Business Terms & Data Processing Agreement

For businesses using the AllCards Business Studio, automations and API. Last updated 20 October 2026.

1. Who we are

These terms are between you (the business using the Business Studio, "you") and AllCards.ai ("we", "us"). Contact: cards@allcards.ai.

2. What we provide

We design, print and post cards, A5 postcard flyers and letters to the people and businesses you choose, in the UK, through the Business Studio, automations, send links and our API. Where you switch on bespoke designs, we read each recipient business's own public website to design its item. Printing and UK postage are included in each credit.

3. Credits, payment and refunds

• Each item uses one credit (gifts use extra credits as shown). Credits are bought in packs, monthly plans, or at the moment of sending.
• Items that fail before printing, or that you stop before they are made, are refunded as credits. Items already printed or posted can't be refunded.
• Business data (names and addresses we supply) is charged per record found and is non-refundable once delivered to your campaign.
• Prices include VAT where it applies. Receipts and monthly statements are in the Studio. Larger accounts can ask to pay by invoice.

4. Your content and your list

• You're responsible for the content you supply and for having a lawful basis to send post to each recipient (for example legitimate interests for business-to-business marketing, or an existing customer relationship).
• You must not send anything unlawful, misleading, defamatory, or that infringes anyone's rights. We may refuse or stop any item, and our safety checks may block designs.
• You must honour opt-outs. Every item carries an opt-out link; people who opt out are added to the do-not-mail list automatically and left out of future sends.
• Keep your API key secret. You're responsible for anything sent with it until you replace it.
• Where you post to consumers or homeowners (including through the estate agent autopilot), you're responsible for screening against the Mailing Preference Service where the law or the DMA Code requires it, and for any notices or consents you need.
• Before your first send you confirm a data declaration in the Business Studio. We record who confirmed it, when, from which IP address and which wording. Sends, automations, send links and the API stay switched off until it is confirmed, and we may ask you to confirm again if the wording changes.
• Indemnity. You will indemnify us against any claims, fines, losses and reasonable costs that arise from your data, your recipient lists, your lack of a lawful basis to contact someone, or your content.

5. Delivery

We hand items to Royal Mail (2nd class unless agreed otherwise). Delivery dates are estimates; we're not responsible for Royal Mail delays or for items that can't be delivered to the address you gave. Addresses are checked against the national postcode list, but you remain responsible for their accuracy.

6. Liability

Nothing limits liability that can't be limited by law. Otherwise our total liability in any 12 months is limited to what you paid us in that period, and we're not liable for indirect or consequential loss, or loss of profit, revenue or data.

7. Changes and ending

We may update these terms with reasonable notice. You can stop using the service at any time; unused credits stay on your account. We may suspend accounts that break these terms.

8. Law

These terms are governed by the law of England and Wales, and its courts have jurisdiction.

Data Processing Agreement (UK GDPR Article 28)

1. Roles

For the recipient details you upload or send us (names, addresses, emails and any other fields), you are the controller and we are your processor. For business data we supply to you, and for our own account, billing and security records, we are a controller.

2. What we process, and why

• Subject matter: designing, printing, posting and tracking items you ask us to send; personal pages, opt-outs, lead forms and follow-up emails you switch on.
• Data subjects: your customers, prospects, staff and their contacts.
• Personal data: names, postal addresses, email addresses and phone numbers where provided, business names and websites, team photos from a business's own public website when you switch faces on, and how they interact with their personal page.
• Duration: while your account is active and for up to 24 months after an item is sent (for tracking, receipts and disputes), unless you ask us to delete it sooner.

3. Our commitments

1. We process personal data only on your documented instructions (your campaigns, automations and API calls), unless the law requires otherwise.
2. Everyone who handles it is bound by confidentiality.
3. We use appropriate technical and organisational security, including encrypted connections, access controls and backups.
4. We use these sub-processors, each under written terms with equivalent protections: our web hosting provider (UK/EU); Cloudflare (file storage); Prodigi and Intelliprint (printing and posting, UK); Replicate and Google (AI design and writing — no recipient addresses are sent); Stripe (payments); our email provider. We'll tell you before adding or replacing one, and you may object.
5. Where data leaves the UK, we rely on adequacy regulations or the UK International Data Transfer Addendum.
6. We help you respond to people exercising their rights, and with security, breach notification, data protection impact assessments and consultations, taking into account the nature of the processing.
7. We tell you without undue delay after becoming aware of a personal data breach affecting your data.
8. When you close your account, we delete or return your recipient data (your choice) unless the law requires us to keep it.
9. We make available the information you need to show compliance and allow reasonable audits, on reasonable notice and no more than once a year.

To sign a copy of this agreement for your records, email cards@allcards.ai.