Who we are
LovedPage is operated by [FULL LEGAL NAME], a sole trader at [REGISTERED ADDRESS], [COUNTRY]. For data-protection law, that person is the data controller for everything described here, and is who you contact about any of it: support@lovedpage.com.
The short version
We collect your name and email so you can have an account, and we store what you put on your page because that is the product. We set no cookies. We run no analytics and no advertising trackers of any kind. We do not sell anything about you to anybody, and we never will.
The one thing worth reading properly is section 7, because two things do leave our servers: a photograph, if you ask for an AI portrait, and your email address, when we send you mail.
What we collect
- Your account
- Your email address, your first and last name, and your password — which is stored only as a bcrypt hash and is never readable by us or anyone else. If you sign in with Google instead, we receive your email address, your name and a Google account identifier, and no password ever exists.
- What you put on a page
- Everything you type and upload: the page's title, the name of the person it is for, your own name, the letters and lists and dates you write, and the photographs you add. Some of this is naturally personal — it is a gift for somebody — and we treat it accordingly.
- Photographs
- Stored as files on our server, together with the image's dimensions and file type. We also keep automatically resized copies so pages load quickly on a phone.
- Purchases
- Which plan you bought and when. We never see your card details. Those go directly to our payment provider and never touch our servers.
- Server logs
- Like every web server, ours records each request: the IP address it came from, the time, the page requested, and the browser's user-agent string. This is used to keep the service running and to investigate abuse, and nothing else.
We do not ask for and do not want your date of birth, your phone number, your address, or anything about your finances beyond the fact that a payment succeeded.
Why, and on what basis
Under the UK and EU GDPR we have to say not just what we do but what entitles us to. Ours comes down to four things:
- To give you what you asked for — performance of a contract
- Holding your account, storing your page, publishing it at its address, taking payment, and emailing you about your own page.
- To keep the service working and safe — legitimate interests
- Server logs, rate limiting, investigating abuse, and preventing attacks. We have weighed this against your privacy and kept it to the minimum: no profiling, no tracking between sites, no building a picture of you.
- Because you specifically asked — consent
- Generating an AI portrait, which sends a photograph to a third party. This happens only when you press the button, and you can decline by simply not using the feature.
- Because the law requires it — legal obligation
- Keeping records of sales for tax, and responding to lawful requests.
Your page is public
This is the most important paragraph in this document. When you publish a page, it is on the open internet at its own web address. Anyone who has that link can open it, and so can anyone the link is forwarded to. We do not list pages anywhere, we do not put them in a directory, and the address is a long random string that cannot realistically be guessed — but it is not secret in the way a password is.
If a page is not for everybody, put a PIN on it. You can set a four-to-eight digit code that must be entered before the page will open. The code is stored hashed, cannot be read back by us or by anyone else, and repeated wrong guesses are throttled.
Because a published page can contain photographs and stories about somebody else, please think about that person before you publish. If you appear on a LovedPage and want it taken down, email us and we will act.
Leaving your country
Some of the providers above operate outside the country you live in, so your data may be transferred internationally. Where that involves personal data leaving the UK or the EEA, we rely on the safeguards the law provides for it — an adequacy decision where one exists, and otherwise the UK or EU Standard Contractual Clauses in our agreement with that provider.
You can ask us for the details of any specific transfer at support@lovedpage.com.
How long we keep it
- Your account and pages
- For as long as you have an account. Delete your account and it goes, along with everything on it.
- A page you started without an account
- Automatically deleted after 30 days if you never come back to it and never make an account.
- A free trial page
- Online for 15 minutes, then taken offline. What you wrote is kept against your account so that paying can put the page back.
- Server logs
- 14 days, then deleted automatically.
- Records of sales
- Kept as long as tax law requires, which is typically several years, even after you delete your account. This is the one thing we cannot delete on request.
Your rights
If you are in the UK or the EU you have the following rights, and we extend them to everybody regardless of where they live, because drawing that line seemed mean.
- See it — ask for a copy of everything we hold about you.
- Correct it — have anything wrong put right.
- Delete it — have your account and content erased.
- Take it elsewhere — get your data in a portable, machine-readable form.
- Object — to any processing we do on the basis of legitimate interests.
- Restrict — ask us to hold off processing while a dispute is sorted out.
- Withdraw consent — for anything you consented to, such as AI portraits, at any time and without affecting what was lawful before.
Email support@lovedpage.com and we will act within one month. We will not charge you, and we will not make it difficult.
We do not make any automated decision that has a legal or similarly significant effect on you, and we do not profile you.
How we protect it
- Everything travels over HTTPS. There is no unencrypted way to reach the service.
- Passwords are stored as bcrypt hashes, never as text, and cannot be read back.
- Page PINs are hashed the same way, and guessing is rate-limited.
- The database is not reachable from the internet at all.
- Access to the server is limited to the operator named in section 1.
No system is perfectly secure, and we will not pretend otherwise. If we ever suffer a breach that puts your rights at risk, we will tell you and the relevant regulator without undue delay, and within 72 hours where the law requires it.
Children
LovedPage is not for children. You must be at least 16 to have an account. We do not knowingly collect anything from anyone younger, and if we discover we have, we will delete it. If you believe a child has given us their data, please tell us.
Changes
If we change this policy, the date at the top changes with it. If a change materially affects how we handle your data, we will email everybody with an account before it takes effect, rather than quietly editing this page.
Contact and complaints
Email support@lovedpage.com about anything in this document. A person reads it.
If you are unhappy with how we have handled your data you can complain to your national data protection authority. In the UK that is the Information Commissioner's Office at ico.org.uk; in the EU it is the supervisory authority in the country you live in. We would rather you came to us first, but it is your right either way.