Privacy Policy

Playing Cards (“we”, “us”, “our”) operates the website playingcards.ai. We are a UK-based business that creates and sells personalised playing cards.

Contact email: hello@playingcards.ai

When you place an order or interact with our site, we may collect the following information:

• Name and delivery address — to fulfil and ship your order
• Email address — to send order updates and respond to enquiries
• Payment information — processed securely by Stripe. We do not store your card details on our servers.
• Photographs — uploaded by you to create personalised playing card artwork
• Technical data — if you consent to analytics cookies, we collect anonymised usage data such as pages visited, session duration, and device type

We use your personal data for the following purposes:

• To create and deliver your personalised playing cards
• To process your payment via Stripe
• To send you order confirmation, review, and shipping update emails
• To respond to support enquiries submitted through our contact form
• To improve our website and service (only with your analytics consent)

Our legal basis for processing your data is the performance of a contract (fulfilling your order) and, for analytics, your consent.

We take the handling of your photographs very seriously. Here is exactly what happens to the photos you upload:

• Purpose: Photos are uploaded solely for the purpose of creating personalised playing card artwork. They are not used for any other purpose.
• Storage: Your original photos are stored securely in our cloud storage (Supabase) during the creation and production process.
• Automatic deletion: Your original uploaded photos are automatically and permanently deleted 30 days after your order is completed and delivered.
• No secondary use: We do not use your photos for marketing, AI training, advertising, or any other purpose without your explicit written consent.
• Early deletion: You may request immediate deletion of your photos at any time by emailing hello@playingcards.ai.

Note: Generated card artwork (the illustrated card images created from your photos) may be retained for a limited period after photo deletion to support reprints in the event of delivery issues. This artwork does not contain the original photographs.

We share your data only with the following service providers, solely for the purpose of fulfilling your order:

We do not sell your personal data to any third party.

We use a small number of cookies to make our website work and, with your consent, to understand how visitors use our site. Essential cookies (such as those needed for your shopping cart and checkout) are set without consent as they are strictly necessary. Analytics cookies are only set after you give consent.

For a full breakdown of every cookie we use, please see our Cookie Policy.

We retain different types of data for different periods:

• Original uploaded photos: Automatically deleted 30 days after order completion
• Generated card artwork: Retained for up to 90 days after order completion to support potential reprints, then deleted
• Order records (name, email, address, order details): Retained for 6 years to comply with UK tax and accounting obligations
• Contact form submissions: Retained for 12 months, then deleted
• Analytics data: Anonymised and retained for up to 12 months

Under the UK General Data Protection Regulation, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your personal data
• Right to restrict processing — ask us to limit how we use your data
• Right to data portability — request your data in a machine-readable format
• Right to object — object to our processing of your data

To exercise any of these rights, please email hello@playingcards.ai. We will respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We take the security of your personal data seriously. Our measures include:

• All data transmitted between your browser and our servers is encrypted using HTTPS/TLS
• Payment information is handled entirely by Stripe, a PCI-DSS Level 1 certified payment processor
• Uploaded photos and order data are stored in Supabase with access controls and row-level security policies
• Access to customer data is restricted to authorised personnel only

We may update this Privacy Policy from time to time. If we make significant changes, we will update the “Last updated” date at the top of this page. We encourage you to review this page periodically. For material changes that affect how we process your data, we will make reasonable efforts to notify affected customers by email.