Privacy Policy

Effective 22 October 2026

This page explains what Heartleigh (heartleigh.com) does with your personal data.

Who we are

The business behind Heartleigh is Axiom Synapse LLC, registered in the State of Delaware, USA, at 2810 N Church St, PMB 691717, Wilmington, DE 19802-4447, USA. We are the controller of your personal data. We have not yet appointed a representative in the EU or the UK. Until we do, people there can reach us at [email protected].

To reach us, use the form at heartleigh.com/contact or write to [email protected].

What we collect, and why

Orders (keepsakes). Your name, email, delivery address, the photo and design you upload (with any name, dates or message on it), and what you ordered and paid. We use these to take payment, make and ship your item, and email you about it (contract). We keep order records because tax law requires it (legal obligation).

Candles and candle pages. Your email, the name the candle is for, the visibility you choose, your own name if you give it, an intention if you write one, and the date a pet or loved one died if you give it. We use these to light your candle, run its page, and email you (contract). If you light a free candle on someone else's page, we use your email to send the link that lights it.

Reminder emails. The anniversary email is sent only if you tick the box and give a date (consent). We also email a candle's buyer a month before it goes out, and once after, to offer a relight, unless they untick that box when buying (legitimate interests). Every one has a stop link, and you can stop all our reminders to your address at once.

Intentions read on the live stream. Only if you tick the box when buying a candle while our live stream is on. We use your first name and intention text, after we read and approve them (consent). An intention can reveal faith or health, which the law treats as sensitive, so please leave out medical details and other people's full names. You can withdraw consent at any time and we will take the intention off the air.

Messages and feedback. What you write in the contact form, feedback form, a page report or a guestbook message, with your name and email if given. We use it to reply, improve the site and handle reports (legitimate interests). Guestbook messages stay unpublished until you confirm by email (consent).

Launch alerts. If you ask us to email you when a feature opens (memorial pages, birthday pages, gift registries or birthday wishes), we keep your email and which feature, to send that one email (consent). Nothing is sent until you confirm by the link we email you, every email has a link to stop it, and we never use the address for anything else.

Security. Forms use a hidden field and a timing check to stop bots, and we count requests per IP address for a few minutes to limit abuse. We may also use a bot check from our website provider. (legitimate interests).

Site statistics and errors. Our analytics runs on our own server and sets no cookies. Page addresses are cleaned before recording, so candle ids and private link tokens are removed. Our own error tracking has cookies, query strings and ids stripped before it is sent (legitimate interests).

We do not sell your personal data. We do not use advertising trackers.

What is public, and what is not

You choose the visibility of each candle.

Show the name: the name of the pet or person, and your own name if you gave it, appear on the candle wall and on its page. That page can be found through search engines.
No names on the wall: the candle is counted but not named. Its page exists, shows the name it is for, and is for the people you send the link to. It is not listed and is hidden from search engines.
Private: nothing is shown and there is no page.

The intention you write is never shown on the wall or a page. It appears on your own receipt page, reached through the link we email you. Anyone with that link can read it, so keep it to yourself.

On a candle page, someone who lights a candle is named only if they chose to be. We never show your email address.

Photos you upload are private. We never publish them. They are used only to print your order.

These kinds of companies handle data for us, each only for its own task.

Our payment provider takes payment. It sees your card details, email, name, delivery address and the item name, which for a candle includes the name it is for.
Our print and shipping partners make and ship keepsakes. They receive your name, email, delivery address, and the print file made from your design, which includes your photo.
Our email provider sends our emails, so it sees the address and text of each one.
Our website, storage and mail forwarding provider serves our website, stores your uploaded photos, and forwards mail sent to [email protected].
Our hosting provider runs our server and database, in Germany.
A voice service turns approved intentions into a spoken voice for the live stream, and receives the first name and text. The screen says when a voice is AI generated.
The platforms that carry our live stream show and speak approved intentions. We cannot erase copies made by the platform or viewers.
A video player from our streaming platform is shown on our candles page while the room is live. We use its privacy-enhanced mode, which sets no tracking cookies until you press play, though the platform can still see your IP address and may store some data on your device.

Ask us and we will tell you the name of each company.

Transfers outside your country

Our server is in Germany. Some of the providers above may process data in the United States and other countries. For UK or EU data we rely on adequacy decisions or standard contractual clauses.

How long we keep it

Photos uploaded but not ordered: deleted after 7 days.
Photos and designs of paid orders: deleted a year after delivery.
Intention text used for the live stream, and its spoken clip: erased 30 days after it first airs, or 30 days after we receive it if it never airs. The intention also stays on your own receipt page until your candle's details are erased (below). If a candle is refunded, or you ask us to remove an intention, we erase the text at once and the clip within minutes. We keep the fact that a prayer was said, the first name it was said for, and when.
Launch alerts: deleted 7 days after you ask if you never confirm; kept, once confirmed, until the feature opens and the alert is sent, or you stop it; then deleted 30 days later.
Guestbook messages never confirmed: deleted after 7 days. A removed message loses its text, name and email.
Order records: 7 years, as tax law requires.
Candles: your email, your name, any intention and any date you gave are erased a year after the candle goes out, 30 days after a checkout you did not complete, or 7 days after a free candle you did not light.
Emails we sent, contact messages, feedback and page reports: 2 years.
Server logs, which can include your IP address: up to 30 days.
Private links we email you stop working after 120 days (orders), 180 days (relight) or 400 days (page management). You can ask for a new one.

Cookies and similar storage

We set no advertising or tracking cookies and show no cookie banner.

Opening a private link from our email sets a cookie that shows you your own page: hl_order (until you close the browser), hl_manage (400 days) or hl_relight (180 days).
Your browser stores your cart, shipping country and design drafts, including photos, on your device until you clear them.
The payment page, any embedded video player and any bot check set their own cookies under their providers' own policies.

Your rights

If you are in the EU or UK you can ask to see, correct, delete, restrict or move your data, or object to our use of it. Where we rely on consent, you can withdraw it. We reply within one month. You can complain to your local data protection authority, such as the ICO in the UK.

If you live in California or another US state with a privacy law, you can ask what we hold, ask us to delete or correct it, and ask us not to sell or share it. We do not sell or share personal data for advertising, and we will not treat you worse for asking.

To use a right, contact us. We may ask for your order reference to check it is you, and we may keep what the law requires, such as order records.

Children

Heartleigh is not for children under 16. We do not knowingly collect their data. If you think a child has given us data, tell us and we will delete it.

Changes

If we change this policy we will update the date above.