CardYourself Photo & Biometric Data Policy
What this covers. The photos you upload to create your cards ("Photos"), the finished portraits generated from them ("Portraits"), and any information derived from the faces in them, which some laws call biometric identifiers or biometric information ("Face Data").
Why we process them. Only to generate your Portraits, show you a proof, and print and ship your order. We do not use Photos, Portraits or Face Data to train AI models, for advertising, for any other product, or to identify anyone. We do not sell, lease, trade or otherwise profit from them.
Who sees them. Our image-generation provider (OpenAI), to generate your Portraits; our printer (The Game Crafter) receives the finished Portraits only, not your original Photos; our hosting provider (Vercel), which stores files encrypted. We do not send Photos to any advertising platform or advertising service, including OpenAI's. We disclose them to authorities only if required by law.
How long we keep them.
| Item | Retention |
|---|---|
| Original Photos | Deleted, with your free previews, within 90 days after the estimated delivery date of your most recent order (the shipping date plus 5 business days), so you have time to order another deck |
| Photos and previews from visitors who have not ordered (abandoned carts included) | Deleted within 30 days after your last recorded visit or action |
| Photos and Portraits from cancelled or refunded orders | Deleted within 7 days, except a Photo that you also used for another order of yours: it follows the period of that order |
| Face Data we hold, if any | Deleted at the same time as the Photos it came from |
| Finished Portraits | Kept 12 months after delivery for reprints, then deleted. This includes the image of a free preview that became a card of your deck |
| Earlier versions of a Photo that you replaced | Same period as your latest Photo |
| Thumbnail of your Photo shown to you | Same period as the Photo it comes from |
| High-definition preview Portraits made for a visitor who has not ordered | Deleted within 30 days after your last recorded visit or action |
| Web images without watermark, refused Portraits and earlier versions of Portraits | Same period as Portraits: kept 12 months after delivery, then deleted |
| IP address recorded with a Photo upload | Deleted when the Photo file is deleted |
| Device and IP fingerprints used against abuse | Deleted within 30 days |
| One-way code (hash) made from your email address, used to count free previews per mailbox | Deleted with the email address record it belongs to: 30 days after your last recorded visit or action if you gave no consent and placed no order; otherwise at the same time as your consent record (5 years after your last Photo was deleted, and as long as an order record refers to it), or sooner if you ask us to delete your data |
| Consent record (including the IP address and the text versions you accepted) | Kept 5 years after your last Photo was deleted, and as long as an order record refers to it |
| Deck acceptance record | Kept as long as the order record it belongs to |
| Copies at OpenAI | Up to 30 days in its safety logs |
| Order records (name, address, payment confirmation, printer order number, tracking number, refund confirmation and the history of your order) | [TAX RECORD YEARS] years, as tax law requires |
| Notes our team writes about your order | Deleted 12 months after delivery, or 12 months after the refund of an order that was not shipped, or sooner if you ask us to delete your data |
In every case, we destroy Face Data when the purpose for which it was collected is satisfied or within 3 years of your last interaction with us, whichever comes first.
Your choices. Email privacy@cardyourselfdeck.com to ask us to delete your Photos, Portraits and Face Data at any time, or to withdraw consent. We will reply within 30 days and delete them, except records we must keep by law. Withdrawing consent after we have printed your order does not undo the printed order.
Security. Files are encrypted in transit and at rest, access is restricted, and deletion is automatic.
Children. Our service is for adults. You must be 18 or older to order. If you upload a photo of a child, you confirm that you are their parent or legal guardian. We do not knowingly collect information directly from children under 13; if we learn that we have, we will delete it.
Contact: Côme Geoffray EI, 445 Grande Rue, 01240 Marlieux, France, privacy@cardyourselfdeck.com.