Privacy policy

Last updated: November 7, 2026

We collect as little as we can. Your photos never leave your phone, we do not sell data, and nothing optional runs before you say yes.

Who is responsible

Verse & Light is operated by Mauro Correia, Portuguese tax number (NIF) 221117580, Figueira da Foz, Portugal (the “controller”). Contact: [email protected].

What we collect and why

Nothing to use the site. You can read, create and share images without an account.
Your photos are placed on the image inside your own browser. They are never uploaded to us.
On your device only: small preferences such as the days you opened your verse this week, whether you closed the Christmas message, and your cookie choice. They stay in your browser’s storage and never reach us.
Email (only if you ask for it): your address, to send the daily verse or a confirmation. Legal basis: your consent, which you can withdraw in one click.
Subscriptions and gifts: handled by Paddle, our reseller (Merchant of Record). Paddle collects your payment details; we receive your email, plan and status. Legal basis: the contract.
Visit statistics without cookies: Cloudflare Web Analytics counts visits without cookies and without identifying you. Legal basis: legitimate interest in knowing which pages help.
Google Analytics (only with your OK): which pages are visited and which buttons are used, without advertising features or Google signals. Legal basis: your consent.
Microsoft Clarity (only with your OK): anonymous recordings of how pages are used, to improve them. Legal basis: your consent, given in the cookie message and changeable at any time.
Links you send to someone: the verse, the style and the first names you type, kept to show the page to the person you send it to, and deleted after 90 days.

Who processes data for us

Cloudflare, Inc. (hosting, security, cookieless statistics)
Resend, Inc. (email delivery)
Paddle.com Market Ltd (payments, invoices and taxes, as Merchant of Record)
Google Ireland Limited (Google Analytics, only with consent)
Microsoft Corporation (Clarity, only with consent)

Some of these companies are in the United States. Transfers rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

How long we keep it

Email addresses: until you unsubscribe. Subscription records: as long as the law requires for accounting (usually 10 years in Portugal). Sent links: 90 days. Clarity data: as set by Microsoft, up to 13 months. Google Analytics data: 14 months.

Your rights

You can ask to see, correct, delete or move your data, object to its use or withdraw consent, by writing to [email protected]. We answer within 30 days. You can also complain to the Portuguese data protection authority (CNPD, cnpd.pt) or your local authority. In Brazil you have the rights in article 18 of the LGPD; in the United States you have the rights your state law gives you, and we do not sell or share personal information.

Children

The service is not aimed at children under 13 and we do not knowingly collect their data.

Changes

If this policy changes in a way that matters, we will say so on this page and, if you get our emails, by email.