Privacy Policy

Last updated: 10/17/2026

1. Information We Collect

We collect the following types of information when you use our service:

• Purchaser Information: Your name, email address, and zip code for order processing and confirmation.
• Recipient Information: Phone number (required for SMS delivery), email address (optional), and name to personalize and deliver greeting cards.
• Message Content: Gift messages you create to accompany your digital greeting cards.
• Transaction Information: Order details and payment status. Actual payment data is handled by Stripe or PayPal — we never see or store card numbers.

2. How We Use Your Information

We use your information solely for the following purposes:

• Processing and fulfilling your greeting card orders
• Sending SMS messages to recipients to notify them of their digital greeting card
• Sending optional email notifications to recipients
• Sending order confirmations to you
• Providing customer support
• Maintaining order records for accounting purposes

2a. Legal Basis for Processing (GDPR Article 6)

As a business based in the European Union (Poland), we process personal data under the following legal bases:

• Contract performance (Art. 6(1)(b)): Processing necessary to fulfil your greeting card purchase and delivery.
• Consent (Art. 6(1)(a)): Optional SMS delivery to recipients, which is explicitly opted into during checkout.
• Legitimate interest (Art. 6(1)(f)): Fraud prevention, service improvement, and customer support.
• Legal obligation (Art. 6(1)(c)): Tax and accounting record retention as required by law.

2b. International Data Transfers

Your personal data may be transferred to and processed by service providers located outside the European Economic Area (EEA), including:

• Twilio (United States) — SMS delivery. Transfers are made under the EU-US Data Privacy Framework.
• Stripe (United States / EU) — Card, Apple Pay, and Google Pay processing. Stripe is PCI DSS Level 1 certified. Transfers under Standard Contractual Clauses.
• PayPal (United States / EU) — PayPal balance and PayPal-routed payments.
• Postmark (United States) — Email delivery.
• Bunny CDN (European Union) — Image and media delivery.
• Turso (United States) — Database hosting, protected by Standard Contractual Clauses.

Data Processing Agreements are in place with all sub-processors to ensure your data is protected in accordance with GDPR requirements.

3. SMS Data and Phone Number Handling

We take the protection of phone numbers and SMS data seriously:

• Purpose: Phone numbers are collected exclusively for delivering digital greeting card notifications via SMS.
• No Marketing: We do not use recipient phone numbers for marketing purposes. Recipients receive only the greeting card notification message.
• No Sharing: We do not sell, rent, or share phone numbers with third parties for marketing purposes.
• Service Provider: SMS messages are transmitted through Twilio, our trusted telecommunications service provider. Twilio processes phone numbers solely to deliver messages on our behalf and is bound by strict data protection agreements.
• Data Retention: Phone numbers and SMS delivery records are retained only as long as necessary to complete the transaction and provide customer support. Greeting card content expires 72 hours after first viewing.
• Opt-Out: Recipients can opt out at any time by visiting our SMS Consent Policy page or contacting us at [email protected].

4. Information Sharing

We share your information only with the following parties and only as necessary to provide our service:

• Stripe and PayPal: For payment processing. Stripe handles card, Apple Pay, and Google Pay transactions; PayPal handles PayPal-routed payments. Neither processor shares your full card number with us.
• Twilio: Our SMS service provider, used exclusively for delivering greeting card notifications to recipients. Twilio is a TCPA-compliant, enterprise-grade telecommunications provider.
• Bunny CDN: For secure storage and delivery of greeting card images and media.

We do not sell, trade, or otherwise transfer your personal information to third parties for marketing or advertising purposes.

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Secure HTTPS encryption for all data transmission
• Secure storage of phone numbers and personal data
• Limited access to personal data on a need-to-know basis
• Regular security reviews and updates

6. Data Retention

We retain your information only as long as necessary:

• Order Information: Retained for accounting and legal compliance purposes.
• Greeting Card Content: Expires and becomes inaccessible 72 hours after first viewing.
• SMS Delivery Logs: Retained for customer support and delivery verification purposes.

7. Cookies and Tracking

We use essential cookies to maintain your shopping cart functionality. We do not use tracking cookies, advertising cookies, or third-party analytics that track individual users.

8. Your Rights (GDPR Articles 15-22)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access (Art. 15) — Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — Request correction of inaccurate personal data.
• Right to erasure (Art. 17) — Request deletion of your personal data, subject to legal retention requirements.
• Right to restriction (Art. 18) — Request that we limit how we process your data.
• Right to data portability (Art. 20) — Receive your personal data in a structured, commonly used format.
• Right to object (Art. 21) — Object to the processing of your personal data based on legitimate interests.
• Opt out of SMS — Visit our SMS Consent Policy page or email [email protected].

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority:

• European Union — your national supervisory authority, or our lead authority, the UODO (Urząd Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland — uodo.gov.pl.
• Ireland — Data Protection Commission (DPC), 21 Fitzwilliam Square South, Dublin 2, D02 RD28 — dataprotection.ie.
• United Kingdom — Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk.
• California, USA — California Privacy Protection Agency (CPPA) — cppa.ca.gov, or the California Attorney General — oag.ca.gov.
• Other US residents — Federal Trade Commission (FTC) — reportfraud.ftc.gov, or your state attorney general's office.

9. Children's Privacy

Our service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the "Last updated" date at the top of this policy.

11. Data Controller

The data controller responsible for your personal information is:

12. Contact Us

For questions about this Privacy Policy or to exercise your rights, please contact us at:

Email: [email protected]

For SMS-related inquiries, please visit our SMS Consent Policy page or email us directly.