google tag library is requested only after you accept analytics. We disable Google Signals and ad-personalization signals, omit URL arbitrary query parameters, and do not send private account, invitation, response, or reveal URLs. Google uses the IP address at collection time to derive coarse location and says it discards the address before logging it.

With consent, Google Analytics and Google Ads also measure verified payments on a dedicated confirmation page. This includes the order identifier, plan, currency and price before tax. Public landing URLs may include Google ad click identifiers; the confirmation URL excludes purchase query parameters and personal details. We do not send gift messages, recipient names or private project content to Google. Advertising personalization remains disabled.

If you accept analytics and Meta measurement is configured, the Meta Pixel measures visits to public marketing pages. The Meta Conversions API may record creation of a project, checkout start, and completed payment. These events may include campaign IDs, consented Meta browser identifiers, a hashed organizer account identifier, browser and network information, plan category, currency, and payment value. We do not send recipient names, contributor names, messages, images, private-link tokens, or private account and reveal URLs to Meta.

If Meta cannot receive a purchase event immediately, we retry it for up to seven days. Browser and network identifiers in the retry record are removed after delivery or expiry. Withdrawing consent while signed in also cancels your pending unsent Meta purchase events.

Sentry error and performance monitoring operates without analytics cookies and is limited to scrubbed technical diagnostics. Session Replay starts only after analytics consent, masks all text and form inputs, blocks images and other media, and excludes network payloads. It stops when consent is withdrawn.

Rejecting analytics does not limit the service. Choose Cookie settings to withdraw or grant analytics consent. Withdrawal stops future analytics and replay collection and removes accessible Google Analytics, Google Ads and Meta measurement cookies, stored campaign attribution and the first-party analytics session cookie.

Fields marked as required are needed to create an account, project, payment, or submission. Without them, we cannot provide that part of the service. Optional fields and analytics consent may be left blank or refused without losing access.

We will update the date above when this notice changes. If a change materially affects how we use existing personal data, we will provide additional notice where required.