Last updated: [DATE]
Heartisans ("Heartisans," "we," "us," or "our") is a Wyoming limited liability company.
We do not sell your personal information. We also do not share it with third parties for their own marketing, advertising, or business purposes.
The only circumstances in which any of your information ever leaves Heartisans are the specific, limited circumstances described in Section 3 below. In short, very basic information such as your email address and your name are shared only with the handful of vendors who help us run basic infrastructure (like payment processing). The only other circumstance in which we would share personal information would arise in the case of the narrow legal exceptions where we are compelled by a valid subpoena or court order, as outlined in Section 5 below. We will not share your personal information under any other circumstances. We do not share any personal data with advertising partners. We do not have data brokers. We do not have a "sharing" relationship with anyone beyond what's listed explicitly below.
Heartisans considers protecting your privacy a crucial part of our mission because of the type of information you share here, including your sexual orientation, your political views, your photos, your private messages, and your approximate location. We treat that information as sensitive, and this policy is written to outline exactly when and how that information is used so you can feel comfortable knowing we are protecting your information to the best of our capabilities.
We do not collect government ID, Social Security numbers, or similar identity documents unless a future identity-verification feature is introduced, in which case this policy will be updated, and you will be notified, before that feature launches.
We use the information above to operate the app itself: matching, messaging, showing your profile to other users the way you've configured it, processing donations, responding to reports, and keeping the platform safe. We do not use your data to build advertising profiles, and we do not use it for any purpose beyond running Heartisans and keeping it safe, secure, and legally compliant.
Below is a complete list of every party who receives any of your information, along with an explanation of exactly what information they receive. If a vendor isn't listed here, they don't receive any of your data from us.
Stripe (payment processing): Stripe receives only your name and email, the amount of your donation, and the date of your donation. Stripe does not receive your location, any profile information beyond your name, any of your messages, or any of your answers to compatibility questions. Stripe has its own privacy obligations for the payment details it handles directly (like your card number), which we never see or store ourselves.
Cloud hosting/infrastructure provider: Our database and servers are hosted with a third-party infrastructure provider (e.g., AWS, Supabase, or similar). Because your data is stored on their servers, it technically resides on their infrastructure, but our contract with them prohibits them from accessing, using, analyzing, or disclosing your data for any purpose of their own. They are a storage and computing utility, not a party we share data with in any meaningful sense, think of it like a locked storage unit: they own the building, but they don't have a key to your unit or the right to look inside.
Email delivery provider: We use an email delivery provider for sending you a magic link, match notifications, donation receipts, or other information. Our email delivery provider receives only your email address and the content of the specific transactional email being sent (for example, "you have a new match"). This provider does not receive your location or any other personal information from your profile or account.
Push notification provider: We use a push notification provider for sending phone notifications, if you have opted to receive them. Our push notification provider receives only a device identifier and a generic notification text title (e.g., "You have a new message"), not the message content itself, your location, any of your photos, or any other profile data.
We do not use any third-party advertising or analytics SDK that has its own independent access to your data. We do not share personal data or information with data brokers, advertising networks, or "marketing partners" or affiliates. We do not sell aggregated or "de-identified" data. If we ever add a new vendor or service that receives user data, we will update this section by name before that vendor receives any user information.
Heartisans is dedicated to minimizing precise location data.
We are a US company, and like any US company, we are subject to valid US legal process and may also be subject to valid legal process in other jurisdictions in which our app is lawfully used.
We do not proactively share your data with law enforcement, government agencies, or any other party absent a legal requirement to do so. We do not have a standing relationship with any law enforcement agency, and we do not monitor, scan, or report on your messages or activity as a matter of course.
If we receive a subpoena, court order, or other legally valid compulsory process, we are legally required to comply with it, but only to the extent it validly compels us, and only with the specific information it lawfully covers, not a blanket handover of everything we hold on you.
We will review every such request for legal validity before responding, and will push back on requests that are overbroad, defective, or not properly issued.
Where legally permitted, we will notify the affected user that a request for their information was made, before or as we respond to it. Some legal process (such as a court-ordered gag provision) may legally prohibit us from notifying you; in those cases we comply with the law but do not go beyond what it requires.
This exception applies only to compelled legal process. It is not a general license for us to share your data, it is the one narrow circumstance where the law overrides the commitment in this policy, and we treat it as narrowly as the law allows.
We retain your information for as long as your account is active, and for a limited period afterward as needed for legal, safety, or fraud-prevention purposes. You may request deletion of your account and associated data at any time (see Section 9).
We take reasonable technical and organizational measures to protect your information, including scrubbing precise location data from server logs before it can ever be stored, and limiting internal access to personal data to what's strictly necessary to operate and secure the app. No system is perfectly secure, and we cannot guarantee absolute security.
Donations are processed by Stripe, as described in Section 3. We do not store your card details or other financial information ourselves.
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you additional rights:
To exercise these rights, contact us at info@heartisans.app. We may need to verify your identity before processing your request.
If you access Heartisans from outside the United States, your information will be transferred to and processed in the United States, under the same protections described throughout this policy. By using Heartisans, you consent to this transfer.
Heartisans is not intended for anyone under 18. We do not knowingly collect information from anyone under 18. If we learn we have done so, we will delete that information promptly.
We may update this policy from time to time. If we make a material change, especially any change to who we share data with or what we share, we will notify users through the app or by email before the change takes effect, not after.
For privacy questions or to exercise your rights, contact us at info@heartisans.app.