Privacy & Cookie Policy
Last updated: 18 October 2026
Who we are
AllCards.ai is run by AllCards.ai ("we", "us"). We are the controller of the personal information described here. Questions or requests: cards@allcards.ai.
What we collect and why
| Information | Why we use it | Legal basis |
|---|---|---|
| Account details (name, email, password) | To run your account, save your cards, send receipts and service emails | Contract |
| What you put on cards: words, details about the person, photos — including photos of faces | To make the card you asked for (AI design, putting a face into the picture, printing) | Contract. Faces are used only to make your card, never to identify anyone |
| Video and voice messages | To store your message and play it to whoever scans the QR code or opens the e-card. Checked automatically for unsafe content | Contract |
| Recipients' names and postal addresses, your address book, birthdays you save | To post cards and send you the reminders you set up | Contract / legitimate interests |
| Payment details | Handled by Stripe — we never see or store your card number | Contract |
| Order and delivery details | To print, post and track your order and handle any problems | Contract / legal obligation (tax records) |
| Emails about your cards: order and delivery updates, "your card is waiting", reminders, one review request | To complete and support your orders | Legitimate interests — every email has a one-click unsubscribe |
| Reviews you write | Published on our site with your first name | Consent |
| Your buyers' names and addresses (Sell Studio) | To print and post the cards you've sold. You are the controller of your buyers' details and we process them on your behalf, only for this | Contract (with you) |
| Referral (Card Empire) activity | To credit free cards and commission you earn | Contract |
| Usage data and cookies | See Cookies | Consent (except essential cookies) |
Designs shared to our card shop
When you keep a card you designed, an anonymised version may be added to our public card shop so others can personalise it. Before that happens, real faces are replaced with AI-generated people, names and personal words are removed, and every design is safety-checked. You can switch this off in the card editor at any time ("Share an anonymised version in the shop"), and ask us to remove any design.
Business customers
If you upload a list of people in Business Studio, you are the controller of that list and we process it on your behalf, only to print and post your cards. You must have a lawful basis to send them a card. We keep the list only as long as needed to complete your campaign and keep records.
Who we share it with
Only the services we need to make and deliver your cards, under contract: Stripe (payments), Prodigi (printing and posting), Cloudflare (secure file storage), Google (Gemini AI, for safety checks and designing cards), Replicate (AI image generation), Hostinger (website hosting and email), and, only if you accept analytics cookies, Google Analytics, Google Ads and Meta. Some of these providers are in the USA. Transfers are protected by the UK International Data Transfer Addendum or the UK–US data bridge. We never sell your information.
How long we keep it
- Your account and saved cards: while you have an account. Delete it any time by emailing us.
- Orders: 6 years, for tax and accounting.
- Video and voice messages: until you delete them (from the message page), or 2 years after they were made.
- Unfinished card designs used for "your card is waiting" emails: up to 90 days.
- Business recipient lists: until the campaign is complete plus 12 months.
Your rights
You can ask for a copy of your information, ask us to correct or delete it, object to or restrict how we use it, ask us to move it to another service, and withdraw consent at any time. Email cards@allcards.ai — we reply within one month. If you're unhappy, you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
Children
Accounts are for people aged 13 and over. Please don't upload photos of other people's children without their parent's or guardian's permission.
Cookies
| Cookie | Purpose | Needs consent? |
|---|---|---|
| PHPSESSID | Keeps you logged in — the site can't work without it | No (essential) |
| ac_ref, ac_ref_src | Remembers which friend referred you, so they get their reward (30 days) | No (needed for the referral service you used) |
| Google Analytics (_ga, _ga_*) | Counts visits and how the site is used | Yes |
| Google Ads (_gcl_*), Meta Pixel (_fbp) | Measures whether our adverts work | Yes |
Analytics and advertising cookies are only set if you press "Accept" on the cookie banner. You can change your mind any time: Cookie settings.
Changes
If we change this policy in a way that matters, we'll tell you by email or on the site.