Privacy Policy

Harri Digital Ltd, registered in England and Wales (No. 17032672), registered address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, is the data controller. For any privacy questions, contact us at hello@bridgeoflights.org. We respond personally within 48 hours.

When you purchase a candle we collect:

• Memorial content (name of your loved one, their dates if provided, your personal message): to display your candle on the bridge. Memorial content relates to the deceased, to whom data protection law does not apply, but any personal data about living persons within messages is treated with care.

• Your email address: to send your receipt, candle number, and certificate (if purchased). Your email is never publicly visible.

• Payment reference: we receive a transaction reference from Stripe but never see or store your card details.

• IP address: temporarily processed for rate limiting, fraud prevention, and abuse prevention (e.g. when reporting offensive content). IP addresses are not stored long-term. The one exception is a discount code redemption, described below, which keeps the checkout IP address for 12 months.

• Currency/country: your approximate country is detected via Cloudflare to display prices in the correct currency (GBP, EUR, or USD). No precise location data is stored.

• Discount code records: if you use a discount code, we keep a record of that redemption. It stores the code, the order it applied to, a normalised (lower-cased) form of your email address, and the IP address used at checkout. We keep this to reconcile orders with the code that was used, to report accurately to the partner who issued it, and to stop a limited code being used more times than it allows. The IP address on that record is deleted after 12 months. The rest of the record is kept for as long as the payment record it belongs to.

• How you reached us: if the link you arrived by said where it came from (for example an advert, a page somebody shared, or a printed QR code), we note the campaign tags on that link and the address of the first page you opened. This is held in your browser for the length of your visit (in session storage, not a cookie) and is saved with your order only if you place one. We use it to understand which pages and links lead to candles being lit. It is never public, and it is not used to follow you around other websites.

Providing your email address and memorial details is required to complete your purchase. Without them, we cannot process your candle or send your receipt.

If you apply to be listed on our Creators page, we collect your name and email address (to reply to you and, if you ask for one, to send you a code for your community), the name, link, handle, description, country, extra line and logo or picture you give for your listing, your answer to "What made you start?" if you choose to share it, and a record of the three confirmations you ticked, with the time. Your name, email address and your answer to "What made you start?" are never published. If we list you, the listing details are shown publicly on the Creators page until you ask us to remove them. We do not store your IP address with your application.

If you create a memorial page, we collect the full name, the name people called them, the years, the words and sign-off you write and the colour you choose (all of which are shown publicly on the page), and your email address. Your email address is used to send your confirmation, to let you sign in and manage the page, and to email you about new candles on it. It is never shown on the page.

• Emails to a page’s organiser: we email the organiser when a candle is lit on their page, with that candle’s message. Every one of those emails ends with two links, one to have a single summary a day instead and one to stop them, and both work without signing in. The same choice is in the account area. These are emails about a page you look after, not marketing.

• If your candle is asked to join a page: when somebody makes a memorial page for a person you have already lit a candle for, they can ask for your candle to be shown on it. We then send you one email to ask. The person who made the page is not shown your name or your email address, and is not told whether you said yes or no. Your candle is added only if you say yes. We keep a record of the request (the page, the candle, when we asked and what was answered). A request that is not answered lapses after 30 days.

• Reports about a page: if you report a concern about a memorial page, we store the reason you chose, anything you wrote, your email address if you gave one, and the IP address the report came from. The IP address is used to prevent abuse of the form and is removed after 30 days. The rest of the report is kept as our record of what was raised. Reports are read by our team and are never shown to the organiser or the public.

• QR code scans: each memorial page has a QR code. When one is scanned we add one to that day’s count for that page, so that the organiser and we can see it is being used. We store the count and nothing else: no IP address, no device details and nothing that identifies who scanned it.

We process your data under the following lawful bases:

• Contract (Art 6(1)(b)): displaying your candle, sending your receipt and candle number, processing payment via Stripe, and delivering your certificate if purchased.

• Legal obligation (Art 6(1)(c)): maintaining financial and tax records as required by HMRC.

• Legitimate interest (Art 6(1)(f)): content moderation to maintain a respectful memorial environment, fraud prevention, rate limiting, responding to your queries, and ensuring the security of our service.

• Consent (Art 6(1)(a)): analytics cookies (Google Analytics) and advertising measurement (Google Ads), each only when you actively opt in to that category. You may withdraw consent at any time via the Cookie Settings link in the footer. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Publicly visible to all visitors: your loved one's name, their dates (if provided), and your personal message. Your email address is never publicly visible.

On a memorial page, visible to all visitors: the name, years, words and sign-off its organiser wrote, and each candle shown on the page with its message, its date and its song if it has one. No buyer’s or organiser’s name or email address is ever shown on a page, to the public or to the organiser. An organiser managing their page sees each candle’s message, date and number, and nothing about who lit it.

We share your data only with the following service providers, each acting as a data processor on our behalf (or, where noted, as an independent controller):

• Stripe (payment processor, US): processes your payment securely. Stripe is PCI DSS Level 1 compliant and acts as an independent data controller for payment data. See stripe.com/privacy.

• Resend (email delivery, US): delivers your receipt email and certificate PDF. Only your email address is shared. See resend.com/legal/privacy-policy.

• Google Perspective API (content moderation, US): your candle message text, and the listing name and description from a Creators page application, are sent to Google for automated toxicity scoring to help us maintain a respectful memorial space. No personal identifiers (name, email, IP) are sent, only the message text. The names, words and sign-off written for a memorial page are scored in the same way, when the page is created and each time it is edited. The organiser’s own name, email address and IP address are not sent. See policies.google.com/privacy.

• Google Analytics (analytics, US): only with your explicit consent. When you decline analytics cookies, no analytics data is sent to Google. We do not enable Google Analytics advertising features such as remarketing audiences or demographic reporting. See policies.google.com/privacy.

• Google Ads (advertising measurement, US): only with your explicit consent. We use it for one purpose, which is to tell us whether someone who reached this site came from one of our own adverts. We advertise elsewhere so that bereaved people can find the bridge; this measures whether that worked. We do not build advertising profiles, we do not run remarketing or retargeting, and we do not use it to serve you adverts anywhere. Advertising measurement defaults to off, and you can withdraw consent at any time via Cookie Settings. See policies.google.com/privacy.

• Spotify (song search, Sweden/US): when you search for a song while ordering, the words you type are sent from our server to Spotify’s search service to find matching tracks. Your name, email address and IP address are not sent with them. We keep the chosen song’s title, artist and Spotify track ID with the candle. No Spotify player is embedded on our pages. See spotify.com/legal/privacy-policy.

• Cloudflare (security and CDN, US): provides HTTPS, DDoS protection, and geo-IP detection for currency display. Cloudflare processes your IP address as part of delivering our site to you. See cloudflare.com/privacypolicy.

• Our own analytics (first-party, self-hosted): we run a privacy-first analytics system on our own servers. It sets no cookies, does not track you across other websites, and does not store data that identifies you personally. Because it collects no personal data and shares nothing with third parties, it runs without consent. It exists so that we can understand which pages help people without handing that information to anyone else.

Some of our service providers are based in the United States. When your data is transferred outside the UK or EEA, it is protected by appropriate safeguards including the UK International Data Transfer Agreement (IDTA), EU Standard Contractual Clauses (SCCs), or the service provider's participation in recognised data protection frameworks. You can request details of the specific safeguards in place by contacting us.

We use automated content moderation to help keep the bridge respectful. When you submit a candle message, it is automatically scored for potentially harmful content using the Perspective API. Messages that score below the review threshold are approved automatically. Messages above a higher threshold may be automatically held for review. No candle is permanently rejected without the opportunity for human review. If your message is held or rejected, you can contact hello@bridgeoflights.org and a real person will review your submission.

Memorial content (name, dates, message) is kept permanently for as long as the bridge operates: that is the core promise of this service. Your email address and payment records are kept for 7 years as required by HMRC for tax purposes, then securely deleted. If you used a discount code, the IP address recorded against that redemption is deleted after 12 months. A Creators page application we decline is deleted, with your contact details and private answer, 90 days after we decline it. A published listing and its contact details are kept while it is listed, and removed when you ask. Analytics data (if you consented to cookies) is retained by Google for 14 months, then automatically deleted. The note of how you reached us is kept with the order it belongs to. A memorial page, with its words and the candles on it, is kept on the same permanent basis as any memorial content. A memorial page that is started but never paid for is deleted 30 days after it was last changed. The IP address on a report about a page is removed after 30 days, and a request for a candle to join a page lapses after 30 days if it is not answered. QR code scan counts hold no personal data.

We use the following cookies:

Strictly necessary cookies (no consent required, set automatically):

• PHPSESSID: a session cookie used for security (CSRF protection) when you interact with forms. Expires when you close your browser.

Preference cookies (set when you interact with the cookie banner):

• bol_consent: records your analytics cookie preference so we do not ask you again. Set only when you click a choice on the cookie banner. Expires after 12 months.

• bol_ad_consent: records your advertising measurement preference in the same way. Set only when you click a choice on the cookie banner. Expires after 12 months.

Analytics cookies (only set with your explicit consent):

• _ga, _ga_*: Google Analytics cookies that help us understand how visitors use the site (e.g. which pages are visited, how long people stay). The cookies persist in your browser for up to 2 years, but Google Analytics retains the underlying data for a maximum of 14 months before automatic deletion. No advertising or user profiling. Analytics defaults to off: these cookies are only set if you actively opt in.

Third-party cookies: a song on a candle sets no cookies, because there is no music player on our pages. If you follow one of its “Listen on” links, the service you open (Spotify, Apple Music or YouTube) may set its own cookies under its own privacy policy.

Advertising measurement cookies (only set with your explicit consent):

• _gcl_*: set by Google Ads to record that a visit arrived from one of our own adverts, so we can measure whether that advert worked. Used only for that measurement. They are not used to build a profile of you, to retarget you, or to serve you adverts, and no adverts are shown on this site. Advertising measurement defaults to off: these cookies are only set if you actively opt in.

You can change your cookie preferences at any time using the Cookie Settings link in the footer. Declining a category prevents the corresponding cookies from being set and, through Google Consent Mode, prevents the corresponding data being sent to Google.

Under the UK GDPR (and, for EEA residents, the EU GDPR), you have the right to:

• Access your personal data (receive a copy of what we hold)

• Rectify inaccurate data (correct your candle details or email)

• Erase your personal data (right to be forgotten)

• Restrict processing in certain circumstances

• Data portability (receive your data in a structured, machine-readable format)

• Object to processing based on legitimate interest

• Withdraw consent at any time (for analytics cookies, via Cookie Settings)

• Human review of automated content moderation decisions

To exercise any of these rights, email hello@bridgeoflights.org. We will respond within one calendar month. There is no fee for making a request, unless it is manifestly unfounded or excessive.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk, or by post at: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. If you are in the EEA, you may also contact your local data protection authority.

We take appropriate technical and organisational measures to protect your data. All connections are encrypted via HTTPS. All payment data is handled entirely by Stripe (PCI DSS Level 1) and never passes through our own servers. Access to personal data is restricted to authorised personnel only.

This site is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has submitted personal data, contact us at hello@bridgeoflights.org and we will delete it promptly.

We may update this policy from time to time. The current version, with the date of last update, is always available on this page. If we make significant changes that affect how your personal data is processed, we will notify affected users by email where possible.

Privacy questions? Email hello@bridgeoflights.org and we respond personally within 48 hours.

Terms of Service  ·  Questions and answers  ·  Return to the bridge