Privacy Policy

1. Who we are

Bridgelight is run by an independent operator based in the Republic of Korea ("we", "us"). We are the controller of the personal information described here. You can reach us at any time through our contact form at bridgelight.pet/contact. That form is also how you send privacy requests. Person in charge of privacy (privacy officer, including under Quebec's Law 25 and Korea's PIPA): the operator of Bridgelight, reachable through the same form.

2. What we collect

Memorials: the pet's name, species, breed, dates, story, photos, video, theme and visibility setting that the creator enters. A pet's details are not personal information, but photos and stories can include people, places or names, so please share only what you are comfortable with.

Email (optional): if a memorial's creator gives an email address or turns on notification emails, we keep that address and the language they use. Notification emails start only after the address is confirmed through a link (double opt-in).

Edit key: when you create a memorial, a private key is saved in your browser so you can edit it later. We keep only a scrambled (hashed) copy, so we cannot read or recover it.

Letters, candles, flowers and garden notes: the words and the optional name that visitors write. These appear on the memorial for anyone who can open it.

Anti-abuse and counting data: to stop spam and to count "people who visited today", we keep salted, one-way hashes of IP addresses and of a random device id stored in your browser. We do not store raw IP addresses in our database. Daily visitor ids change every day and differ for every memorial, so visits cannot be linked across days.

"Match my photo" (optional, 16+): if you choose a photo of yourself to dress your 3D garden figure, it is shrunk in your browser and sent once to Anthropic, which returns only a hair style and four colors (hair, skin, top, bottom). We do not save the photo, do not read facial features or identity, and do not create face templates or any biometric data. The colors are kept only in your browser and shown to people in the same garden or meadow as your figure. You can change or clear them at any time.

Contact requests: the email, link and message you send through the contact form.

Server logs: our host (Vercel) automatically records technical data such as IP address, browser type and the page requested, for security and troubleshooting. These logs are kept for a short time by Vercel.

We do not collect payment details today. If paid features are added later, payments will be handled by a payment provider and we will update this policy first.

3. Why we use it (and our legal basis)

To provide the memorial, letters, the shared meadow and the 3D garden you asked for (performance of a contract).

To send notification emails you asked for (your consent, which you can withdraw at any time with the unsubscribe link in every email).

To prevent spam, abuse and illegal content, keep the service secure and count daily visitors (our legitimate interest in running a safe, gentle service).

To answer your requests and meet legal obligations (legal obligation and legitimate interest).

We never sell personal information, never share it for advertising, and never use it for automated decisions that have legal or similarly significant effects on you.

4. AI features

Some features use AI providers. If switched on, a memorial's cover photo is sent once to Anthropic to describe the pet (breed, size, coat colors) so the 3D garden can show a similar-looking pet. If the owner asks for an AI portrait, the chosen photo is sent to fal.ai to paint it.

We send only the photo needed, never your email. AI portraits are artistic images created by a computer, not real photos, and are labeled "AI-generated" on the site.

5. Who helps us run Bridgelight

We use these service providers. They process data on our behalf, only to provide their service to us:

• Supabase (database and photo storage; servers in the United States, AWS us-east-1).

• Vercel (website hosting and server logs; United States and a global edge network).

• Resend (sending owner notification emails, only if you turn them on; United States).

• Anthropic (reads a memorial's cover photo once to shape the pet in the 3D garden, and, only if you choose "Match my photo", your own photo once to color your garden figure; if that feature is on; United States).

• fal.ai (paints AI portraits from a photo, only when the owner asks for one; United States).

• Cloudflare (domain name and DNS only; it does not see page content).

We may also disclose information if the law requires it, or to protect people from harm.

6. International transfers

Our providers store data mainly in the United States. When data moves from the EU, UK or Korea to the United States, we rely on the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses and the UK addendum, as set out in their data processing terms.

7. How long we keep it

Memorials, photos, letters and garden items: until the owner deletes them or the memorial (deleting a memorial deletes everything attached to it).

Notification email address: until you unsubscribe, change it, or the memorial is deleted. Unconfirmed addresses are not used.

Daily visitor ids: deleted after 30 days.

Email sending log (no email addresses, only counts and hashes): deleted after 90 days.

Contact requests: up to 3 years, so we can show how a request was handled, then deleted.

Copies may remain in our providers' backups for a short time before they are overwritten.

8. Your rights

Depending on where you live (for example Korea, the US, the EU, UK, Canada including Quebec, Australia, Japan or Taiwan), you can ask to access, correct, delete or receive a copy of your information, object to or restrict how we use it, and withdraw consent at any time.

Owners can edit or delete a memorial themselves from the memorial page. For anything else, such as removing a letter you wrote or getting a copy of your data, use the contact form and choose "Privacy request". We reply within 30 days. We may ask a question to confirm the request is really yours, for example proof that you hold the edit key.

California residents: we do not sell or share personal information as those terms are defined in the CCPA/CPRA, and we will not treat you differently for using your rights.

You can also complain to your local data protection authority (for example Korea's Personal Information Protection Commission, your EU supervisory authority, the UK ICO, the Office of the Privacy Commissioner of Canada or Quebec's CAI, the OAIC in Australia, Japan's PPC, or Taiwan's PDPC). We would appreciate the chance to fix things first.

9. Cookies and browser storage

We use no advertising or analytics cookies and no third-party trackers, so we do not show a cookie banner. We use only what the site needs to work:

• bl_lang cookie: remembers your language choice for 1 year.

• Browser storage (localStorage) on your device: your memorial edit key, an unsent memorial draft, which letters you reported, a random device id for anti-spam and daily visit counting, and 3D garden settings such as sound, your name and your figure's look.

• An operator login cookie, used only by the site's operator.

You can clear these at any time in your browser settings. If you do, you may lose the edit key for a memorial you created, so please keep the owner link we show you.

10. Children

Bridgelight is not meant for children. You must be at least 16 to create a memorial, write letters or give us an email address. If you believe a child has given us personal information, contact us and we will delete it.

11. Security

Data travels over HTTPS. Database tables are closed to the public and reached only through our server. Edit keys and abuse ids are stored only as hashes. No system is perfectly secure, so please do not post anything you need to keep secret.

If a data breach could seriously harm you, we will tell you and the relevant authorities as quickly as the law requires (for example within 72 hours in Korea and the EU).

12. Changes

If we change this policy, we will update the date above and, for important changes, show a notice on the site before they apply.

13. Contact

Questions or requests: bridgelight.pet/contact.