Skip to put a heart
1M Hearts

Privacy

Your note will be public. Your email will not.

This notice tells you who holds your personal data, why, how long, who sees it, and what you can do about it. It covers the UK GDPR and the Data Protection Act 2018, and cookies under PECR.

One Million Hearts is operated by Inoveb Ltd, a company registered in England and Wales (Companies House 10579627). VAT GB309553007. Registered office: 72 Badminton Road, London, SW12 8BL, United Kingdom. Email: hello@onemillionhearts.co.

Inoveb Ltd is the data controller for One Million Hearts (onemillionhearts.co). We have not appointed a data protection officer (we are not required to). There is no UK representative because we are established in the UK. Write to hello@onemillionhearts.co or to 72 Badminton Road, London, SW12 8BL, United Kingdom.

Last updated 9 September 2026.

The wall is public

Hearts on the wall are meant to be seen. Anyone can read the message, optional from / for / city, colour, and, for forever hearts, the number. Search engines may list forever hearts. Skip addresses, phone numbers, and anything that belongs only to you and them.

What we collect

We collect this from you when you use the site:

  • Email, if you give us one or Google, Apple, or Facebook send one: to sign you in and to write to you about your hearts (a code, when a note goes up, when it doesn’t).
  • A name from Google, Apple, or Facebook, when they send one and we don’t have an email. That is how we recognise the account.
  • If you sign in with Google, Apple, or Facebook, they tell us enough to let you back in.
  • The note: message, optional names and city, colour, and whether it is free or forever.
  • Enough to slow abuse. We don’t keep your internet address or the name of your browser.
  • Reports you send, including the reason.
  • A record that you paid for a forever heart. Cards are handled by Stripe. We don’t keep your card number.
  • Stats about how the site is used, without tracking cookies, so we can improve it.

We may also receive a report about your note from another person. That is the only personal data we typically get from someone other than you.

Site analytics

We collect stats, without tracking cookies, to understand how the site is used and to improve it. They are not advertising, and they are not tied to your note or your email.

Why we use it, and the lawful basis

  • Contract: creating your account, putting a note up, taking $3 to keep it forever, sending the mail that goes with that, and keeping you signed in.
  • Legitimate interests: keeping the wall kind, slowing spam and abuse, reviewing reports, defending the project, basic security, and understanding how the site is used so we can improve it. Those interests are running a public wall that stays safe enough to exist. You can object (see below).
  • Legal obligation: tax, accounting, and fraud records around a payment.

We do not rely on consent as the UK GDPR basis for the core service. Paying for a forever heart forms the contract; that is not a GDPR consent. We do not send marketing mail. Status mail (sign-in codes, codes to close your account, approved, rejected) is part of the service.

We do not make solely automated decisions, including profiling, that have legal or similarly significant effects on you. Rate limits and Stripe’s fraud checks are not used to grant or refuse a legal right. A person looks at reports and at notes we review.

Payments and Stripe

Forever hearts cost $3. We use Stripe for payment, tax, and fraud detection. Stripe collects the card, billing details they need for the charge and for tax, and whether you accepted the Terms. Stripe is an independent controller for much of that payment data. Read Stripe’s notice: stripe.com/privacy. See also Refunds.

Cookies

We only keep what we need to keep you signed in and to make My hearts work. We don’t use advertising cookies. We collect stats without tracking cookies.

You can sign out or erase your account from My hearts. Erasing emails you a code first if we have an email for the account. If you signed in with Google, Apple, or Facebook and we have no email, you confirm it while signed in. Clearing this site in your browser signs you out here. It does not delete the account on our side.

How long we keep it

  • Email stays on the account until you erase it, or we close the account. A name from Google, Apple, or Facebook is kept the same way when we have no email.
  • A free heart leaves the wall 30 days after it goes up. We may keep a record that it existed. The public message does not.
  • A forever heart stays in our records even if you take it down or erase the account. The public text can still come down.
  • Abuse-prevention data on notes and reports is cleared after 6 months.
  • If you erase the account, a private log of the note (including from, city, and for) is kept for 6 months so we can see what happened, then cleared. It is not shown on the wall.
  • Payment and accounting records are kept as long as tax and company law require, usually six years.

Who else sees it

Here’s who may see it:

  • The public, for anything you put on the wall.
  • Stripe (including Stripe Payments UK Ltd and affiliates) for cards and tax.
  • An email provider, to send codes and status mail.
  • Google, Apple, or Facebook, if you choose to sign in with them. They send us enough to recognise the account, and usually an email and a name.
  • The company that hosts the site.
  • Moderators, who see notes waiting for a look, including the author’s email or name.
  • Professional advisers or authorities if the law requires it, or to defend a claim.

Some of that (Stripe in particular) may involve a transfer outside the UK, including to the United States. Where the UK has not found that country’s law adequate, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or another safeguard the UK GDPR allows. You can ask hello@onemillionhearts.co for a copy of the relevant clauses, so far as they can be shared.

Your rights

You can take a heart down from My hearts. You can erase the account there too. If we have an email, we send a code first. We drop your email or sign-in name, take your notes off the wall, and sign you out. Taking a paid heart down doesn’t send the money back by itself. Within 14 days of payment, write to us and we’ll refund you.

You can also ask us to:

  • give you a copy of what we hold (access)
  • correct it (rectification)
  • erase it, where that right applies
  • limit how we use it (restriction)
  • send it to you or another service in a portable form

Write to hello@onemillionhearts.co. We may need to confirm it is you. We will answer within a month, or tell you if we need more time.

You can complain to the Information Commissioner’s Office: ico.org.uk, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Your right to object

You have a right to object to processing we do on the basis of legitimate interests, for example slowing abuse. Email hello@onemillionhearts.co and tell us what you object to. We will stop unless we have compelling grounds, or the processing is for a legal claim. Objecting does not always mean we can keep providing the wall to you.

Children

You must be 16 to put a heart on the wall or create an account. We don’t knowingly collect email from anyone younger. If we learn we have, we’ll erase it.

Changes

If this notice changes in a way that matters, we’ll update this page and the date above. The current version always lives here.