Your story belongs to you
Privacy Policy
This notice explains how Héritage uses the data needed for your account, your memories and your book, and for your sign-up to news of the launch.
Age and provisional accounts
Everything begins with your email. You then give your first name, last name and birth date, and explicit consent to process sensitive data, before any portrait or purchase. The birth date is checked; a date indicating an age under 18 leads to refusal and deletion, without retaining the rejected date or names. An anonymous session lets you begin; confirming your email lets you find the book on another device. An unpaid portrait is erased 30 days after it begins, files included; an unconfirmed anonymous account is then deleted.
Data controller
QUALIA LP, an Ontario limited partnership, 2967 Dundas Street West, Suite 207d, Toronto, Ontario, M6P 1Z2, Canada, Ontario business number 1001111214, is the data controller. To exercise a right or ask a question, write to [email protected].
Representative in the European Union
QUALIA LP is established in Canada and has not yet appointed an EU representative within the meaning of Article 27 of the GDPR. Their name and contact details will be published here before accounts open.
Why we use your data
The account, the sessions, the keeping of your memories and the making of the book are necessary to perform the service you have asked for, on the basis of Article 6(1)(b) of the GDPR. Memories can reveal your health, your beliefs, your love life, or other sensitive data: their processing also rests on your explicit consent, in accordance with Article 9(2)(a). You can withdraw it at any time from My account, without affecting processing already carried out lawfully.
Advice and offers by email, like ad measurement, rest on your consent, Article 6(1)(a). Fraud prevention, security, restoration quotas, and the defense of our rights rest on our legitimate interest, Article 6(1)(f).
What we process
We process your identity and contact details, your date of birth, your settings, your texts, your audio or video recordings, your photographs, their transcriptions, the people and places mentioned, and the memories and the book derived from them. Your stories may contain sensitive data about you or about people close to you. We also process the payment and invoice information received from Link (Stripe), support requests, technical events, the hashed IP address used for public quotas, and your consent choices.
Signing in with Google
If you choose “Continue with Google”, Google sends us only your email address, your name and your profile picture (the openid, email and profile scopes). We use your address and name to create your account, recognise you when you come back and write to you about your book; we do not use the picture. We access no other data in your Google account. This data is not sold, not used for advertising and not used to train artificial-intelligence models; it is entrusted only to Supabase, which runs sign-in. Its use complies with theGoogle API Services User Data Policy, including its Limited Use requirements. You can revoke this access at any time from your Google account, and delete your Héritage account from My account.
Your biographer’s letters
If you tick the optional box, we send one letter a day for a week, with two reminders on the last day of the welcome price, then one question a week. Amazon SES delivers them. OpenRouter routes the rewrite to Claude Sonnet; our code fills prices, dates and links.
Before your address is confirmed, the letters contain no quotations, title or story details. Each has one-click unsubscribe. Replies are not read and no open-tracking pixel is used. A complaint or bounce blocks future sends; an address hash is retained to respect that suppression.
Cloudflare Turnstile protects portrait start and gift checkout. The site counts views by page, angle, ad campaign and day, without cookies, IP addresses or identifiers stored by this counter. As with any web request, your IP address passes through our hosts (Cloudflare for the pages, Supabase for the counter) and appears briefly in their technical logs; the counter itself neither reads nor keeps it. In the app, portrait milestones, cover sharing, gift opening and clicks on sent letters are associated with the relevant account. No letter-open pixel is used; Meta’s advertising pixel loads only with your consent.
Ad measurement
Our advertising partners, to date: Meta Platforms Ireland Ltd. (Facebook, Instagram). Each new partner is added here before it is used.
Only if you click “Accept all” do we load Meta’s pixel (Meta Platforms, for Facebook and Instagram) on this site and on the app’s arrival and purchase pages: the ad pages, the e-mail step, the welcome, the purchase page and your portrait’s page. It never loads inside your book, your conversation or your account, or on a page opened from a shared link. It tells Meta the page viewed and these steps: arriving on an ad or sales page, giving your address, finishing the welcome, starting and then revealing the portrait, opening payment and buying, with the amount. Once you have given your address, it adds a hashed (SHA-256) fingerprint of your e-mail address and account identifier, and after the welcome of your first name, last name and date of birth. Meta sets its _fbp and _fbc cookies for 90 days. If you arrive from an ad, we set_fbc ourselves, with that click’s identifier, as soon as you consent.
With the same consent, our server also reports these steps to Meta (Conversions API) once it has checked them: giving your address, finishing the welcome, starting the portrait, opening payment and the confirmed purchase. For each: the step, its time, the page, the amount and currency where there is one, the step’s or payment’s identifier, those cookies, your browser’s name, your IP address and a hashed (SHA-256) fingerprint of your country (your connection’s or your browser’s time zone’s, and for a purchase your billing address’s), e-mail address, account identifier and, once the welcome is finished, your first name, last name and date of birth, so Meta can recognize what came from an ad. We keep these items for at most 7 days. The identifier of a click on an ad (_fbc) is kept with your account for 90 days, the life of Meta’s cookie, so that a step taken later from another browser, where you also consented, stays linked to that ad; declining while signed in erases it. Nothing you tell, no photograph and no text from your book is sent. For this collection we are joint controllers with Meta, which then processes the data under its own policy, possibly with transfers to the United States.
Declining changes nothing about the service. Your choice is kept on this device for six months. You can change it at any time with the “Cookies” link at the foot of the pages, or in your account; declining clears Meta’s cookies from this device.
Who is involved
Supabase hosts the database in Canada (Montréal region) and runs the service’s functions. Cloudflare provides the pages, the Workers, and video, and keeps the files (recordings, photographs, books) in its R2 storage in the United States. Google provides the biographer and voice; Deepgram transcribes recordings. OpenRouter routes other text, including letters rewritten with Claude Sonnet 5.5 and book prose. Replicate restores photographs. Meta receives ad measurement, only with your consent. Amazon SES sends the messages the service needs and, only with your consent, the biographer’s letters. Link (Stripe) acts as reseller, Merchant of Record, and payment provider, through the entity shown when you buy. Sentry receives technical errors when it is enabled, and by design never the text of a memory.
These providers act on our instructions or, for Link (Stripe) in its role as seller and payment provider, under their own obligations. The database is hosted in Canada, where QUALIA LP is established: these transfers benefit from adequacy Decision 2002/2/EC. Files are kept in the United States, where our artificial-intelligence providers also process the interviews. These transfers, like other transfers outside the European Economic Area, are covered by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission’s standard contractual clauses and supplementary measures.
Link (Stripe) processes the data needed for payment, invoicing, and its obligations as seller in accordance with its privacy policy. Héritage does not receive your full card number.
How long
The account, the memories, the files, and the book are kept for as long as the account exists, then deleted at your request. Accounting entries and proof of purchase are kept for the period required by accounting and tax rules, at most ten years. Technical queue events are deleted after thirty days; providers’ logs follow their contractual periods. A callback request is kept for as long as it takes to deal with it. Marketing consent is kept until it is withdrawn, then as proof for as long as needed to defend our rights.
Your rights
You can ask for access, correction, erasure, restriction, or objection, and for the portability of the data you have given us in a structured format. You can withdraw a consent at any time. In My account, “Delete my data” erases the account and its memories. We normally reply within one month.
You can also refer a matter to the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or use its online complaint service.
Artificial intelligence
An artificial intelligence transcribes the recordings, identifies the memories, suggests the biographer’s lines, and writes a first version of the book. It can make mistakes. You can read over and correct the result; no decision producing a legal effect is taken automatically on the basis of your story.
Sharing and privacy
Your memories are private by default. You can create a reading link for a book, or a link to the recording that goes with a memory; anyone who has that link can then open it. You can revoke reading links. A copy already downloaded or passed on to someone close to you cannot be taken back.
What your browser keeps
No advertising cookie is set without your consent. The app keeps five items in your browser’s storage: heritage.session to keep you signed in; heritage.derniere-methode and heritage.derniere-adresse to recognize this device at the door; heritage.restaurations to find your public restorations again; and heritage.question-cachee:<token> to hide, on this device, a question from a shared book. The session expires according to its authentication lifetime; the other four stay on the device until they are replaced, deleted by the app, or cleared from storage by your browser.
After an age rejection, heritage.age-rejected keeps only a flag in browser session storage, without a birth date or identity. It preserves the rejection notice for that browser session and disappears when the tab closes.
The ad measurement question keeps your answer and its date in heritage.ads for six months. With your consent,heritage.ads.sent.* avoids counting the same step twice, and heritage.ads.checkoutkeeps the amount of an opened payment until you return from Stripe.
If you use the language switch on this site, it keeps a heritage_lang cookie for one year to remember your choice of language.