Privacy Policy

1. Information We Collect

Account information: When you create an account (via email or Google Sign-In), we collect your name, email address, and profile information. If you sign up with email, your password is securely hashed and never stored in plain text.

Card and order data: When you send a card, we collect the message you write, the recipient's name, mailing address, email, or phone number depending on the delivery method. We also store your selected handwriting style, delivery preferences, and order history.

Contact list: If you import or manually add contacts (names, addresses, birthdays), this data is stored securely and used only for sending cards on your behalf.

Payment information: Payment is processed securely by Stripe. We do not store credit card numbers, CVVs, or full card details on our servers.

2. How We Use Your Information

• Create and manage your account
• Process and fulfill card orders (digital and physical)
• Generate AI-assisted message suggestions when you request them
• Send birthday and holiday reminders if you opt in
• Communicate with you about your orders and account
• Improve our services and user experience
• Comply with legal obligations

We do not sell, rent, or trade your personal information to third parties.

3. Third-Party Services

We use the following trusted third-party services to operate our platform. Each has their own privacy policy governing how they handle your data:

• Supabase — Authentication, database, and file storage
• Stripe — Payment processing (PCI DSS compliant)
• Vercel — Website hosting and serverless functions
• SimplyNoted — Physical card fulfillment (printing, handwriting, mailing). Recipient names and addresses are shared with SimplyNoted to deliver your cards.
• Twilio — SMS delivery for text message cards and reminders
• Google — OAuth authentication (Sign in with Google) and Gemini AI for message suggestions

4. Cookies and Tracking

We use essential cookies for authentication (keeping you signed in) and preferences (theme, dismissed banners). These are strictly necessary for the site to function.

We may use Google Analytics to understand how visitors use our site. You can opt out of analytics tracking via our cookie consent banner. We do not use cookies for advertising or cross-site tracking.

5. Data Security

• All connections use HTTPS/TLS encryption
• Passwords are hashed using industry-standard algorithms
• Authentication uses secure HttpOnly cookies
• API endpoints are protected with CSRF tokens and rate limiting
• Database access is controlled with Row Level Security (RLS)
• Admin access requires multi-layer authorization

6. Data Retention

• Account data: Retained for as long as your account is active
• Order history: Retained for business records and legal compliance (minimum 7 years for tax purposes)
• Card messages: Stored with your order records
• Temporary card renders: Automatically deleted within 7 days of creation

You may request deletion of your account and all associated data at any time by contacting us.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data (“right to be forgotten”)
• Portability: Request your data in a machine-readable format
• Opt-out: Unsubscribe from marketing communications at any time

California residents (CCPA): You have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.

EU/UK residents (GDPR): Our legal basis for processing your data is (a) contractual necessity (to fulfill card orders), (b) consent (for optional features like AI suggestions and reminders), and (c) legitimate interest (to improve our services). You may withdraw consent at any time.

8. Children's Privacy

Cards From You is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by posting a notice on our website or sending you an email. Your continued use of the service after changes constitutes acceptance of the updated policy.

10. Contact Us

For privacy-related inquiries, data requests, or concerns:

• Cards From You, 2081 SE Floresta Drive, Port Saint Lucie, FL 34984
• Email: Jenn@cardsfromyou.com
• Phone: (801) 791-9295