Your information, held with care

Effective date: November 01, 2026

Held is a service of Canoa Studio LLC (“Held,” “we,” “us”). This notice explains what personal information we collect, why we collect it, and the choices you have.

1. What we collect

Information you give us

• Your details: name, email, mailing address and, if you add it at checkout, your phone number.
• Gift details: the recipient’s first name and mailing address, the mailing date you choose, your note and how you sign it.
• Messages: anything you write to us by email or social media.
• Feedback: what you share in the feedback form on My Held, and your email.

Payment information

Payments are handled by Stripe. We see your name, email, billing and shipping address, what you bought, and the card type and last four digits. We never see or store your full card number.

Information collected automatically

When you visit heldme.org, our website host (Netlify) and our font provider (Google Fonts) receive basic technical information, such as your IP address and browser type, so the site can load and stay secure. We do not use advertising cookies or tracking pixels. If that ever changes, we will update this notice first. When you check out or manage your subscription, you are on Stripe’s pages, which use Stripe’s own cookies to process payments and prevent fraud.

Sensitive information

We don’t ask for sensitive information, such as health details or religious beliefs. Choosing a letter series does not require you to tell us anything about your health or faith. If you choose to share a personal story with us, we use it only to reply to you.

2. How we use it

We use your information only to:

• print and mail the letters and products you ordered, to you or to the person you named;
• take payment and handle renewals, cancellations and any refunds;
• answer your messages and send service emails, such as receipts;
• send launch news and occasional notes, if you joined our email list. Every one of these emails tells you how to unsubscribe;
• prevent fraud, keep our site secure, and meet legal, tax and accounting duties.

We do not use it for anything else without asking you first.

3. Gift recipients

When you send a gift, you share someone else’s details with us. Please do this only if you believe they would welcome the letter. We use the recipient’s details only to mail that letter. We never add them to our email list, and we delete their details in our quarterly clean-up, no later than 4 months after the letter is mailed, unless the law requires us to keep them longer. Recipients can ask us to delete their information at any time.

4. Who we share it with

We do not sell your information, and we do not share it for targeted advertising. We share only what is needed with the service providers that help us run Held:

• Stripe, for payments and subscription management. Stripe also uses payment data under its own privacy policy, including to prevent fraud.
• Netlify, for website hosting and our sign-up and gift forms.
• Google, for email (Gmail) and website fonts.
• The U.S. Postal Service, which sees the name and address on the envelope. That’s how mail works!

We may also share information if the law requires it, to protect the rights and safety of Held or others, or as part of a sale or merger of our business, in which case the new owner must honor this notice.

5. Our social media pages

Held has pages on Facebook, Instagram and TikTok. If you follow, like, comment on or message us there, we see your public profile and what you send us. We use it only to reply to you and connect with you. The platforms may also show us summary statistics about our pages, such as how many people saw a post.

These platforms collect and use your information under their own privacy policies and settings, which we do not control. For Facebook and Instagram page statistics, Meta takes primary responsibility for that data under its own terms.

We will only repost a photo or post you tag us in after asking your permission. Please never send payment card details through social media messages.

Ads: if we advertise on these platforms, we use their general audience tools (such as age range, location and interests). We do not upload your email or other personal information to them, and our website has no tracking pixels. If that ever changes, we will update this notice first.

6. No AI training

We do not use your personal information, your gift notes or your messages to train artificial intelligence (AI) models, and we do not sell or give them to anyone for that purpose. (Stripe’s own fraud protection, described above, is separate and run by Stripe.)

7. How long we keep it

• Subscribers: while your subscription is active, and afterwards only as long as needed for taxes, accounting and legal reasons (usually up to 7 years for payment records).
• Email list: until you unsubscribe. When you unsubscribe, we delete your email address from our list within 30 days.
• Gift recipients: deleted in our quarterly clean-up, no later than 4 months after the gift letter is mailed.
• Messages and feedback: up to 2 years, so we can follow up and improve Held, unless you ask us to delete them sooner.

8. Keeping it safe

We use trusted providers and take reasonable steps to protect your information. No system is perfectly secure, but if a security problem affects your information, we will tell you when the law requires it.

9. Your rights and choices

Everyone can ask us to access, correct, delete or get a copy of their information, unsubscribe from emails, or cancel a subscription.

California residents have the right to know what we collect and how we use it, to correct and delete it, to opt out of the “sale” or “sharing” of personal information (we do neither), to limit the use of sensitive information (we don’t use it for other purposes), and to be treated equally for using these rights. You may use an authorized agent. We honor Global Privacy Control (GPC) browser signals.

Residents of other U.S. states with privacy laws have similar rights. If we deny your request, you can appeal by replying to our answer.

If you are in the EU, the EEA or the UK: Held mails letters within the U.S. only, but if the GDPR applies to you, we use your information because it is needed to fulfill your order (contract), for our legitimate interests (such as security, fraud prevention, record keeping and delivering a gift someone sent you), with your consent (our email list, which you can withdraw at any time), or to meet legal duties. You may also ask us to restrict or stop using your information, and you can complain to your local data protection authority. Our providers are based in the U.S. and protect international transfers with safeguards such as Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, where applicable.

How to ask: email heldme.letters@gmail.com with “Privacy request” in the subject line. We may need to confirm your identity, and we will reply within the time the law requires (usually 30 to 45 days).

10. Children

Held is not meant for children under 13, and we do not knowingly collect their information. Orders must be placed by an adult (18 or older). Letters from teens for teens may be ordered only by a parent, guardian or another adult, who gives us the teen’s name and address only so we can mail the letters. If you believe a child has given us information, contact us and we will delete it.

11. Changes to this notice

We may update this notice from time to time. We will change the date at the top and, for important changes, let subscribers know by email.

12. Contact us

Canoa Studio LLC (Held) · heldme.letters@gmail.com