Privacy Policy

This page exists to protect both you and the integrity of this experience.

This privacy policy applies to the Last Hour Experience and all online content on lasthourexperience.com.

I take your privacy seriously. The Last Hour Experience is a personal reflection experience.

I only collect the data necessary to deliver this experience safely and correctly.

This policy explains what data I process, why I process it, how I protect it and what your rights are.

The Last Hour Experience is operated by Vita Florentis, which acts as the legal data controller.

The plain-language explanation of what happens to your words lives on Your words.

The Last Hour Experience processes as little personal data as possible. I only process:

• your name
• your email address
• a free-text message if you choose to use the Voices contact form
• if you are a Voice: the PayPal address for your payout, the rewards you earn and the record of each payout
• the optional answer you gave on the Early Access form before the launch, if you chose to provide one
• your answers inside the experience (temporarily)
• your farewell letters and the first names of the people you write to (temporarily)
• optional Vita Flow workbook answers, held only in your browser's memory while the page is open
• your preferences within the experience
• anything you separately choose to submit as a public message or testimonial
• up to 50 one-way hashed reservation email addresses stored on your device to recognize an existing reservation
• payment and transaction data when you place an order
• purchase, access and content-free delivery status
• clean public page paths, language, a day code, a broad region and the type of device for the cookieless page count
• which buy button you click and what you choose in the cookie notice
• your cookie choice and a random consent-decision ID used only to honor withdrawal of consent for server-side marketing measurement
• campaign source fields and a pseudonymous visitor ID only where available and permitted
• content-free product status and fixed technical error codes
• public-message IDs stored on your device after you light a candle, plus a salted one-way server hash used to prevent duplicate candles or reports
• basic technical data such as device and browser for delivery, security, fraud prevention and, where you consent, analytics or marketing measurement

I do not ask for special-category personal data in lead forms. The optional Early Access reason you may have left before the launch was never meant for health data, religious or political beliefs, or similarly sensitive information; if you included any, ask me and I delete it. Reflection content may be deeply personal and is handled as described below.

Everything you write remains yours. Your answers are processed temporarily for the purposes described here, including to:

• save and resume your active hour
• generate your personal PDF
• make it available to you as a secure download in your own account
• email you a secure link to that download
• act on a choice you make to publish a wall message or testimonial
• send a first-deed reminder only when you explicitly switch that reminder on

Your reflections can touch on religious or philosophical beliefs, on your health, or on other sensitive personal data about yourself, because they are about your life. I never ask for any of it; nothing is read or analyzed to infer anything about you, and nobody is segmented or targeted based on it. Before the experience opens, you give separate, explicit consent for the sensitive personal data about yourself that you choose to write, and you withdraw that consent by erasing your words.

People you mention. People in your life may appear in your reflections and letters. I receive that information from you. It may include their name, their relationship to you, events and what you write about them. I process ordinary personal data about these people solely for my legitimate interest in providing your personal experience and delivering your document to you. I do not use the content to assess, profile or contact them, and I never deliver anything to them. I do not inform each person individually: doing so would require me to read your confidential text, identify them and obtain contact details even though none of that is needed to provide your experience, and it would intrude on your privacy and theirs. Write from your own experience; medical information, allegations or other highly sensitive details about identifiable people do not need to be there unless they are part of your story. This content follows the retention period for your words. A person you mention may submit a privacy request using the contact details below. I do not confirm or deny, in response to a general request, whether someone appears in private text; if that person provides enough specific information to locate data without a broad content search, I reassess the request and also take your rights and confidentiality into account.

During an active hour, this browser also keeps a resume draft with your answers, letters and message on the device you are using. That device copy is stored encrypted, with a key that exists only in this browser. Someone with access to your unlocked device or browser profile could open the experience and may therefore be able to read it.

The local resume draft is removed when you complete the experience. It is also configured to expire 30 days after its last local save: if the page remains open it is removed automatically, otherwise the site removes it on your first visit after expiration. Clearing this site’s browser data removes it sooner.

Vita Flow is a separate workbook. Anything you type there exists only in your browser's memory while the page is open and is not sent to Last Hour Experience. You can create a completed PDF or HTML file locally in your browser and choose where to save it. That file is readable by anyone who can open it.

If you are signed in, your answers are encrypted and stored only temporarily. The encrypted copy includes your answers and letters so you can resume your hour. Your personal PDF is created on your own device when you download it.

This is end-to-end encryption: your own device encrypts your answers and letters before anything leaves, and the key belongs to you alone. Last Hour Experience cannot decrypt the stored copy. Several independent security audits have confirmed that Last Hour Experience cannot read your stored words.

Everything you write remains yours. After the hour, an encrypted copy of your answers and letters remains available to you. I erase it when you delete it yourself, or no later than 30 days after you complete your hour.

Your answers and letters are stored encrypted in your account. Your personal document is created on your own device. The encrypted copy stays available in your account after you download it. You can permanently delete that copy with the delete button in your account. Otherwise, it is deleted no later than 30 days after you complete your hour, with a reminder before deletion.

For transactional emails, your recipient address, subject and message body pass through Convex, my mail-orchestration layer, before Resend sends the email; delivery status is also processed through Convex. An answer-download email contains only a secure link, never the PDF or answers as an attachment. Only if you explicitly opt in to first-deed reminders may that opted-in deed appear in the relevant reminder email and be processed by Convex and Resend solely for delivery.

The deletion promise has four precise, optional exceptions plus one record that is deliberately kept. A public Message for the World and a published testimonial are kept only when you explicitly choose publication, separately from your answers, and can be removed on request. Private testimonial feedback is deleted within 30 days. If you opt in, I may keep only your first deed, encrypted, for your yearly reminder, and/or briefly for the one 48-hour reinforcement email. Turning off either opt-in deletes that stored deed immediately; the 48-hour copy is also deleted after sending and after 72 hours at the latest. Content-free run metadata, such as completion date, language and deletion status, is not answer content and remains only where needed to operate the account and prove deletion. Separately from all of this, proof that you gave consent before the experience opened is kept permanently: the version, the language and the moment, without your name, email address or a single word you wrote. It is the evidence that your consent was properly requested, so it has to outlive the erasure it refers to.

I process your data for the purposes described in this policy, including:

• delivering the Last Hour Experience
• generating your PDF and making it available as a secure download in your account
• letting you complete Vita Flow and create your own local PDF or HTML file
• security, fraud prevention and error detection
• improving website stability and performance
• managing Early Access, newsletters and the communications or reminders you choose
• measuring public-site use and campaigns where you consent
• publishing content only when you explicitly choose to publish it
• payment processing, transaction records, and legally required recordkeeping
• answering a Voices inquiry or exploring a collaboration you ask about

Your reflection answers from the experience are never used for marketing or advertising audiences, and are never shared with third parties for commercial purposes. If you reserved Early Access before the launch, you left your email so I can send you the resource you requested and occasional updates about the experience, with your consent and with an unsubscribe link in every message.

The optional “What made you pause here?” answer is separate from the reflection experience. If you submitted it before the launch, the text was added to the Vita Florentis lead records in Google Workspace and included in an operational notification to Vita Florentis delivered by Resend. The text is not sent to Meta or Google Analytics. After analytics consent, Google Analytics may receive only the fact that an optional reason was provided, never its content.

If you enter your email at checkout and leave without paying, I may send you one reminder with a link back to the same checkout. I do this based on my legitimate interest in a purchase you started yourself, and the reminder has an unsubscribe link. Stripe passes your address back to me when the checkout expires, and Resend delivers the email. I keep only a one-way hash of your address, the checkout reference and the time it was sent, so the same address never gets a second reminder within thirty days. That record stays until you ask me to delete it.

Cookieless public page count

On each public page load, a first-party request records a clean page path, language and server time in the Vita Florentis Supabase environment. To tell how many people visit each day, the server also creates a day code from your IP address and browser information, using a key that changes every day and that I delete after two days. After that, the code can no longer be traced back to you, and codes from different days can never be linked. Your IP address itself never goes into the row. The row does get a broad region (the Netherlands or Belgium, the rest of Europe, or elsewhere), the type of device and whether the visit came from a bot or my own testing. Without analytics consent, the database row contains no persistent visitor ID, country, query string, campaign field or cookie.

This request is never sent from account, checkout, gift-payment, access, download or experience pages.

On public pages, the same kind of request counts how often a buy button is clicked, how often the cookie notice appears and what you choose in it. That count keeps only which button or choice it was, the language and the time, with no cookie, day code, region or visitor ID. On the home page, it also counts how far people scroll, which questions they open and which ad they came in through, without knowing who they are.

Optional analytics

If you consent to analytics, a public-page record may also contain a random pseudonymous visitor ID, country, broad first-touch category and selected engagement events such as scroll depth, FAQ opens and CTA clicks. Google Analytics 4 and Cloudflare Web Analytics/RUM may then measure public-page usage and technical performance. Unlike the cookieless count above, which only records how often something is clicked, this measurement also sees which visit a click belongs to.

These tools are not loaded on private pages and never receive your reflection answers, letters or messages.

Messages and Voices are public community pages, so optional analytics there follows the same consent rules. Content-free wall views, permalink views and shares are recorded only after analytics consent and never contain message text, reflection answers or an email address. Lighting a candle or reporting a message remains functional without analytics consent.

What buyers did before their purchase

If you buy, I keep a general record of how you used the site before you went to checkout, such as how far you scrolled and which questions you opened. It is kept separate from your name, your email address and your order, helps me improve the site (legitimate interest), is stored for 180 days and is shared with no one. If you don't buy, I keep nothing.

Voluntary conversion attribution

When you voluntarily submit a lead form or start an order, the first-touch category and available UTM source, medium, campaign, content and ad-set values from that visit may be stored with the lead or order. Without analytics consent, these fields are used only for that voluntary conversion and do not create a persistent visitor ID or browsing profile.

Marketing and analytics scripts do not run on private experience, account, login and authentication, checkout and payment-return, access and redemption, pass-it-on, private Voice-invitation or admin routes. Messages and Voices remain public, consent-gated pages; no message, answer or letter content is sent to Google or Meta.

First-party measurement

After analytics consent, the public website stores a random visitor identifier and one coarse first-touch source (direct, ad, wall or Voice) for up to 12 months. No click ID, UTM value, IP address, answer or message is stored in those cookies.

Meta Pixel and Conversions API

After marketing consent, Meta Pixel and the Meta Conversions API may receive advertising-measurement events for public page views and voluntary conversions such as signups and purchases. Depending on the event, this can include a cleaned public-page URL or referrer, language, IP address, browser information, Meta browser identifiers, one-way hashed email or name, and purchase value, currency and product type.

Reflection answers, letters and messages are never sent to Meta. No Meta browser script loads on private pages; after payment, a consented Purchase event may be sent server-side.

If you withdraw marketing consent before a pending purchase event is sent, a first-party revocation request disables that pending event. The random consent-decision ID is not used as a visitor ID or browsing profile.

Content-free product reliability

To operate the experience reliably, the service records when a run starts and completes, derives the time between those moments, and records a fixed technical error code and stage when an identified run operation fails. These operational metrics contain no answers, letters, messages or other reflection content and are not used for advertising.

Essential public-wall interactions

Reading the public wall does not require analytics consent. If you light a candle or report a public message, the service must prevent duplicate or abusive actions. This browser therefore stores the public message IDs for your candle choices. The server creates a salted one-way deduplication hash from your account ID when signed in, or otherwise from a truncated IP network and coarse browser category. The candle or report record stores that hash, not the underlying account ID or raw IP address. If you wrote a message yourself, your account on app.lasthourexperience.com sets a cookie holding only your signed candle token, which this site reads. That way a candle you light on your own message counts as yours, and you never get a notification about your own candle. Non-functional wall-view, permalink and share measurement is recorded only after analytics consent.

I review every Message for the World and testimonial submitted for publication myself before it goes public. That text is not sent to an AI model for moderation.

YouTube

Embedded videos stay behind a local placeholder until you deliberately click to load one. The video then loads through YouTube's privacy-enhanced player and YouTube may receive technical request data.

I use appropriate technical and organizational measures, including:

• encrypted connections (SSL)
• encryption on your device for answers, letters and in-progress drafts before they are stored on the server
• a separate, encrypted local browser resume draft, disclosed above, with a key that exists only on your device
• deletion of the encrypted copy of your answers when you delete it yourself, or no later than 30 days after you complete your hour
• separate, encrypted first-deed reminder records only after explicit opt-in, with the 48-hour copy deleted within 72 hours and the yearly copy deleted on opt-out or when the account lifecycle ends
• a self-service button to permanently delete your answers at any time
• Convex and Resend for transactional email delivery; the answer PDF is never sent as an attachment, and reflection content appears only in an optional first-deed reminder you explicitly enabled
• limited access to systems and logs
• automatic deletion of temporary data

Your data is shared with:

• Supabase (for accounts, temporary encrypted content, first-party page views, content-free product-health metrics and the canonical Early Access and newsletter CRM records, including contact details, consent, segments, mail status and suppression)
• Stripe (for checkout, payments, refunds and legally required transaction records)
• Convex (the Vita Florentis Mainframe mail hub, which processes the recipient address, subject and message body before Resend and records delivery status; reflection content appears only in a first-deed reminder you explicitly enabled)
• Resend (for sending transactional emails, usually containing only secure links. If you explicitly enable a first-deed reminder, that email quotes only that chosen sentence. Resend also delivers the optional Early Access reason in an operational notification and Voices contact messages to Vita Florentis. Resend also holds the Early Access and newsletter addresses as a sending list, because that is how my own mail system sends; that list follows the same consent, unsubscribe and deletion rules as the CRM record)
• Cloudflare (for hosting and security; Web Analytics/RUM on public pages only after analytics consent)
• Meta Platforms (Pixel and Conversions API for advertising measurement and audiences, only after marketing consent. For these tools, Meta and Vita Florentis are joint controllers: Vita Florentis decides whether they load at all, which is only after your marketing consent, and Meta decides how it processes what it receives under its own terms. You can exercise your rights with either of us)
• Google Analytics (for website statistics on public pages, only after analytics consent)
• Google/YouTube (the privacy-enhanced video player is contacted only after you deliberately click its local placeholder; Google may then receive your IP address and browser or device information and may use its own cookies or local storage)
• PayPal (only for Voices: your PayPal address and the amount of your monthly payout, so your reward reaches you)
• Google Workspace / Google Sheets (a temporary one-way observation mirror for Early Access and newsletter submissions during the controlled cutover; it is not the canonical record. It also stores the optional reason you chose to submit before the launch and, only after the relevant cookie consent, limited source and interaction fields)

Personal reflection answers are processed only by the technical service providers required to run the experience and carry out the choices you make. Apart from the one first-deed sentence in a reminder you explicitly enable, reflection content is not included in transactional emails. It is never shared for advertising, profiling, commercial purposes or AI training.

Some providers listed above are international and may process personal data outside the European Economic Area. Where this happens, Vita Florentis uses the transfer mechanism available in the provider agreement, such as an applicable adequacy decision or the European Commission’s Standard Contractual Clauses, and limits the data sent to what is needed for that service. Provider locations and mechanisms can change; you can ask for current information using the contact address below. You can also request a copy of the applicable Standard Contractual Clauses using the contact details at the end of this notice.

• Your answers and letters: stored encrypted until you delete them yourself, or for at most 30 days after you complete your hour. Downloading does not delete the encrypted copy
• Optional first-deed yearly copy: only that one chosen sentence, stored separately with encryption until you turn the opt-in off, delete your account or replace it with a newer opted-in deed
• Optional 48-hour first-deed copy: encrypted until the email is sent, you turn the opt-in off, a refund is issued or account deletion occurs, or 72 hours pass, whichever comes first
• Public Messages for the World: retained based on your explicit choice to make them public and removable on request
• Local browser resume draft: configured to expire 30 days after it was last saved and removed while the site remains open or on the next site visit after expiry; removed sooner when you complete the experience or clear this site’s browser data
• Local reservation recognition: up to 50 one-way email hashes remain on your device until you clear this site’s browser data
• Public-wall candles: up to 5,000 public message IDs remain on your device until you unlight them or clear this site’s browser data. The corresponding salted server deduplication hash remains while that candle or report record and the public message exist; an account-derived candle hash is also removed when the account is deleted
• Post-hour testimonials: kept separately from your answers; published only with your explicit consent and removable on request. Private feedback without publication consent is deleted within 30 days
• Technical delivery data: only as long as needed for delivery, security and error handling
• Temporary checkout handoff data, hashed consent-decision IDs and Meta browser identifiers: deleted automatically within 30 days
• Minimal campaign fields attached to a completed lead or order: kept with that lead or order only as long as needed for its stated purpose and applicable recordkeeping requirements
• Account and purchase contact details: while the account or purchase relationship exists and as long as applicable recordkeeping rules require
• Early Access and newsletter contact details: until you unsubscribe or withdraw consent; a minimal suppression record may remain where needed to honor the opt-out or comply with a legal requirement
• Voices contact messages: only as long as reasonably needed to answer your inquiry, explore the collaboration you requested and keep any resulting necessary business records
• Voice payouts: your PayPal address for as long as you are a Voice; the record of each payout for as long as the law requires it for accounting purposes (in the Netherlands, seven years)
• Limited refund anti-abuse identity record: normalized email plus Stripe customer and payment-method references, retained only as long as needed to enforce the once-per-person satisfaction promise
• Server and provider-status logs: kept for as short a time as reasonably possible for security, reliability, delivery and troubleshooting
• Website measurement records: the visitor identifier, country and day code are removed after 180 days, and the key behind the day code after two days; the page count itself remains, without anything that points to a person
• Consent evidence: kept permanently in an immutable form, containing only the consent version, language, and time. It contains no name, email address, or reflection content, and it remains after your writing and account are deleted because it proves that consent was properly requested

Nothing is kept longer than necessary.

Encrypted platform backups of the database run a few days behind the live system, so deleted data can briefly survive there. If a backup is ever restored, the deletions made since are applied again to the restored data.

The legal basis depends on what you choose to do:

• Performance of a contract, or steps you request before entering into one: account creation, orders, access, delivery of the experience, secure downloads and requested steps around a possible Voices collaboration
• Consent: Early Access and newsletter emails, an optional Early Access reason you chose to submit before the launch, optional first-deed reminders, optional analytics and marketing, and publication of a wall message or testimonial. You can withdraw consent for future processing at any time
• Customer relationship: if you bought from me, I may email you about my own similar offers. Every email has an unsubscribe link
• Legitimate interests: security, fraud prevention, error handling, responding to contact messages, the cookieless count of page loads, buy-button clicks and cookie choices without a persistent visitor ID, content-free product-reliability measurement and one-way deduplication of functional public-wall candles and reports. These interests are balanced against your privacy; those measurements do not contain reflection content. You may object to this processing
• Explicit consent for special categories (art. 9(2)(a) GDPR, and art. 32 of the Dutch GDPR Implementation Act for criminal-law data): the sensitive personal data about yourself that you choose to write during the experience, such as your health or your beliefs. This consent covers only that sensitive layer; the ordinary storage and use of your reflections rest on the agreement. You give it as a separate step before the experience opens and withdraw it by erasing your words. A pseudonymous record that consent was given, with its version and time, remains as proof after erasure
• Legal obligation: financial and transaction records that Vita Florentis must retain

You have the right to:

• access your personal data
• request corrections
• request deletion
• request restriction of processing
• object to processing
• request data portability
• withdraw consent for future processing at any time
• file a complaint with your local data protection authority

You can reach me at julian@lasthourexperience.com. You will receive a response within one month. If a request is complex, I may extend the deadline by up to two months, and I will tell you within the first month.

You can delete your product account from the account page. Removal requests for a public message, testimonial or complete cross-system record are handled within 72 hours; a complete request also covers the Supabase CRM record, the temporary Google Sheet mirror and Convex/Resend delivery records. Payment records required by law and the limited anti-abuse identity record (normalized email plus Stripe customer and payment-method references) required to enforce the once-per-person refund promise remain as limited exceptions.

This section applies if you live in a US state with a consumer privacy law, including California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Virginia and the other states whose laws are in force. It adds to the rest of this policy; it does not replace it.

What is collected and why

Using the categories these laws use, Vita Florentis may process: identifiers such as your name, email address, IP address, a random pseudonymous visitor ID and cookie or advertising identifiers; commercial information such as your order, purchase value and currency; internet or network activity such as public pages viewed, referrer, language and selected engagement events; approximate location derived from your IP address; and the content you write yourself inside the experience or in a contact or wall message. The purposes are listed above under “Why I process your data”, and the retention periods under “Data retention”.

Selling and sharing

Vita Florentis does not sell personal information for money and has not done so in the past twelve months. It does “share” personal information for cross-context behavioral advertising in one specific case: after you give marketing consent, Meta Pixel and the Meta Conversions API may receive identifiers, internet or network activity and commercial information about public-page visits, signups and purchases. That is the only sharing that takes place. Your reflection answers, letters and messages are never shared, sold or used for advertising, profiling or AI training.

Personal information is disclosed to the service providers listed above under “Who your data is shared with”, each for the purpose described there.

Global Privacy Control is honored

If your browser or extension sends a Global Privacy Control signal, it is treated as a valid opt-out of sale and sharing. Marketing measurement stays off, the Meta Pixel is not loaded and any pending server-side marketing event is canceled, without any further action from you. You can see the confirmation in Your Privacy Choices, at the bottom of every page.

You can also make the choice yourself at any time through Your Privacy Choices. Opting out is exactly as easy as opting in.

Sensitive personal information

Any free-text field inside the experience can lead you to write about your health, religious or philosophical beliefs, or other sensitive personal information about yourself. It is used only to deliver the experience you asked for: to resume your hour, to build your personal document and to publish something you explicitly choose. It is never used to infer characteristics about you and never for advertising. You have the right to limit its use to those purposes, and that limit is already how the service works. If you live in Washington, the separate Consumer Health Data Privacy Policy linked in the footer applies as well.

Your rights and how to use them

• Know what is collected, used, disclosed and shared, and get a copy in a portable format
• Correct inaccurate personal information
• Delete personal information, subject to legal retention duties such as tax records
• Opt out of sale or sharing, and of targeted advertising
• Limit the use of sensitive personal information
• Appeal a denied request, where your state provides that right
• Not be treated differently for using any of these rights

Email julian@lasthourexperience.com with the request and the email address you used here, so the request can be matched to your data. You get a reply within 45 days, extendable once by another 45 days if the request is complex, in which case you are told before the first period ends. An authorized agent may act for you with written permission. There is no charge unless a request is manifestly unfounded or excessive.

The Last Hour Experience is for adults. You must be 18 or older to take part. If I learn that someone under 18 has used the service, I block access and delete their reflections and account data, except for the minimal records I need for a refund, a legal obligation, misuse prevention or a legal claim.

This privacy policy is governed by the laws of the Netherlands.

You can review or change your privacy choices for this website at any time, in any language and from any page.

Open Your Privacy Choices