Privacy Policy

1. Who we are

RoseNote ("we", "us") operates the RoseNote digital rose card service on rosenote.live. We are the controller of the personal data described in this policy. For privacy questions or requests, contact [email protected]. Regardless of where you are located, we apply the EU GDPR as our baseline privacy standard and additionally honour rights granted to you by local law (such as US state privacy laws) to the extent they apply to us.

2. What we collect

• Card data: sender name, recipient name, your message, delivery choice, and the recipient's email address (used to deliver the card).
• Your email: required and stored so we can send you a copy of your share link and QR code and respond to support requests.
• Consent records: the date and time you accepted the Terms of Service and the immediate digital-delivery consent.
• Voice notes: audio files you optionally record, stored only to attach them to the card.
• Payments: handled entirely by Polar.sh — we receive only payment confirmation and never see or store your card number.
• Browser storage: the cookies listed in Section 10.

3. How we use it, and why

Solely to create, deliver, and support your card, on these legal bases:

• Contract performance: creating the card, sending the rose email, sending your copy of the share link and QR code, and serving the private view link.
• Legitimate interest: keeping the service secure, preventing abuse, and investigating delivery issues.
• Consent: your digital-content and withdrawal acknowledgements, and your cookie choices where consent is required.
• Legal obligation: keeping transaction records required by tax and accounting law.

We do not sell your data or the content of your messages, and we do not use them for advertising, profiling, or AI training.

4. Recipient and other third-party data

When you create a card you provide data about another person (the recipient). You confirm that you have that person's consent — or another valid legal basis — to share their data with us. We process it on the basis of our legitimate interest in fulfilling your order. Because the service is designed to deliver a surprise, notifying the recipient before delivery would defeat its purpose; we therefore do not contact recipients in advance. Recipients (or anyone else) may request access or deletion of their data at any time by contacting us.

5. Voice recordings

Voice recordings are processed only to attach them to the card and play them to the recipient. We do not sell them, use them for advertising or profiling, or submit them to AI training. They are retained only for the lifetime of the card (see Section 9), or until you or the recipient request earlier deletion. By recording or uploading audio, you confirm you have the rights and consents needed to share it, as described in Section 8 of our Terms of Service.

6. Payments

Payments are processed by Polar.sh, which acts as the Merchant of Record for purchases. Polar is a separate controller of your payment-related personal data — see its privacy policy at polar.sh. We never receive or store full payment card details.

7. Processors

We share data only with processors needed to run the service:

• Polar.sh — payments and order confirmation (Merchant of Record)
• Brevo — transactional email (rose delivery and your link copy)
• Turso — hosted database (card data)
• Cloudflare R2 — file storage (voice recordings)
• Vercel — hosting and CDN (serving the site)

Each processor operates under a data processing agreement and applies appropriate safeguards. We do not share your data with anyone else.

8. International transfers

We aim to keep data in the European Economic Area where possible, but some processors (such as Vercel, Polar, and Cloudflare) may process data in the United States or other countries. Wherever data is transferred outside the EEA or a country without an adequacy decision, we rely on appropriate safeguards — such as Standard Contractual Clauses approved by the European Commission and/or certification under the EU–US Data Privacy Framework.

9. Retention

• Card content (message, voice recording): kept while the card is active; we may delete a card 6 months after its dispatch (see Section 5 of the Terms of Service), and earlier on request.
• Your email, consent records, and delivery data: kept with the card, and deleted with it unless we must keep them longer (see next point).
• Transaction and billing records: retained as required by tax and accounting law, typically 5 years from the end of the relevant tax period.
• Cookie lifetimes: as listed in Section 10.

10. Cookies

We use only a few cookies and browser-storage items:

• rosenote_draft — remembers what you typed in the create form for 7 days so you can come back and finish your rose (necessary; set whether or not you accept cookies).
• rosenote_cookie_consent — records your cookie choice for 12 months (necessary).
• rosenote_pending — kept in your browser's localStorage for up to an hour around payment so the confirmation page can restore your share link and QR code (necessary).

We do not use advertising or analytics cookies today. If we ever add optional cookies, they will only be set after you accept them in the cookie banner.

11. Security and view links

We protect data in transit with HTTPS encryption, restrict access to what is needed to run the service, and rely on our storage processors' access controls. Cards are accessible only through a unique, hard-to-guess link — but the link is unlisted, not password-protected: anyone who has it can view the card, so it must be kept confidential.

12. Your rights

Subject to applicable law, you may request to:

• access the personal data we hold about you,
• correct inaccurate data,
• delete your data (including the card itself, on request),
• restrict or object to certain processing,
• receive a portable copy of your data, and
• withdraw consent at any time (without affecting processing that already took place).

US residents additionally have rights such as knowing, deleting, and porting their personal information and non-discrimination for exercising them — we do not sell personal information. To exercise any right, email [email protected] — we may need to verify your identity and will respond within the timeframe required by applicable law (generally 30 days). You also have the right to lodge a complaint with your local data protection supervisory authority.

13. Children's privacy

The service is intended for adults. A child's data (such as their name in a message) may be included only by an adult with parental authority, who consents to its use in the card. If you believe a child's data was provided without a guardian's consent, contact us and we will delete it.

14. Changes to this policy

We may update this policy for legal, regulatory, or technical reasons. The current version is always available on this page with its revision date. Material changes will be notified where we hold your email address.

15. Contact

Privacy questions and rights requests: [email protected].