Privacy
What we hold, who can see it, and how to make us delete it. Written from the database, not from a template, and last checked against it on 2026-10-21.
Two different relationships
If you hired us to build or run your website, we decide how your account data is handled and this page tells you how.
If you filled in a form, bought something, or had your photo taken on a site we run for somebody else, that business decides what happens to your information. We hold it on their behalf and act on their instructions. You can always come to us and we will either act or put you in touch with them — we will not use your request as a way of making you go away.
What we hold
Businesses who hire us
- Business name
- Email address
- Billing details held by Stripe
- Support messages
Why: To run the account, build and host the site, and take payment
Kept for: While the account is open, then 7 years for the invoices tax law requires us to keep
People who contact a client through their site
- Whatever the form asks for — typically name, email, phone, message
- A label saying what the enquiry looks to be about and how urgent it seems, worked out from the words on our own servers. It is not sent to anyone, and nothing is deleted or refused because of it
Why: To pass the enquiry to the business it was meant for, and to put the urgent ones at the top of their list
Kept for: Until the client deletes it, or the account closes
People who buy from a client's shop
- Name
- Delivery address
- What they ordered
- Payment record from Stripe
Why: To fulfil the order and keep the business's records
Kept for: While the account is open, then as long as the client's own tax obligations require
Visitors to a client's website
- Without consent: the page viewed and when — nothing that identifies anyone
- With consent: a visitor id, a one-way hash of the IP, browser, device and referrer
Why: To tell the business how many people visited and which pages they read
Kept for: Rolled into daily totals; the session rows are pruned
Guests at an event using a Sparkler camera
- The photographs they take
- A first name, only if they type one
- The IP address and kind of phone used, to stop one device flooding a roll
- A random token their browser keeps — held by us only as a hash
Why: To gather the photographs into one roll for whoever set the camera up
Kept for: Until the host deletes the roll or the guest deletes their own photographs, which they can do at any time from the camera
What we do not do
- We do not sell your information, and we do not share it for advertising.
- We do not train any AI model on your data. We send text to OpenAI or DeepSeek to generate website copy when somebody asks for a draft; that is the only thing that leaves us for that purpose, and it is not training.
- Enquiries sent through a client’s contact form are sorted automatically so the urgent ones rise to the top of that business’s list. That sorting happens on our own servers, the message is not sent to any outside company to do it, and nothing is ever deleted, blocked or auto-answered as a result — it only changes the order somebody reads things in.
- We do not run face recognition on photographs, including Sparkler photographs.
- There is no advertising pixel, no Google Analytics, no Meta pixel and no tag manager anywhere in our code.
Analytics, and what refusing actually does
A client’s website can count its visitors. If you refuse, the visit is still counted and nothing is stored that identifies you — no visitor id, no IP address in any form, no browser, no device, no referrer, and nothing linking this visit to another one. The business learns that a page was read. It learns nothing about who read it.
If you agree, we store a random visitor id, a one-way hash of your IP address, and your browser and device type, so the business can tell repeat visits from new ones.
Who else can see it
The companies that run the parts of this we do not run ourselves. Each one is listed on subprocessors with what it does and what it can see. There are 9 of them.
Getting your data, or getting rid of it
If you are a Sparkler guest, the camera has a link that shows exactly what is held about you and deletes all of it, on the spot, before or after the roll develops. You do not need to ask anyone.
Everyone else: email privacy@melivate.com and say what you want — a copy of what we hold, a correction, or deletion. We will answer within 30 days. We do not charge for this and we will not ask you to explain why. Our mailing address is Melivate Group, 712 H St NE, Washington, DC 20002.
Two honest limits. If you ask us to delete something a business holds about you on one of their sites, we have to tell them, because it is their record and sometimes their legal obligation to keep it. And we keep invoices for seven years because tax law requires it, so that part of a deletion request is one we will refuse and tell you we have refused.
Where it is
In the United States. If you are writing from the UK or EU, your information is transferred there to be stored and processed.
Children
None of this is built for children and we do not knowingly collect anything from them. If a child’s information has reached us, email us and it will be removed.
Changes
When this changes materially we will say so to account holders by email rather than quietly reposting it.