Privacy policy

1. Who handles your data

The data controller is [company name], registered office at [registered office], VAT number [VAT number].

For any question about your data, write to [privacy email].

2. What data we collect

• Account: name, email address and password, which we only keep in encrypted form. If you sign in with Google, we receive your name, email and profile picture from Google.
• Orders: name, shipping address, email, any gift message and the details of the deck you ordered. Your payment card details are handled by Stripe: we never see or store them.
• Your deck: the photos you upload, place names, texts, the initials on the card back and the illustrations created for you.
• Technical data: IP address and browser information recorded by the servers for security and operation, and an anonymous identifier that counts the free illustration tries.
• Usage statistics, only if you consent: the steps of your visit (pages, configurator steps, main choices, cart, payment), device type, language and the site you came from, tied to a random code that deletes itself after 30 days without visits. Never your name, email, IP address or photos.

3. Why we use it

• To give you the service you ask for: creating the deck, managing your account, producing and shipping the order, sending you the digital files and helping you. Legal basis: performance of a contract (Art. 6.1.b GDPR).
• To comply with the law, for example tax and accounting obligations on orders. Legal basis: legal obligation (Art. 6.1.c).
• To protect the site from abuse and fraud, including by limiting the free illustration tries. Legal basis: legitimate interest (Art. 6.1.f).
• To understand how to improve the site, with usage statistics. Legal basis: your consent (Art. 6.1.a), which you can withdraw at any time from "Cookie preferences" at the bottom of the pages.
• To follow orders: when an order is paid or a new account is created, we receive an internal notification with the amount and format, without name, email or address. Legal basis: performance of a contract and legitimate interest (Art. 6.1.b and 6.1.f).

4. Your photos and the AI illustrations

The photos you upload are only used to create the cards of your deck. While you design, they stay on your device. When you ask for an illustration, the photo is sent to an artificial intelligence provider that redraws it and returns it to us. The illustrations are kept in our archive so we can show them to you, produce the order and let you reprint it.

If you save a draft ("Save draft" in the configurator), the deck and its photos are stored on our servers so you can pick it up again from the link or from your account, on any device.

We do not use your photos for any other purpose, we do not publish them and we do not sell them.

5. Who we entrust it to

We rely on providers that process data on our behalf, each only for its own part:

• Netlify: hosts the site and the server functions.
• Supabase: manages accounts, saved drafts and the illustration archive.
• Stripe: handles payments as an independent controller, under its own policy.
• AI illustration providers (Cloudflare, Google, fal.ai): they receive the photo only to redraw it.
• Unsplash and Pexels: provide the archive images when you search for them.
• Telegram: delivers statistics (if you consent) and internal notifications about orders and new accounts to the controller, in a private channel. It does not receive your name, email, IP address or photos.
• Printer and courier: for printed decks they receive the files and the delivery address.

Some of these providers are based in the United States: see the next paragraph.

6. Data outside the European Union

When a provider processes data outside the European Union, the transfer takes place under the safeguards set out in the GDPR: the EU-US adequacy decision (EU-U.S. Data Privacy Framework) for participating providers, or the standard contractual clauses approved by the European Commission.

7. For how long

• Account: until you ask us to delete it.
• Orders and tax documents: 10 years, as required by law (Art. 2220 of the Italian Civil Code).
• Photos, drafts and illustrations: for the time needed to produce the order and reprint it, and in any case no longer than 24 months after the last activity on your deck, unless you ask us to delete them sooner.
• Server technical data: for the period set by the hosting providers, usually a few weeks.
• Statistics and internal notifications: 12 months at most.

8. What stays in your browser

The deck in progress, the cart and your account session stay saved in your browser, so you don't lose your work if you close the page. All the details are on the cookie page.

9. Your rights

You can ask us at any time to access your data, correct it, delete it, restrict its use, receive it in a readable format or object to its processing. Write to [privacy email]: we reply within one month.

If you believe your data is not being handled correctly, you can lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the authority of the country where you live.

10. Minors

You must be at least 18 years old to create an account and make a purchase.

11. Changes to this policy

If we change the way we handle data, we update this page and the date at the top. If the change is significant, we also tell you by email.