Privacy Notice

Who is responsible

HeldJoy, the registered business operated by Joy Moore, is the data controller for personal information processed to provide HeldJoy’s website and services. Contact heldjoyconnect@gmail.com with privacy questions or requests.

Information and purposes

• Name, email, session choice, preferred time, and optional notes: to prepare checkout, process a paid request, contact you, and arrange and provide your session.
• Consent acknowledgements, their version and date, payment references, payment status, and selected price: to record your choices, verify payment, handle support, and prevent duplicate requests or fraud. HeldJoy does not store card details.
• Emails and support messages: to respond to questions, cancellations, refund assistance, and privacy requests.
• Text entered in the optional AI session finder: to generate a relevant session suggestion. This text is sent through Lovable’s AI service to its model provider for processing. Avoid unnecessary sensitive details or information about others.
• Technical information, such as IP address, device/browser information, request and error logs: as processed by our infrastructure providers to deliver the website, diagnose failures, and protect it from abuse.

Session notes and conversations may include sensitive information you choose to share. Share only what is necessary. Conversations are not legally privileged or absolutely confidential: information about unlawful activity may be reported to authorities as permitted or required by law.

Legal bases

Where data-protection law requires a legal basis, we use contract performance and steps you request before a contract for service requests and delivery; legitimate interests for support, service reliability, and fraud prevention; and legal obligations for required records or disclosures. Where consent is required, including for sensitive information where applicable, we rely on consent and you may withdraw it by contacting us. Withdrawal does not affect earlier lawful processing.

Who receives information

We share information as necessary with service providers for hosting and data storage (Lovable Cloud), AI processing (Lovable’s AI service and its model providers), email and support delivery, and technical monitoring. Stripe, our payment processor, receives payment details and related information to process payments and prevent fraud, and processes its own data under Stripe’s Privacy Policy. HeldJoy does not receive or store full card details.

Information may also be shared with legal or accounting advisers and authorities where required or permitted by law. We do not sell personal information.

Retention and security

We keep request and correspondence information while needed to arrange and provide services, resolve concerns, or meet legal obligations. Payment and consent records may be retained for applicable accounting, dispute, and legal requirements. Unfinished checkout records and technical logs are kept only as needed for recovery, reliability, and fraud prevention. Information should be deleted or anonymised when no longer needed; contact us to request deletion or details of the retention applicable to your records.

We use appropriate technical and organisational safeguards, including encrypted connections and restricted access to request records. No internet service can guarantee absolute security. Do not email card details or identity documents to HeldJoy.

International processing

Our service providers may process information in countries other than your own. Where UK or EEA data-protection rules apply to transfers outside those regions, appropriate safeguards are required, such as adequacy decisions or standard contractual clauses. Contact HeldJoy for information about safeguards relevant to your data.

Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing and withdraw consent. Email HeldJoy to exercise these rights; we may need to verify your identity using proportionate information. Where GDPR applies, we normally respond within one month, subject to lawful extensions, and you may complain to your data-protection supervisory authority.

Cookies and browser storage

The website uses session storage to retain a pending payment reference and recovery token in your current browser tab. Our hosting and secure checkout providers may use essential cookies or similar technologies for delivery, security, and checkout. HeldJoy does not intentionally add marketing or advertising cookies. You can clear or block storage in your browser settings, but doing so may interrupt checkout or remove payment recovery information. Provider privacy notices describe their own technologies.

Changes and contact

Updates appear here with a revised date. For questions about this notice or the information HeldJoy holds about you, email heldjoyconnect@gmail.com.