Draft — needs lawyer review
Privacy Policy
Last updated: [DATE]
What we collect
Your email address; the recipient's and sender's names and your message; payment status (card details are handled by Stripe and never reach us); basic technical logs (IP address, browser) for security and fraud prevention.
Why
To make and deliver your card, send order emails, provide support, prevent abuse, and meet legal and tax obligations. Marketing emails only if you opt in.
Email and card analytics
Our order emails contain a tiny tracking image and links that pass through our email provider (Resend, on links.ecardtoon.com), so we can see whether an email was delivered, opened and whether a link was clicked. Some email apps (for example Apple Mail) open emails automatically, so "opened" is approximate.
On the order page we record when a card is viewed, played to the end or downloaded, with only the order, the video shape, the page language and a coarse device type (phone, tablet or computer). We don't store IP addresses or browser fingerprints for this, and we don't use advertising cookies. We use it to check that cards arrive and play properly and to improve the service.
Who processes it for us
Stripe (payments), Supabase (database/sign-in), Cloudflare (media storage and delivery), ElevenLabs (voice generation from your text), Resend (email), Vercel (website hosting), and our render server provider [HETZNER/NETCUP]. Each processes data only to provide its service.
Children
Cards are often made for children, but our service is for adults to purchase. We ask only for a first name for the recipient; please don't include other personal details about a child in messages.
How long we keep it
Card videos and audio: [e.g. 12 months] after purchase, then deleted. Order records: as required for tax and accounting ([e.g. 7 years]). You can ask us to delete your card earlier.
Your rights
Depending on where you live you may request access, correction, deletion or a copy of your data, and object to certain processing. Contact [PRIVACY EMAIL]. You can also complain to your local data-protection authority.