Overview
Steel Hearts Foundation ("we," "us," or "our") is a 501(c)(3) nonprofit organization (EIN: 47-2511085). We are committed to protecting your privacy. This policy explains how we collect, use, and safeguard information when you visit steel-hearts.org or interact with our services.
Information We Collect
Information you provide directly
- Purchases: Name, email, shipping address, and payment information (processed securely by Stripe; we do not store card numbers).
- Donations: Name, email, and payment information for tax receipt purposes.
- Tribute messages: Your name, email (optional), relationship to the fallen service member or first responder, and your message. Separate choices cover private family sharing and optional public display. Every message is reviewed.
- Commission requests: Your name, email, and details about a fallen service member you wish to honor.
- Contact forms: Name, email, and message content.
- Newsletter and follow-up signups: Email address, optional first name, signup source/page, and the time you opted in.
Information collected automatically
- Usage and performance data: Information such as pages visited, browser type, device category, and performance measurements through Vercel's hosting, analytics, and speed-insight services.
- Bot protection: We use Cloudflare Turnstile to help identify automated form submissions.
How We Use Your Information
- Process and fulfill bracelet orders and donations.
- Queue and send order confirmations, shipping notifications, and donation receipts.
- Share tribute messages privately with fallen heroes' families or designated contacts after review.
- Respond to inquiries and commission requests.
- Send memorial updates or a signup confirmation if you opt in.
- Improve our website and services.
- Comply with legal obligations, including tax reporting for donations.
How We Share Your Information
We do not sell, rent, or trade your personal information. We share data only with:
- Stripe: Payment processing (PCI-compliant).
- Supabase: Data storage and processing for order, donation, message, and form records.
- Cloudflare: Bot protection (Turnstile).
- Vercel: Website hosting and analytics.
- Google Workspace: Email communications (order confirmations, receipts, and acknowledgements).
- ShipStation: Order fulfillment and shipping logistics.
Tribute messages may be shared privately with the family or designated contact only after review and required private-sharing consent. Public display requires a separate optional consent and review. Public tribute display remains disabled unless Steel Hearts activates the reviewed publication process.
Data Retention
We retain order and donation records for tax, accounting, fraud prevention, and legal compliance purposes. Tribute messages are retained to support ongoing family engagement. Other records are kept only as long as reasonably necessary for the purpose described here. You may request deletion by contacting us; some records may need to be retained to meet legal or operational obligations.
Browser storage
The cart may retain non-sensitive bracelet details in your browser so you can recover them later. Family or tribute message text is not placed in that durable cart storage. An unfinished standalone tribute draft may remain only in the current browser tab for up to 30 minutes after the last edit; expired, invalid, and successfully submitted copies are purged. Short-lived checkout-attempt identifiers may also remain in the current tab so a Stripe checkout can be resumed without creating a duplicate.
Your Rights
You have the right to:
- Request access to the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your data (subject to legal retention requirements).
- Opt out of memorial update emails at any time.
Cookies
We do not sell personal information or use it for cross-site advertising. Cloudflare Turnstile, Stripe, Vercel, and other service providers may use cookies or similar technologies to protect forms, process payments, host the site, and measure performance.
Children's Privacy
Our services are not directed at children under 13. We do not knowingly collect personal information from children under 13.
Security
We use industry-standard security measures including HTTPS encryption, secure payment processing via Stripe, and access controls on our systems. No method of transmission over the internet is 100% secure, but we take reasonable steps to protect your information.
Changes to This Policy
We may update this policy from time to time. Changes will be posted on this page with an updated date.
Contact Us
For privacy-related questions or to exercise your rights, contact us at: contact@steel-hearts.org
Steel Hearts Foundation
501(c)(3) Nonprofit Organization
EIN: 47-2511085