Candle procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| Data retention | All applicable tiers | unknown | “ If your account is inactive for an extended period, we may automatically close it. After automatic closure, your data will be handled as described below.” | Captured 2026-07-19Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ While backup data is not accessible in normal operations, it has not been permanently destroyed. Complete Deletion Requests : If you require complete destruction of all data including backups (for example, to comply with a legal obligation in your jurisdiction), contact us at support@trycandle.app and we will work with you to accommodate your request to the extent technically feasible and legally permissible.” | Captured 2026-07-19Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ You can delete your account and request deletion of your Personal Data at any time through your account settings or by contacting support@trycandle.app . We will process deletion requests in accordance with applicable law, except where retention is required (such as for tax or accounting purposes).” | Captured 2026-07-19Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ User Uploaded Images Retained as part of photos and images you upload; follows User-Generated Content retention Photos are stored for service functionality; no biometric templates extracted or stored separately Security Logs and Audit Trails 1 year Security monitoring, incident investigation, and fraud prevention Marketing Preferences Until you opt out or close your account; suppression lists retained to honor opt-outs Honoring your communication preferences Aggregated/De-identified Data Indefinitely No longer identifiable; used for analytics, research, and service improvement ” | Captured 2026-07-19Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ This section explains how long we retain your Personal Data and the factors that determine retention periods.” | Captured 2026-07-19Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, provide our Services, comply with legal obligations, resolve disputes, and enforce our agreements.” | Captured 2026-07-19Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Active Account and Profile Data Duration of account + 30 days after closure To provide Services and allow reasonable account recovery period User-Generated Content (photos, messages, posts) Duration of account; deleted within 30 days of account closure Core service functionality; privacy protection after departure Purchase and Transaction History 7 years after transaction Order history, refund eligibility, and legal compliance Payment Information Duration of account or as required by payment processor; card details may be retained for 180 days to address chargebacks To process transactions, refunds, and handle payment disputes Account & Billing Records 7 years after account closure Tax, accounting, and legal compliance requirements Customer Service Records 3 years after resolution Customer service quality, dispute resolution, and legal claims Consent Records 3 years after consent given or withdrawn Demonstrating compliance with consent requirements under applicable law Communication Logs and Metadata 1 year Legal data retention obligations; security and fraud investigation Identity Verification Data Retained as part of account data and support records; verification codes are temporary and expired after use Account security and support purposes ” | Captured 2026-07-19Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Candle uses a two-layer deletion process: Layer 1 - Active Systems : When you delete content or your account, we immediately remove your access to the data from our active systems so it is no longer accessible. Layer 2 - Backups : Deleted data may persist in backups, archives, and disaster recovery systems for a reasonable period as necessary for:” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ All of your Personal Data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part).” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Marketing and Advertising Partners. We work with advertising partners to promote Candle on third-party platforms. However, these partners receive only technical identifiers (such as device IDs or hashed email addresses) to measure campaign effectiveness and conduct other similar marketing activities. However, we do not share your private messages, partner conversations, shared photos, or responses to personal prompts with any marketing or advertising partner. Analytics Partners. These parties provide analytics on web traffic or usage of the Services. They include: Companies that track how users found or were referred to the Services. Companies that track how users interact with the Services.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We use third-party services to operate Candle, including, without limitation: Cloud Hosting Providers : PlanetScale provides database hosting (MySQL/Vitess) with SSL/TLS encryption in transit and encryption at rest. Authentication : Clerk (SOC 2 compliant) manages user login and account security. Learn more: Clerk Privacy Policy AI Services : OpenAI powers our AI features, including question generation, debate topics, date recommendations, and question rewording. When you use AI features, your prompts may be sent to OpenAI for processing. We do not share your photos or private conversations with OpenAI. Learn more: OpenAI Privacy Policy Analytics : Amplitude provides product analytics to understand how users interact with our Services. Learn more: Amplitude Privacy Policy AppsFlyer provides mobile attribution to measure advertising effectiveness. Learn more: AppsFlyer Privacy Policy ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ The categories of Personal Data described above may be shared with the following recipients for the purposes described in this Policy. We disclose your Personal Data to the categories of service providers and other parties listed in this section. Depending on state laws that may be applicable to you, some of these disclosures may constitute a “sale” of your Personal Data. For more information, please refer to the state-specific sections below. Service Providers. These parties help us provide the Services or perform business functions on our behalf. They include: Hosting, technology and communication providers.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ These providers may have their own privacy policies governing their use of your Personal Data.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Advertising Tracking : Meta Pixel (Facebook/Instagram) tracks website visits and ad interactions. Learn more: Meta Data Policy The TikTok SDK collects app activity and ad interaction data from TikTok campaigns. Learn more: TikTok Privacy Policy ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Vendors: We may use analytics providers to analyze how you interact and engage with the Services, or third parties may help us provide you with customer support.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may share any Personal Data that we collect with third parties in conjunction with any of the activities set forth under “Meeting Legal Requirements and Enforcing Legal Terms” in the “How We Use Your Data” section above.” | Captured 2026-07-19Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.