CardYourself Privacy Policy

Who we are. CardYourself is operated by Côme Geoffray EI, 445 Grande Rue, 01240 Marlieux, France ("we"). Contact: privacy@cardyourselfdeck.com.

What we collect.

• You give us: name, email, shipping and billing address, order details, your Photos and chosen options, messages to support.
• Payment: handled by Stripe. We never see or store your card number.
• Automatically: IP address, device and browser data, pages viewed, and advertising/analytics identifiers (see Cookies).

How we use it. To create, print and deliver your order; send order emails; provide support; prevent fraud and abuse; measure and improve our site and advertising; comply with law; and, with your separate permission, send marketing emails.

Photos and Face Data. Governed by our Photo & Biometric Data Policy, which is part of this policy.

Who we share it with. Service providers who help us run the business, under their own terms: Stripe (payments), OpenAI (image generation), The Game Crafter and its carrier (printing and delivery, which receive your finished Portraits and shipping address), Vercel, Resend, Google Analytics, Google (analytics and advertising) and OpenAI (advertising). We do not sell your personal information. We do not share your Photos with any advertising platform or advertising service, including OpenAI's.

Cookies and advertising. We use cookies and similar technologies for the site to work, for analytics, and for advertising measurement. You can control cookies in your browser. We do not respond to Do Not Track signals.

Retention. As in the Photo & Biometric Data Policy; order records as required by law; marketing data until you unsubscribe.

Your rights. You may ask to access, correct or delete your personal information, or to withdraw consent, by emailing privacy@cardyourselfdeck.com. We reply within 30 days. Residents of California and other states with privacy laws have additional rights, including to know what we collect, to delete it, and to opt out of the sale or sharing of personal information; we do not sell it. We will not discriminate against you for using these rights.

International. We operate from France and process data in the United States and France. The EU General Data Protection Regulation (GDPR) applies to our processing. We rely on your consent for your Photos and Portraits, for marketing and for non-essential cookies; on our contract with you to fulfil your order; on legal obligations for tax and accounting records; and on our legitimate interest in keeping the site secure. You may access, correct, delete or port your data, restrict or object to its processing, withdraw your consent at any time, and complain to the French data protection authority (CNIL). Some of our providers are in the United States; these transfers rely on safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

Security and incidents. We protect data with encryption and access controls. If a breach affects you, we will notify you and the authorities as the law requires.

Changes. We will post changes here and update the date; for material changes to how we handle Photos, we will ask for your consent again.