Privacy policy

Effective 28 July 2026

Who controls your data

Forget-Me-Not is operated by blackplate, a sole proprietorship (eenmanszaak), registered in the Netherlands (KVK 82691770). For anything in this policy, contact legal@forgetmenot.nl. Full operator details are on the legal notice page.

This website

These pages are static. There are no cookies, no consent banners needed, and no third-party requests — fonts, images, and scripts are all served from this domain.

We measure visits with a self-hosted, cookieless analytics tool (Umami) served from this same domain. It sets no cookies and cannot follow you across sites. It stores visit data — pages viewed, referrer, browser type, and country-level location — under a pseudonymous identifier that rotates daily, never your name, email, or full IP address.

When you create an account, your email address is stored in our self-hosted mailing system. That one step is the whole signup: there is no confirmation link to follow, and we record the time you signed up as proof of consent. We send you nothing at the time, and the only message you will receive before launch is your invite when deliveries open in your area. Every email includes a one-click unsubscribe link, and addresses that unsubscribe are deleted automatically within 30 days.

That is the whole of it for now. Forget-Me-Not is pre-launch, so no delivery addresses, no recipient names and no dates are collected on this website yet. When the product opens, the details you enter about the people you send flowers to will be used to deliver those flowers and for nothing else: never sold, never used to build an advertising profile, and never shared with a data broker. This policy will be updated, and its effective date changed, before that happens.

Where this runs

This site and the services behind it run on our own servers in the European Union, under EU jurisdiction. Analytics and email are self-hosted on that same infrastructure rather than handed to an outside platform, which is why there are no third-party requests on these pages and nothing to hand to an advertising network or data broker.

The whole server is defined as code in a single reproducible configuration, and we intend to publish that configuration on Codeberg so the claims on this page can be checked rather than taken on trust. Publication is pending a security review: a server configuration names every service, port, and trust boundary in the system, so it gets checked before it is public rather than after.

Your rights

Under the GDPR you can request access, correction, deletion, or export of your data. Email legal@forgetmenot.nl and we'll respond within 30 days. You can also lodge a complaint with the Dutch DPA (Autoriteit Persoonsgegevens).