Privacy Policy

1. Data we collect and why

  • From the sender: name and email, to show who sent the rose, to send the receipt and the management link, and to let you know if the rose could not be delivered.
  • About the recipient: name and the chosen contact (email, WhatsApp number, or Instagram profile), to deliver the rose or help you deliver it.
  • The message and, if you record one, the voice message, which make up the rose itself.
  • Payment: handled by Stripe. We never receive or store card details; we keep only the confirmation, the amount, and the currency.
  • IP address: we keep only an irreversible hash of the IP to limit abuse of the service (such as creating drafts, starting payments or opening roses), deleted within 3 hours.

2. Anonymous statistics

We use PostHog to measure how the service is used, with no cookies and nothing stored in your browser (the data lives only in memory while the page is open). IP addresses are not stored. We record only anonymous usage events and page performance metrics (Web Vitals).

Each event also carries the browser, operating system, and device type, and the page address with private links removed. Events use a random identifier for the draft and the rose. They never contain names, messages, emails, phone numbers, Instagram profiles, or the private links.

Apart from statistics, the site itself keeps only two things in your browser: the language you chose and the identifier of the draft in progress, so you can pick up where you left off.

3. How long we keep data

  • Unpaid drafts and their voice messages are deleted about 24 hours after their last change.
  • Paid roses are kept so the link keeps working, until someone asks for removal (section 6).

4. Who helps us run the service

We share data only with the providers the service needs to work:

  • Stripe
  • Supabase
  • Resend
  • PostHog
  • Sentry
  • Cloudflare

5. International transfer

Some providers store data outside Brazil, mainly in the United States. In those cases, the transfer happens to provide the service you asked for, with providers that apply appropriate security measures.

6. Your rights

Under the LGPD, you can ask us to confirm whether we process your data, and for access, correction, anonymization, portability, deletion, and information about sharing, and you can withdraw consent where it is the basis for processing. To exercise any right, including asking for a rose to be removed, write to [email protected].

7. Sharing to stories

The image or video for stories is created on your own device. Nothing is uploaded to our servers.

8. Who the controller is

The controller of the personal data processed by Send a Rose is Construtora Florence LTDA. This policy follows Brazil's General Data Protection Law. Privacy contact: [email protected].