Privacy Policy
1. Who We Are
This website (heartful.art) is operated by Heartful Ltd (“Heartful”, “we”, “us”), a company incorporated in England and Wales with registered number 16423367, whose registered office is at Unit 308, 25 Floral Street, Covent Garden, London, United Kingdom, WC2E 9DS. Heartful Ltd is the data controller for the personal data described in this policy. You can contact us about anything in this policy at info@heartful.art.
Heartful pairs guided meditations with the world’s greatest artworks. Our starting principle is simple: we collect as little personal data as possible. This site uses no cookies, no analytics, no advertising, and no tracking technologies, and all fonts and images are served from our own domain.
2. What We Collect, Why, and Our Lawful Basis
Waitlist email address. If you choose to join our waitlist, we collect the email address you submit. We use it to tell you about Heartful’s launch and early access, and to send you occasional emails from Heartful about art, meditation, new artworks and features. Every email includes an unsubscribe link. Our lawful basis is your consent (UK GDPR Article 6(1)(a)), which you may withdraw at any time by emailing us or using the unsubscribe option in any email we send — withdrawal does not affect the lawfulness of processing before withdrawal.
If you joined before 3 October 2026, you signed up for launch and early-access news only, and that is all we will send you. We will only send you our other emails if you tell us you want them, for example by choosing that option in our launch email.
Correspondence. If you email us, we receive your email address and the contents of your message, which we use to respond to you. Our lawful basis is our legitimate interest (Article 6(1)(f)) in communicating with people who contact us.
Technical data. Like any website, our hosting infrastructure processes visitors’ IP addresses and standard request data in order to deliver pages and maintain security. This happens in server logs operated by our hosting provider; we do not access or analyse this data. The lawful basis is the legitimate interest in operating a secure website.
We do not collect special category data, we do not knowingly process children’s data, and we do not use personal data for automated decision-making or profiling.
3. Who Processes Your Data
We use a small number of service providers (processors) to run this site:
- GitHub, Inc. (GitHub Pages) — hosts this website and processes technical request data.
- FormSubmit (formsubmit.co) — processes waitlist form submissions and forwards them to our inbox.
- Our email provider — stores the messages and waitlist submissions we receive.
We do not sell personal data, share it with advertisers, or disclose it to third parties except the processors above, or where required by law.
4. International Transfers
Some of our processors are located in the United States. Where personal data is transferred outside the UK or the European Economic Area, we rely on appropriate safeguards under UK and EU law, such as the UK Extension to the EU–US Data Privacy Framework, adequacy regulations, or the applicable standard contractual clauses / International Data Transfer Agreement.
5. How Long We Keep Data
Waitlist emails are kept until you unsubscribe or withdraw consent, then deleted. For people who joined before 3 October 2026 and do not opt in to our other emails, we delete the address once our launch communications conclude. Correspondence is kept only as long as needed to handle your enquiry and any follow-up, after which it is deleted. Hosting logs are retained by our hosting provider under its own retention schedule; we do not keep copies.
6. Your Rights
Under the UK GDPR (and, where it applies to you, the EU GDPR), you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data (“right to be forgotten”);
- Restrict or object to our processing;
- Data portability — receive your data in a structured, machine-readable format;
- Withdraw consent at any time, where processing is based on consent.
To exercise any of these rights, email info@heartful.art. We will respond within one month. There is no fee unless a request is manifestly unfounded or excessive.
You also have the right to complain to a supervisory authority. In the UK, that is the Information Commissioner’s Office (ICO) — ico.org.uk or 0303 123 1113. If you are in the EEA, you may complain to the supervisory authority in your country of residence.
7. Security
This site is served exclusively over HTTPS, applies a strict Content Security Policy, collects the minimum data necessary, and stores nothing about you in your browser. Waitlist submissions travel encrypted to our form processor and inbox.
8. Children
This website and the forthcoming app are not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.
9. The Heartful App
The Heartful app is not yet released. Before launch, this policy will be updated with full details of any data the app processes, and the “Last updated” date above will change accordingly. The same minimal-collection principle will apply.
10. Changes to This Policy
We will post any changes on this page and revise the “Last updated” date. Material changes affecting app users will be communicated in the app once it is live.
11. Contact
Heartful Ltd · Unit 308, 25 Floral Street, Covent Garden, London, WC2E 9DS, United Kingdom · Company No. 16423367 · info@heartful.art