Privacy

Finnela Life, S.L. (single-member company), Spanish tax number B93966844, registered at Av. de la República Argentina, 218 — 08023 Barcelona, Spain. Heirleaf is its trading name.

You can write to hello@heirleaf.com about anything on this page, and a person will answer.

What you write in the book: your name, the year and place you were born, your answers, your dedication, and the cover, its color and the inside design you choose.

Until you give your consent, nothing reaches us. We ask for the box when you save your first answer or go to record it; until then, what you write stays only on your phone or computer. If you started your book before October 28, 2026, that box didn't mention photos: we ask you for the new one, which does, the first time you go to add one.

If you answer by speaking: the original recording and its transcript. We always keep both.

The photos in your book: the ones you add at the end of each chapter, with the captions you write, and the cover photo if you choose a photo cover. We keep them only to make your book. We don't publish them, we don't show them to anyone and we don't use them for anything else; we don't analyze them, we don't recognize faces in them and we don't use them to train anything. Before a photo is uploaded, your own browser removes the information the camera stores in it, such as where it was taken. You can remove a photo or change its caption at any time from your link. A photo you remove leaves your book at once; if you had already asked for the print-shop files, it stays inside those PDFs until we delete them, after thirty days. Everything is deleted with the rest when you ask us to delete your data. The people who appear in them are covered under *When you talk about other people, or they are in your photos*.

If you give us an email address: that address, to send you the link to your book, to tell you when it's ready, and to send you at most one weekly reminder with your next question inside it. If you stop at the payment page and tick the box there, we also send you up to two emails saying your book is waiting, the day after and a week after that, and then no more. They tell you which question comes next and what it costs to continue; they never quote anything you wrote. If you pay, they stop. Legal basis for these two: your consent, which you can withdraw by unticking the box or with one click in either email. We keep the record of when you ticked it, and the wording you saw, for as long as we keep your book. Ticking that box does not add you to our email list. One click stops any of these emails.

We ask for nothing else: no phone number, no address, and not your full date of birth unless you want to give it. The one exception is a printed copy, if you order one: see the next paragraph.

If you order a printed copy (for delivery in the United States or Spain, and only if you ask for it): you type your name, delivery address, phone number and email on Stripe's payment page. They stay with Stripe, not in our database, and we look them up there only to send your copy to the printer and to email you about your order. Lulu needs the phone number for the delivery company, which calls if it can't find the house. Your address and phone number are used only to deliver that copy; we never use them to market to you or for anything else. What we keep is the order itself: its number, the country, the number of pages, the amount, its status and dates (when it was paid, when it went to the printer and when it shipped), the tracking link, and the date and version of the two boxes you ticked: that you approved the text, and that you agreed to send your book to the printer.

If someone other than the writer pays for it. When the email used to pay isn't the one on the book, we email the address on the book to ask the person who wrote it for their yes before anything goes to the printer, and we keep when they said yes or no. That email says how many pages the book has and that it is going to an address in the United States; it never says who paid or where it is going.

If you give the gift with the hardcover. You pay on Stripe's payment page, not Paddle's: Stripe collects your card, name, email and billing country, as explained under *Where your data lives*. We don't copy your email address into our database: we ask Stripe for it when we need to write to you — to send you your code, and to tell you if the hardcover is running late. The person writing the book chooses where the hardcover goes and ticks the box to send it to the printer. We never tell you the address, the date or anything in the book. If you ask for the hardcover part back, we only tell you whether the hardcover has already been ordered.

If you were given the hardcover with your gift, you order it from your book as explained above, on a Stripe page that says $0.00, where you type the address and the phone number. They stay with Stripe in the same way, and the person who gave it to you never sees them.

And we keep this ourselves, you don't give it to us: when your link was first opened, and a record of which emails we have sent you and when. If you answer by speaking, we also keep the recording. And if somebody gave you Heirleaf as a gift, we have your name and email address because that person gave them to us when they bought it.

The country you're connecting from, which our hosting provider works out from your connection, to show you the price in your currency and, if you're paying for your book from outside the United States, the box about your right to cancel. We don't store it, or your IP address.

If you arrived through one of our ads: the link carries a short code for that ad — for example ?c=fb-october — and nothing about you. We don't store it in your browser: it travels with the web address while you're here. We keep it with your book and, if you pay, with the payment, which Paddle also sees. It only tells us which ads are worth paying for; it is never used to find out anything about you. Legal basis: our legitimate interest in knowing that. It is deleted with your book, and on the payment it is kept as long as the payment record, which tax law sets. You can object by writing to hello@heirleaf.com. If you open us from inside Facebook or Instagram, their in-app browser may record which pages you visit; that is theirs, under their own privacy policy, and nothing from it reaches us. Ad platforms also add their own click code to the address (such as fbclid): we don't read it or store it, and it only stays a few days in our host's technical logs, like any web address.

If you came from a site that recommends us: some newsletters, podcasts and websites that write about Heirleaf earn a commission when someone buys. Their link carries the site's name — for example ?ref=yournewsletter — and nothing about you. We don't store it in your browser or with your book: it travels with the web address while you're here, and if you buy, we keep it with the payment, which Paddle also sees, so we know whom to pay. We never tell that site who bought: it gets a monthly count of sales and nothing else. Legal basis: our legitimate interest in paying the people who recommend us. It is kept as long as the payment record, which tax law sets. You can object by writing to hello@heirleaf.com.

If you ask for one of our printable lists by email: see *If you ask for one of our printable lists by email*, below.

When you write to us — to hello@heirleaf.com or from the form on /contact — we handle your email address, your message and, if you fill it in, the link or code you give us. There is no captcha and no tracker on that page. We do not store your IP address in our database; our host, Vercel Inc. (United States), does log it for a few days in its technical records, for security.

What for: to answer you, and nothing else. Writing to us doesn't add you to any list, and we don't use that address for advertising. Our email list is separate, and you only join it if you sign up for it yourself.

Legal basis: our legitimate interest in answering people who write to us, and pre-contractual steps if you ask before buying. We don't ask for your consent because none is needed to reply to you.

How long we keep it: for as long as the conversation lasts and up to a year afterwards, in case you write again about the same thing. Then it's deleted. If you ask us to delete it sooner, we delete it sooner.

Who sees it along the way: the message travels through Resend, our sending provider, and rests in our mailbox. Neither does anything with it other than deliver it.

The form also sends you a copy of your own message. That's deliberate: it gives you a record of what you sent and of the address we'll be replying to.

On some pages you can have the printable list of questions emailed to you. The same list prints from the page itself with no email at all: giving us your address is never the price of the questions.

If you don't tick the box: we send you the list in one email and keep nothing. Your address isn't stored; all that remains, for one day, is a scrambled fingerprint of it, so the form can't be used to flood someone's inbox.

If you tick the box and confirm: you join our email list. What we keep: your email address, the language, which list you asked for, and when you asked, confirmed and, if you do, unsubscribed — with the version of the wording you agreed to. Nothing else: not your name, not your IP address.

What for: to send you the list and the emails you signed up for: four before Christmas, counting the one with the questions — why we made Heirleaf, a finished sample book, a gift idea and the Christmas dates. After that, the odd email when there's something worth telling, never more than one a month.

Legal basis: your consent, which you give by ticking the box and confirming from the email we send you. You can withdraw it with one click from any of those emails, by replying "stop", or by writing to hello@heirleaf.com. Withdrawing it doesn't affect what was sent before.

No tracking: these emails carry no tracking pixel and their links are not rewritten to count clicks. We don't know whether you open them.

Separate from any book: this list never meets anything anyone writes or says in a book. We don't put book data in our email provider, we don't match one against the other, and we never upload the list to any advertising platform.

Who handles it: we keep the list ourselves, in our own database (Supabase, the same one that holds books but in a separate table that is never matched against them), and the emails are sent by Resend (United States), the same provider that emails you the link to your book, with no tracking and the safeguards explained below. Neither may use your address for anything else.

For how long: for as long as you stay on the list. If we ever stop sending these emails, we delete the whole list. Requests nobody confirms are deleted after a week. If you unsubscribe, we don't write to you again, and we keep the record of your consent and your unsubscribe for three years, in case we ever have to show we had it.

On the gift page you can ask us to write to you once before Christmas, on December 9, 2026, to remind you about Heirleaf.

What we keep: your email address, the language, that you asked on the gift page, and when you asked and confirmed, with the version of the wording you accepted. Nothing else: not your name, not who the gift would be for, not your IP address.

What for: to send you that one email. Nothing else, unless you also tick the box for our email list: then what *If you ask for one of our printable lists by email*, above, says applies as well.

Legal basis: your consent, which you give by pressing the reminder button and confirming from the email we send you. You can withdraw it with one click from that email or by writing to hello@heirleaf.com.

For how long: we delete your address after we send the email, and by December 31, 2026 at the latest. So that we can show you asked for it, we keep for three years an encrypted fingerprint of your address, which can't be read back, with the dates. Requests nobody confirms are deleted after a week.

Who handles it: the same as the list: our own database and Resend, with no tracking, never matched against any book and never uploaded to any advertising platform.

We do not train artificial intelligence models on what you tell us, and we do not let anyone we hire do it either. The one narrow exception is Lulu's own, explained under *Where your data lives*: a print file that breaks Lulu's content rules may be used to train the systems that detect that kind of abuse.

We do not sell or license your data.

There is no advertising on the site, no trackers, no profiling and no social media pixels. Our emails don't track you either.

We don't follow your browsing and we don't know who you are. We only keep daily totals of how many times each step of starting a book or giving a gift happens (for example, “saw the first question”), by language and by the ad the visit came from, if it came from one. We don't store your IP address, cookies or any identifier, so we can't tell which steps you took. Those totals are deleted after 90 days. If your browser sends a Global Privacy Control or “Do Not Track” signal, we don't count your visit. If it doesn't, this link does the same: we won't count you until you leave the site.

We do not read your answers out of curiosity. They are only accessed if you ask us for help with a specific problem and it is needed to solve it.

You, with your link. The link is the key: there is no username or password to remember, which is why it is worth not publishing it or forwarding it to anyone you would rather not have read it.

If somebody gave you Heirleaf as a gift, that person sees nothing you write. Not an answer, not a photograph, not your progress. They know you redeemed the code, and that is all. It is a product decision, not a setting you have to turn on. If they gave you the hardcover too, they aren't told whether you have ordered it, or where it goes; if they ask for the hardcover part back, we only tell them whether it has already been ordered.

If you order a printed copy, Lulu, the printer that makes it, receives your whole book with its photos, and the people who print, bind and check it see its pages. That only happens if you order it and tick the box that says so. And because the link is the key, anyone who has your link could also order a printed copy of your book, paying for it, and have it sent to another address. That is why, if they don't pay with the email on your book, we email you first, and nothing goes to the printer without your yes. One more reason to keep your link to yourself.

Your book is going to name living relatives and friends — your mother, your husband, the neighbor upstairs — and some of them will be in your photos. That data is never published or indexed, and only people with the link to your book can see it. Who gets that link is up to you.

If you order a printed copy, what your book says about them, and their photos, also goes to the printer to be printed, as explained under *Where your data lives*. It is used for nothing else.

If someone else is in a photo, only add it if you may: if they are alive, ask them first, especially if it shows them ill, in hospital or in a private moment; if it's a child, ask their parents.

We cannot notify each person you mention or who appears in your photos one by one — we have no contact details for them and no idea who they are — so we rely on Article 14(5)(b) of the General Data Protection Regulation, which lifts that duty where it would take disproportionate effort. We keep what your book says about them, and their photos, on the basis of your legitimate interest and ours in letting you tell your life (Article 6(1)(f)): it never leaves your book, we don't analyze it, and it is deleted with it.

If somebody you have mentioned or who appears in one of your photos, or the family of someone who has died, wants to know what your book holds about them, or wants it removed, they can write to hello@heirleaf.com. We will talk to you about it first: the book is yours. But we are responsible for what we keep, so if they have good reason, we may have to remove a photo of them, and we will tell you before we do. That conversation is had by a person, not by a form.

On Supabase servers in the United States (region us-east-1). That is where your book, your recordings and your photos are kept. We say it plainly because almost nobody does: if you are in the European Union, your data leaves it.

The website is served by Vercel Inc. (United States), which logs your IP address for a few days in its technical records.

Emails are sent by Resend (United States; it sends them from Ireland), and payment is handled by Paddle, who act as an independent controller of the payment data and not as our processor. The gift with the hardcover is paid through Stripe instead, as explained below.

If you answer by speaking, your recording travels to AssemblyAI (United States) to be turned into text. We have switched off their use of that audio to train their models, and they delete it after three days. Our own copy of the original recording stays with us: it is what lets you check what you actually said if the machine writes it down wrong.

If you ask for the print-shop files, your book, with its photos, is laid out on a Fly.io server in the United States (Virginia), which makes the two PDFs and keeps nothing: it deletes them when it's done. The PDFs are stored in our Supabase storage only to send you the links, and we delete them after thirty days or when you delete your book.

If you order a printed copy from us (for now, for delivery in the United States or Spain; we will open the rest of the European Union later), we send your whole book, with its photos, as two print files to Lulu Press, Inc. (United States). Lulu sends each order to the plant it works with nearest the delivery address: for the United States, one of its plants in Utah, Wisconsin or Massachusetts; for Spain, one in Europe, usually in France, though it also works with one in the United Kingdom. If the nearest one can't take it, it may send it to another of its plants. There it is printed and handed to a delivery company. Lulu receives the book, your name, your address and your phone number; the delivery company sees your name, address and phone number, not what's inside the parcel. Lulu works for us as our processor and may use all this only to print, deliver and, if needed, reprint your copy. The one exception is Lulu's own: a file that breaks its content rules, such as illegal content, may be used to train the systems that detect that kind of abuse. Legal basis: the contract for the printed copy and, for what your book says about your health, your beliefs, your origins or your private life, the explicit consent of the person who wrote it, given by ticking the box before paying or, if someone else pays, by pressing “Yes, print it” in the email we send them. That consent can be withdrawn at any time. If the order hasn't gone to the printer yet, we cancel it and refund it in full; if it has, the copy can't be called back, but we tell Lulu to delete the files.

The payment for a printed copy is handled by Stripe (Stripe Payments Europe, Limited, Ireland, which also processes data in the United States), not by Paddle. Stripe collects your card details, name, address, phone number and email on its own payment page. It keeps the delivery details on our behalf, so that we can send your order, and handles the payment, fraud prevention and its own legal duties as an independent controller, under its own privacy policy. We pass it the email on your book so you don't have to type it again. Stripe never receives your book: only the order number, the amount and a line such as “Printed book · hardcover · 112 pages”. It also handles the payment for the gift with the hardcover, in the same way: there, it never receives the name of the person you are giving it to, or yours unless you type it on its page.

Our email list, if you join it, is kept in our own database, separate from books, and its emails are sent by Resend. See *If you ask for one of our printable lists by email*, above.

Those transfers outside the European Union rely on the European Commission's standard contractual clauses, which form part of our contract with each provider, Lulu included. For people in the United Kingdom, the same clauses apply together with the UK Addendum issued by the Information Commissioner, Lulu included; where a provider uses the UK's own instruments instead (the IDTA, or the UK extension of the Data Privacy Framework), that is what covers it. If your copy is printed in the United Kingdom, that last step is also covered by the European Commission's adequacy decision for the United Kingdom; if it is printed in France, it doesn't leave the Union. Stripe and Paddle, for what they do as independent controllers, answer for their own transfers. You can ask us for a copy by writing to hello@heirleaf.com.

Your book, for as long as you like. This product exists to last, and a paid book has no expiry and no automatic tidying up: deleting someone's book because they haven't logged in for months would be the opposite of what we sell. The exception is a book that hasn't been paid for. If a year goes by without anyone writing in it, we delete all of it, with its recordings and photos, because nobody has bought it and there is no reason to keep it. If you gave us your email address, we tell you thirty days before, and writing something in it, or paying for it, is enough to stop it being deleted. Books started before September 25, 2026 are not deleted this way: we promised those free reading for good.

If you ask us to delete it, we delete it: answers, recordings, photos and link, within thirty days at most and usually the same day. We keep no separate copy: the automatic database backups renew themselves, and as they do, it drops out of them too. Whatever you have already downloaded is yours, and that we can neither recover nor delete.

Emails you write to us are kept for as long as the conversation lasts and up to a year afterwards, in case you write again about the same thing.

The record of which emails we have sent you is kept for two years, so we can answer if you ever tell us something never arrived.

Recordings that travel out to be transcribed are deleted by the provider after three days. Ours stays with your book, because it is what lets you check what you said.

Billing records are kept for as long as tax law requires, and that part we cannot delete even if we want to.

If someone gave you Heirleaf, or you gave one. From the gift order we keep the name and email address of the person receiving it, the name of the person giving it, and the dedication. Those are deleted on their own: thirty days after the code is redeemed, or fifteen months if it never is. After that all that remains is the record that a gift existed — the code, its status and the dates — which says nothing about who anyone is. And if you ask us sooner, we delete it sooner.

If you join our email list: for as long as you stay on it, and the record of your consent for three years after you leave it. The details are in *If you ask for one of our printable lists by email*, above.

If you ask us to remind you about Heirleaf before Christmas: your address, until we send that email and by December 31, 2026 at the latest. The details are in *If you ask us to remind you about Heirleaf before Christmas*, above.

If you order a printed copy. We keep the order for as long as tax law requires, like any other payment; it holds no address. Our copy of the print files is deleted 35 days after your copy leaves the printer, or sooner if you delete your book. Lulu doesn't delete files on its own, so we instruct it to: every month, for copies delivered more than 30 days earlier, and on the same day if you ask us to delete your data. Lulu has 30 days to carry it out, so your book and address stay with Lulu for up to about three months after delivery. After that, Lulu keeps only the order records the law requires it to keep. Stripe keeps the payment and delivery details for as long as the law requires of it, as its privacy policy explains. If you delete your book before the order goes to the printer, we cancel it and refund it in full.

You can ask to see what we hold, to correct it, to take it elsewhere, to limit what we do with it, to object, or to delete all of it. Write to hello@heirleaf.com and a person will answer.

We make no automated decisions about you. A machine writes down what you dictate, but it decides nothing about you and you can correct it.

If you live in the European Union and think we have got it wrong, you can complain to your country's data protection authority; in Spain, the Agencia Española de Protección de Datos.

If you live in the United Kingdom, you can complain to the Information Commissioner's Office (ico.org.uk). You can also complain to us first at hello@heirleaf.com: a person will reply, and we will acknowledge your complaint within thirty days.

If you live in California, you also have the right to know what we collect and to ask us to delete it, and not to be treated worse for asking. We do not sell or share personal information in the CCPA sense, so there is nothing to opt out of.

One, and only if you change language: it remembers which language you want the site in. There are no analytics or advertising cookies, so there is no banner to accept either. The step count uses no cookies and stores nothing on your device.

“Do Not Track” and Global Privacy Control signals. We do not track your browsing, here or across other websites. If your browser sends either signal, we also leave your visit out of the step totals. No third party collects information about you through this site, except Paddle's checkout when you press pay (see *Payment*). If you order a printed copy, Stripe's payment page, which is Stripe's and not ours, uses its own cookies and device data to prevent fraud. The same goes for its page when you give the gift with the hardcover, or order a hardcover that came with your gift.

Payment is handled by Paddle, who act as the seller and process your card details. We never see or store your card number: we only know that the purchase was made. When you press pay, Paddle's checkout opens and loads its own scripts, including one from its own analytics service, which we cannot switch off. They are Paddle's, under Paddle's privacy notice, and they never load on a page of your book.

A printed copy is paid through Stripe, not Paddle, in a separate payment. The exception is the gift with the hardcover: the whole gift, the digital book and the hardcover, is paid through Stripe in one payment, and Paddle has no part in it. Stripe processes your card details; we never see your card number. If you choose to pay with PayPal on that page, you go to PayPal's own page (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), which handles your details as an independent controller under its own privacy policy; we never see your PayPal account. We have switched off Stripe Link, so paying doesn't open an account with Stripe in your name.

Heirleaf is a product for adults and is not intended for anyone under eighteen. We do not knowingly collect their data. If someone has given you a book and you are under eighteen, write to us before redeeming it and we will sort it out.

Your children or grandchildren appearing as small children in your memories or your photos is a different matter. That is your story and you are the one telling it. What you write about them, and their photos, we keep only inside your book, like everything else: we don't publish it, we don't analyze it, only people with your link can see it, and it is deleted with it.

We will say so on this page, with the date. If the change matters and we have your email address, we will write to you.

Updated October 31, 2026: what is paid through Stripe (a printed copy and the gift with the hardcover) can now also be paid with PayPal, which handles your details on its own account. If you pay by card, nothing changes.

Updated October 30, 2026: the gift with the hardcover, paid through Stripe: what Stripe sees when you give it, that we don't keep your email but ask Stripe for it, that the person who gave it never sees where the hardcover goes, and the $0.00 Stripe page where the writer types the address. Nothing changes if you don't give or receive one.

Updated October 30, 2026, afternoon: a printed copy can now also be ordered for delivery in Spain; the rest of the European Union will follow later. We explain where Lulu prints it then — at a plant in Europe, usually in France, or in the United Kingdom — and what covers that transfer. Nothing changes if you don't order one.

Updated October 29, 2026: we explain what a printed hardcover of your book adds, for delivery in the United States: your address and phone number, kept by Stripe; Lulu, the printer, and how long it keeps your book; the box you tick before paying; and the email we send the writer if someone else pays. Nothing changes if you don't order one.

Updated October 28, 2026: we explain what Facebook and Instagram's own browsers and Paddle's checkout can see. Nothing changes in what we collect.

Updated October 28, 2026: you can add photos at the end of each chapter, in *What we keep*, and the consent box now covers them; the people in them, in *When you talk about other people, or they are in your photos*. A book that hasn't been paid for is deleted after a year with nobody writing in it, with notice first, in *For how long*. And we corrected *Children*: we do keep what you tell about your children and grandchildren, and their photos, inside your book.

Updated October 21, 2026: on the gift page you can ask us to remind you about Heirleaf once before Christmas, in *If you ask us to remind you about Heirleaf before Christmas*. Nothing changes for your book.

Updated October 14, 2026: if you stop at the payment page, you can ask us to remind you twice that your book is waiting, in *What we keep*. And we explain that we use the country you're connecting from.

Updated October 13, 2026: we count, as totals and without knowing who, the steps of starting a book or giving a gift, in *What we do NOT do*.

Updated October 8, 2026: we added our email list, in *If you ask for one of our printable lists by email*. Nothing changes for your book.