Privacy Policy

CandlePaws is operated by Global Investment Consulting BV, Alfons Servaislei 96b bus 7, 2900 Schoten, Belgium (KBO/BTW BE 0755.799.452, RPR Antwerp). In the words of the GDPR, that operator is the “controller” of the personal data described on this page — the party responsible for how and why it is used. If you have any question about your data, the contact section below is the place to reach us.

We have not appointed a data protection officer — we are not required to. Your questions come to us, and we answer them ourselves.

Only what the service genuinely needs:

• Your email address, when you create an account. We sign you in with an emailed link — no passwords, and no other account details.
• The memorial you create: your pet’s name and details, the story you write, and the photos you upload. Published memorial pages — including the story and photos — are visible to anyone who has the link.
• Guestbook tributes and candles: visitors can leave a memory (the name they sign with and their message) and light a candle (we store only the time it was lit) — no account needed. Tributes and candle counts appear publicly on the memorial page.
• Payment records, but never card details. Premium payments are handled entirely by Stripe; your card number never touches our servers. We keep only the order record: which memorial, the amount, and when.
• Technical basics: the short-lived server logs (such as IP addresses) that any website generates, used only to keep the service secure and to prevent spam and abuse.

We need your email address for an account — without it we cannot sign you in. Everything else you write or upload here is voluntary.

What we don’t do: no selling of data and no advertising profiles — not now, not ever. Optional usage analytics exists, but only if you say yes first: nothing is measured and no analytics script even loads until you agree in the small banner (see Cookies & analytics below).

The GDPR asks us to name a legal basis for each use of your data. Ours are simple:

• To provide the service you asked for — hosting the memorial, signing you in, delivering the Premium upgrade you purchased (performance of a contract, Art. 6(1)(b) GDPR).
• To keep the service safe — preventing spam and abuse, and keeping security logs (our legitimate interest, Art. 6(1)(f) GDPR, in running a trustworthy service).
• To meet legal obligations — for example keeping payment and bookkeeping records for as long as tax law requires (Art. 6(1)(c) GDPR).
• With your consent, where we ever ask for it for something optional (Art. 6(1)(a) GDPR) — anything like that will say so clearly, and you can withdraw consent at any time.

When you use “Help me shape this” while writing a memorial story, the notes you typed (plus your pet’s name and species, if you gave them) are sent to Anthropic, the company behind the Claude AI model, to draft a story from them. Under Anthropic’s commercial terms, this text is not used to train their models. The draft comes back to you as an editable suggestion — nothing is published unless you choose to save it, and nothing is sent anywhere unless you use the feature.

So that it is said plainly: this draft is written by an AI system, not by a person. You decide whether and how it appears on the memorial — and the words that end up there are yours.

A handful of carefully chosen providers process data on our behalf (as “processors”), each under a data-processing agreement and only for the purpose listed:

• Supabase — our database, sign-in system, and photo storage, hosted in Frankfurt, Germany (EU).
• Vercel — hosts and serves the website itself.
• Stripe — processes Premium payments; the only party that ever sees your payment details.
• Resend — delivers our emails, such as your sign-in links.
• Anthropic — provides the AI writing helper described above, only when you use it.
• Google (Google Analytics) — usage statistics, only after you consent in the analytics banner. Nothing loads without your yes.
• Meta — measurement of our own ads (the Meta Pixel and its server-side counterpart), only after you consent in the analytics banner. Without your yes, nothing is ever sent to Meta.

The heart of the service — accounts, memorials, stories, photos, tributes and candles — is stored with Supabase in Frankfurt, Germany, inside the EU. Some providers (payments, email delivery, the AI helper, consented analytics) may process data in the United States; where that happens, it is covered by recognised safeguards such as the EU standard contractual clauses or the EU–US Data Privacy Framework.

We are happy to send you a copy of the standard contractual clauses — just ask.

• Memorial content stays until you delete it. Free memorial pages stay up for as long as you leave them there — that is the promise the service is built on. When you delete a memorial from your account page, its photos, guestbook and candles are permanently deleted with it.
• Deleting your account deletes everything — every memorial you look after, and then the account itself.
• Payment and bookkeeping records are kept by Stripe and by us for as long as Belgian tax and commercial law requires (currently seven years) — even after an account is deleted. We need nothing beyond the order record for that.
• Security logs are short-lived and rotate automatically, normally within 30 days.

Under the GDPR you can, at any time:

• Access the personal data we hold about you, and receive a copy;
• Correct anything that is inaccurate;
• Delete your data — the delete controls on your account page do this directly, no request needed;
• Take your data with you (portability) in a common machine-readable format;
• Restrict or object to processing based on our legitimate interests;
• Withdraw consent wherever processing is based on it, without affecting what happened before.

To exercise any of these, use your account page or contact us.

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR at CandlePaws.

You also have the right to complain to a data-protection supervisory authority — the one in the country where you live, or the Belgian Data Protection Authority that oversees us (Autorité de protection des données / Gegevensbeschermingsautoriteit, Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be).

CandlePaws is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, please contact us and we will delete it.

By default we use only strictly necessary cookies: the session cookie that keeps you signed in to your account, and a small cookie remembering your analytics choice below. No analytics cookie exists — and no analytics script even loads — unless you say yes first.

With your consent, and only with it, we use Google Analytics to understand how the service is used — which pages are visited and which features are touched, so we can make this a better place to remember them. While we run ads, we also (again only with your consent) use Meta’s measurement tools to see whether those ads work; for a Premium purchase this can include a server-side confirmation to Meta carrying the amount and your email protected by one-way hashing — never the memorial itself.

Declining changes nothing about how CandlePaws works, and you can change your mind at any time — right here:

When this policy changes, we will post the new version here with an updated date. If a change meaningfully affects how your data is handled, we will give account holders reasonable notice — by email — before it takes effect.

For anything about your data, this policy, or the service, reach us at support@candlepaws.com. If you want to report content, the route for that is in our legal notice, under “Reporting content”.