Privacy notice

The controller is Card2Print (the company is being registered in Romania; its legal name, registration number and address will appear here). Contact us about your data at support@card2print.com, through the contact form (choose “My personal data”) or the live chat.

• If you start a card: your first name and email, the card’s details (occasion, title, recipient’s name and, if you add it, their email, delivery date), and what you buy. We never see card numbers: Stripe or Apple handle payments.
• If you sign a card: your name, your message and any GIF or photo you add; your email only if you ask to be told when the card is delivered.
• If a card is for you: your name and the email it’s delivered to; your reactions and thank-you reply; any gift card sent to you. If you sign in with that email, the card appears in My cards under Received.
• If you sign in: your email and when you signed in, with a shortened IP address.
• If you contact us (email, contact form or live chat): your name, email, what you write, the card or gift it’s about, and your answer to our one-question satisfaction survey if you give one.
• If you tap an extra that's “Coming soon” (free beta): we count the tap, with no name, account or IP address. If you ask us to tell you when it's ready, we keep your email for that one message, then delete it.
• If you report content: your report, your email if you give it, and a shortened IP address.
• If you buy a gift card: the gift’s value, shop and recipient’s name, and the payment checks described in section 4.
• Technical: a random device id in your browser (so you can edit your message), shortened IP addresses in our security logs, and which website or campaign link brought you to us (noted with the card you create, without storing anything on your device).

We don’t use your data for advertising, we don’t sell it, and we don’t make decisions about you by automated means alone.

To stop stolen cards being used to buy gift cards, every payment gets an automatic risk score from things like the amount, how many gift cards were bought recently, whether the card was used by other customers, and the fraud signals Stripe gives us. Most payments go straight through. A risky gift card is held before it’s bought and a person on our team decides; we never refuse a payment automatically, except an email or card on our block list, or a pause after many unfinished attempts. For larger gift cards we may ask you to confirm your identity with Stripe Identity (a photo of an ID document and a selfie): Stripe keeps the images, and we keep only the result and the name. If it isn’t done within 7 days, the order is refunded in full. We also check buyers’ names against the EU sanctions list. These records are kept for 5 years. You can ask a person to look at any decision again.

We only use what’s strictly necessary, so there’s nothing to accept or refuse: a sign-in cookie if you sign in; a cookie that remembers your demo card for 7 days; and, in your browser’s storage, your device id, the cards you manage on that device, and a random id for an open live chat. No analytics, advertising or tracking cookies.

Only the people with a card’s links see the card. Our suppliers process data for us under contracts that bind them to our instructions:

Where data goes outside the EU or the UK, it’s protected by an adequacy decision (for example, the UK and, for certified companies, the EU–US Data Privacy Framework) or by the European Commission’s standard contractual clauses (with the UK addendum for UK data). Ask us for a copy of the safeguards. We share data with authorities only when the law requires it.

Under the EU GDPR and the UK GDPR you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; and give it to you in a format you can take elsewhere. You can withdraw consent at any time. We answer within one month.

• Signers can edit or delete their own message from the device they signed on, and unsubscribe from card emails in one click.
• The person who started a card can export it or delete it, and delete their whole account, from My cards.
• For anything else, write to us (contact form: “My personal data”).

You can complain to a data protection authority: in Romania, ANSPDCP (dataprotection.ro); in the UK, the Information Commissioner’s Office (ico.org.uk); or the authority where you live. We’d like the chance to help first.

You must be 16 or over to start a card, sign in or buy anything. Anyone with a signing link can sign a card; a child should ask a parent first. If you think a child has given us personal data without permission, write to us and we’ll delete it.

Card links are long random codes and are never listed publicly; connections are encrypted; gift card codes are stored encrypted; our staff use a separate, two-factor protected console, see only what their job needs, and everything they do is recorded. If something goes wrong with your data, we’ll tell you and the authority as the law requires.

When this notice changes, the version and date at the top change too. If a change affects you significantly, we’ll tell you first.