Privacy Policy

Controller under the GDPR: Schmitz Universe, owner Jonas Schmitz, Friedrich-Mohr-Straße 1, 56070 Koblenz, Germany, email: contact@lovewallglobal.com. See also our Legal Notice.

Provided by you: names/initials, date, location, love message, optional photos, relationship type, timeline milestones and gift details.

Purchase data: you enter your email address in our own payment form. We store it together with your order BEFORE you are forwarded to Stripe — including when you abandon the payment afterwards.

Billing data: your billing address (name and postal address, optionally phone number) is collected by our payment provider Stripe on its payment page; we take it over onto your order after a successful payment — for contract performance and invoicing. We never see your card details.

Collected automatically: technical access data (timestamp, browser type, requested address) via our hosting provider.

One cookie of our own: “NEXT_LOCALE” remembers your language choice (lifetime one year). It is strictly necessary so that the site and our emails appear in your language, contains only the language code and is not analysed. Cookies requiring consent are only set after you agree (see section 8).

Your IP address: it is processed briefly in our server's memory on each request to throttle abuse (rate limiting). It is used in full, but neither stored permanently nor linked to your Love Mark or your order; the entry expires by itself after a short time (Art. 6(1)(f) GDPR — legitimate interest in a working, abuse-free service).

Reports: if you report a Love Mark, we store the reported Love Mark, the reason and your free text — so that we can review the case and detect abuse (Art. 6(1)(f) GDPR). Please do not write anything there that does not belong to the matter.

Stored on our servers: your Love Mark details and optional photos are stored with our database provider Supabase (Postgres database in the eu-central-1 / EU region; photos in a private storage bucket). You decide whether a Love Mark is public, unlisted or private.

Stored locally in your browser (localStorage): your storage consent and cookie choice, your language choice, your signed-in email account including its session key (that is what keeps you signed in; it expires and is deleted when you sign out), an unfinished draft, a cache of your own Love Marks and a cache of the public Wall (counters and the publicly visible Love Marks, so the Wall is there instantly offline and on your next visit). Plus a few interface markers — such as whether you have already seen a hint. No tracking, no advertising cookies; you can delete all of it in your browser at any time.

Providing the service and your Love Mark (Art. 6(1)(b) GDPR — contract).

Reach/sharing only at your initiative; you control public visibility via the privacy setting.

Security, abuse prevention and moderation (Art. 6(1)(f) — legitimate interest).

Payment processing at purchase (Art. 6(1)(b)) via the payment provider Stripe.

Annual anniversary reminder to the email address you provided — part of the service promised at purchase (Art. 6(1)(b) GDPR). You can unsubscribe at any time via the link at the foot of every reminder; we then stop permanently.

We use carefully selected processors: Vercel Inc. (hosting/infrastructure, USA), Supabase (database, authentication and file storage; eu-central-1 / EU region), Stripe (payment processing, USA) and Resend (sending transactional emails such as purchase, gift and anniversary messages).

If you choose PayPal or Klarna on the payment page, Stripe passes the data needed for the payment to that provider (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg; Klarna Bank AB (publ.), Sweden). Both act as independent controllers under their own privacy notices — we receive no payment data from them, only the confirmation of whether the payment succeeded.

These providers process data on our instructions as processors or — where they act on their own responsibility (in particular Stripe, PayPal, Klarna) — under their own privacy notices. Data processing agreements under Art. 28 GDPR are in place with the processors.

Only upload photos and names you have the rights to and for which everyone shown has consented.

Affected people can request removal of their name or image — with no exposure and no public labelling. Use the report function or contact@lovewallglobal.com.

Love Marks are designed to last (“forever”) but remain under your control: you can make them private or archive them. Technical logs are kept only as long as necessary for security and operation.

Order and invoice data (purchase date, amount, package, billing address) are kept separately for as long as commercial and tax law require us to retain them. We therefore cannot delete this data even when a Love Mark is deleted — retention is required by law (Art. 6(1)(c) GDPR).

Your account exists until you delete it. Deleting it removes the associated sign-in data; the exception for invoice data above remains unaffected.

We keep reports for as long as the case is open, and after that for at most twelve months — long enough to spot repeat abuse, and no longer.

Audit trail: when a Love Mark is deleted or the payment status of an order changes, we record that event together with the data concerned — so that an accidental deletion can be undone and so that we can show what happened if there is a dispute (Art. 6(1)(f) GDPR). This record is deleted automatically after 30 days.

Abandoned purchases: if you cancel at the payment step, an unpaid order with your draft remains for a while — that means both names, date, place, message, relationship and design details, the approximate coordinates of the place and, if you selected any, your photos and voice recording — so that a late payment or a question can still find it. After 30 days at the latest we delete that draft automatically. What remains is the order row itself: time, amount, package, status — and your email address, because it is the only link to a payment that may still arrive. You can ask us to delete it at any time, informally, at contact@lovewallglobal.com; we then delete it together with the order row.

You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR).

You also have the right to lodge a complaint with a supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (LfDI RLP), Hintere Bleiche 34, 55116 Mainz, Germany.

Only if you expressly consent in the cookie banner (Art. 6(1)(a) GDPR) do we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to analyse how the site is used and to improve it. Without consent, no analytics script is loaded and no analytics cookies are set.

We run Google Analytics in a data-minimising configuration: IP anonymisation, no Google signals, no personalised advertising.

You can withdraw your consent at any time with effect for the future — via “Cookie settings” in the footer.

Where data is transferred to Google LLC in the USA, Google relies on the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

The Love Mark data itself is stored in the EU (Supabase, eu-central-1 region). With providers based in the USA (Vercel, Stripe, and where applicable Google), a transfer to the USA may occur; such transfers are based on appropriate safeguards, in particular the EU Standard Contractual Clauses (SCC).

For privacy requests: contact@lovewallglobal.com.