Privacy Policy

1. Who we are

Playing Cards (“we”, “us”, “our”) operates the website playingcards.ai. We are a UK-based business that creates and sells personalised playing cards.

Contact email: hello@playingcards.ai

2. What personal data we collect

When you place an order or interact with our site, we may collect the following information:

Name and delivery address — to fulfil and ship your order
Email address — to send order updates and respond to enquiries
Payment information — processed securely by Stripe. We do not store your card details on our servers.
Photographs — uploaded by you to create personalised playing card artwork
Technical data — we collect anonymised, aggregated usage data such as pages visited and device type via a cookieless analytics service that stores nothing on your device and cannot identify you

3. Why we collect your data

We use your personal data for the following purposes:

To create and deliver your personalised playing cards
To process your payment via Stripe
To send you order confirmation, review, and shipping update emails
To respond to support enquiries submitted through our contact form
To improve our website and service using anonymised, cookieless analytics

Our legal basis for processing your data is the performance of a contract (fulfilling your order) and, for anonymised analytics, our legitimate interest in improving the website.

4. How we handle your photographs

We take the handling of your photographs very seriously. Here is exactly what happens to the photos you upload:

Purpose: Photos are uploaded solely for the purpose of creating personalised playing card artwork. They are not used for any other purpose.
Storage: Your original photos are stored securely in our cloud storage (Supabase) during the creation and production process.
Automatic deletion: Your original uploaded photos are automatically and permanently deleted 30 days after your order is completed and delivered.
No secondary use: We do not use your photos for marketing, AI training, advertising, or any other purpose without your explicit written consent.
Early deletion: You may request immediate deletion of your photos at any time by emailing hello@playingcards.ai.

Note: Generated card artwork (the illustrated card images created from your photos) may be retained for a limited period after photo deletion to support reprints in the event of delivery issues. This artwork does not contain the original photographs.

5. Third parties we share data with

We share your data only with the following service providers, solely for the purpose of fulfilling your order:

Provider	Purpose	Data shared
Stripe	Payment processing	Name, email, payment details
QPMN	Print fulfilment	Card artwork files, delivery address
Resend	Transactional emails	Email address, name
Supabase	Database and file storage	All order data, uploaded photos
Vercel	Website hosting and cookieless analytics	Standard server logs (IP, user agent), anonymised usage events

We do not sell your personal data to any third party.

6. Cookies

We use a small number of essential cookies to make our website work, such as those needed for your shopping cart and checkout. These are strictly necessary and are set without consent. We do not use any analytics, advertising, or marketing cookies — our analytics is cookieless and stores nothing on your device.

For a full breakdown of every cookie we use, please see our Cookie Policy.

7. Data retention

We retain different types of data for different periods:

Original uploaded photos: Automatically deleted 30 days after order completion
Generated card artwork: Retained for up to 90 days after order completion to support potential reprints, then deleted
Order records (name, email, address, order details): Retained for 6 years to comply with UK tax and accounting obligations
Contact form submissions: Retained for 12 months, then deleted
Analytics data: Anonymised and aggregated; retained for up to 12 months

8. Your rights under UK GDPR

Under the UK General Data Protection Regulation, you have the following rights:

Right of access — request a copy of the personal data we hold about you
Right to rectification — request correction of inaccurate data
Right to erasure — request deletion of your personal data
Right to restrict processing — ask us to limit how we use your data
Right to data portability — request your data in a machine-readable format
Right to object — object to our processing of your data

To exercise any of these rights, please email hello@playingcards.ai. We will respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. How we protect your data

We take the security of your personal data seriously. Our measures include:

All data transmitted between your browser and our servers is encrypted using HTTPS/TLS
Payment information is handled entirely by Stripe, a PCI-DSS Level 1 certified payment processor
Uploaded photos and order data are stored in Supabase with access controls and row-level security policies
Access to customer data is restricted to authorised personnel only

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make significant changes, we will update the “Last updated” date at the top of this page. We encourage you to review this page periodically. For material changes that affect how we process your data, we will make reasonable efforts to notify affected customers by email.