Privacy and saved information

A Place for Always is operated by Omaia AB, The Yard, Anders Carlssons g 30, 417 55 Göteborg, Sweden (org. nr 559525-1397), which is responsible for how your personal information is used.

For privacy questions or requests, contact hello@omaia.ai. We do not have a designated Data Protection Officer.

Your flower and any message you add are visible to anyone visiting the garden. We do not display a separate author name alongside your message.

Anything you write in the message itself will be visible, including any names or other identifying details you choose to include. Please share only information you're comfortable making public.

To show your flower and let you return to it, we store: the message text, your colour choice, a seed number that determines the flower's shape, its position in the garden, the time it was planted and last edited, an automated screening record, a report count, and the IP address the flower was planted from (kept to prevent abuse).

Your return link lets you find your flower again, edit or remove your message, or delete the flower entirely.

Keep this link private. Anyone who has it can use those controls — we have no other way to verify who you are.

If you lose your link, we can't recover it for you. There are no accounts and no way to look up a flower by name or email, so the link itself is the only way back.

We don't currently offer a way to email you your return link — copying and saving it yourself is the only option. We don't ask for or store an email address anywhere in the garden. If we add email delivery in future, this section will be updated to describe it (the provider, what's stored, and for how long) before it goes live.

Before a message is shown, we send its text to OpenAI's automated moderation service, which checks for hateful or abusive content. If that service flags a message, we send the text to a second automated model for a closer look, through Vercel's AI Gateway, which passes it to the company hosting the model. If those checks fail or time out, the message is shown anyway — screening a message is never allowed to stop someone planting a flower.

Anyone visiting the garden can report a message. A reported message is hidden immediately, before anyone reviews it. One of us then reviews it by hand and decides whether to restore it, remove the message, or remove the flower entirely. Every one of those actions is logged with what was done and when.

Our hosting (Vercel) and database (Turso) automatically log technical information needed to run the service, such as request timestamps and IP addresses, for security and reliability. We do not use advertising trackers. A single, strictly necessary cookie is set only for our own moderators when they sign in to review reported messages — never for a visitor planting or reading flowers.

If you accept, we use Microsoft Clarity to see how the garden is used: where people click and scroll, and where they get stuck, shown as heatmaps and session recordings. Clarity stays completely off until you accept in the cookie banner. If you decline, nothing is loaded and nothing is recorded. You can change your choice at any time with Cookie settings. Your choice is saved in your browser's local storage (omaia-cookie-consent). If you accept, Clarity also sets its own cookies in your browser.

Clarity never runs on your private return-link page, because that link is your only credential. We hide the message boxes and the messages you read from it, and we send it only the names of actions, such as “flower planted”, never what you wrote. Microsoft acts as our processor for this and we use it only to improve the garden. We do not use it for advertising.

• Publishing your flower and message: your explicit consent (the tick-box before planting).
• Providing your return link and letting you edit or remove your message: necessary to provide the feature you've asked for.
• Automated and human moderation: our legitimate interest in keeping the garden safe and respectful.
• Rate-limiting and abuse prevention (including the IP address stored with a flower): our legitimate interest in keeping the service reliable and free of spam.
• Usage analytics with Microsoft Clarity: your consent, given in the cookie banner and withdrawable at any time.

Writing a message is entirely optional — you can plant a flower with no message at all.

Anyone visiting the garden can read a published flower and its message.

We use the following providers to operate the service: Vercel (hosting), Turso (database), OpenAI (automated message screening), Vercel AI Gateway and the model host it routes to (a second automated check on flagged messages), and, only if you accept analytics, Microsoft (Clarity). Vercel, OpenAI and Microsoft are US-based; where information is transferred outside the EU/EEA to them, we rely on Standard Contractual Clauses as the safeguard. Contact us at hello@omaia.ai for more information about these transfers.

• Flowers and messages: kept indefinitely, as a lasting memorial, unless you remove your message, delete the flower yourself using your return link, or a moderator removes it.
• Return-link and editing access: tied to the flower record itself — same as above.
• Email addresses: not currently stored (see “If you request an email” above).
• Reports and moderation logs: kept indefinitely as an audit trail of moderation decisions.
• Analytics recordings and heatmaps (only if you accept): kept by Clarity for the period set in our Clarity project, and not linked to your flower or return link.

You can contact hello@omaia.ai to ask about your personal information, or to request access, correction, or deletion.

Depending on your circumstances, you may also have rights to restrict or object to processing, and to receive a portable copy of your information. Where we rely on your consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

You can remove your own message, or delete your flower entirely, at any time using your return link — no account or request to us is needed for that.

You can also complain to Sweden's privacy authority, IMY.

We do not make any decisions about you using automated processing that have legal or similarly significant effects. The automated screening described above only flags a message for human review — it never makes a final decision on its own.