Privacy Policy

Card content. The photos you upload and the text you add — names, teams, dates, stats, and the message on the back. This is the product, so we store it to render, print, and ship your card, and to show it again if you return to a saved design. If you add a headline, a story, more photographs, or links to a card page, we store them to show on that page. If the card is part of a group pack, the photographs and links added to it also appear on the pack’s page. Photographs on cards often show children, supplied by a parent, a relative, or a coach; see Children below.

Order and shipping details. When you buy, Stripe collects your email, phone number, billing address, and a US shipping address on our behalf, and we store the resulting order record (order number, amount, currency, what was ordered, promo code used, and where to send it).

Payment details. Handled entirely by Stripe. Card numbers never reach Cardbop’s servers.

Account details. For each account, we store your name, email address, account identifier, and authentication data through Supabase. Supabase stores and manages your password in hashed form; the password itself is not visible to us. We use the account identifier to associate orders and product analytics events with your account. Every order is linked to an account. If you are not signed in when you buy, we create one for the email address you use at checkout and send you a link to set a password.

Usage data. Pages viewed, approximate location derived from IP, device and browser type, and a small number of events — clicking a call-to-action, uploading photos, saving a draft, reaching preview, publishing a pack, starting checkout, and completing a purchase. When someone scans a card, we record whether its card page has had anything added, whether the person opening the page is the owner, someone the owner invited, another signed-in user, or a visitor, and any referring site, but not who the person is, their IP address, or a device identifier. That scan record is our own. Card pages also load Google Analytics, which collects more, and links on them do not load content from the linked site. See Analytics and cookies.

Messages you send us. If you contact us, we keep your message, name, and email address so we can reply.

Newsletter subscription. If you sign up, we store your email address, where you signed up from, and whether you have since unsubscribed.

Referrals. If you enter a referral partner’s code at checkout, or reach Cardbop through a partner’s link and then place an order, we record it with your order so we can credit the partner. We give partners only totals, such as the number and value of the orders they referred, never your name, contact details, or order details.

Your rights confirmation. When you confirm that you own or have permission to use the photos in an order, we store that confirmation — the exact wording and the time — alongside the order. See Your photos.

IP address, briefly. We read your IP address to rate-limit forms and block bots, and to decide which country you are in for the analytics rule below. We do not store IP addresses in our database — they are held in memory for a few minutes and discarded. Our hosting and security providers keep their own short-lived logs.

Set out formally, for California and other state privacy laws, here are the categories of personal information we have collected in the past 12 months, where each comes from, and why we hold it. Sensitive personal information is addressed after the table.

Each category is disclosed to the service providers listed in Who we share it with for the purpose shown, and identifiers and internet and device activity are also made available to advertising partners as described in Section 6. We do not collect Social Security numbers, driver’s license numbers, precise geolocation, health information, or account credentials for other services.

Sensitive personal information. A photograph can reveal things a privacy law treats as sensitive — for example race or religion. We do not use photographs to infer any characteristic about you, and we use sensitive personal information only to provide the card services you request, including saving, displaying at your direction, printing, delivering, and supporting cards. We therefore do not use or disclose it for purposes that would trigger the right to limit its use under California law.

To design, print, and deliver your order; to show you your saved cards; to process payment and handle refunds or reprints; to send order and shipping email about a purchase you made; to send newsletter email if you asked for it; to answer your questions; to detect abuse and prevent fraud; to keep a record of the photo-rights confirmation you gave; to meet accounting, tax, and legal obligations; to understand which parts of the site are useful so we can improve them; to advertise Cardbop, including on other websites and apps, unless you opt out; and to credit referral partners for orders they refer.

We do not use your photos or card content to train machine-learning models, we do not sell them, and we do not use them in marketing without asking you first.

We do not use your information to make decisions about you that produce legal or similarly significant effects without human involvement.

If you are in a place whose law requires us to identify a legal basis — the UK and the EEA, for example — we rely on the following:

• Performance of a contract — to make and deliver the cards you ordered, and to run your account.
• Legitimate interests — to secure the site, prevent fraud and abuse, understand how the product is used, and keep a record of the rights confirmation you gave. We balance these against your interests.
• Consent — for newsletter email, and for anything else we specifically ask you to agree to. You can withdraw consent at any time.
• Legal obligation — to keep tax and accounting records and respond to lawful requests.

We share personal information with service providers who process it to help us run Cardbop, and with advertising partners as described in Section 6:

• Stripe — payment processing, billing and shipping collection, tax calculation.
• Supabase — database, file storage for photos and card art, and account authentication.
• Vercel — website hosting and delivery.
• Google Analytics — website usage measurement (not loaded for EEA, UK, and Switzerland visitors).
• Cloudflare — Turnstile bot and abuse protection on our forms.
• Google Drive — holds our nightly backup copy of the photographs you upload or add to card pages, and of our card and order records, in an account we control. See How long we keep it.
• Our printing partner — receives the card artwork needed to produce your order, which may include photographs and names appearing on the card. We do not send separate purchaser contact information or order history with the artwork. They store that artwork outside the United States for production and may keep it afterwards. See Where your information is handled.
• Shipping carriers — receive the delivery address and recipient name needed to get the parcel to you.
• Our email automation provider — receives the details needed to send order, account, contact, and newsletter email (including your email address and the relevant order or message).
• Advertising partners, such as Google and Meta — receive information about your use of the site to measure and target our ads, unless you opt out. See Section 6.
• Referral partners — receive only totals of the orders they referred, never your personal information.

Stripe, Supabase, Vercel, Google, Cloudflare, our email automation provider, and our shipping carriers use the information to provide their services to us. Stripe also uses it for its own purposes, such as preventing fraud, managing security risks, and improving its services, as described in its privacy policy at stripe.com/privacy. Google and our other advertising partners use advertising information as described in Section 6. We send our printing partner the artwork needed to produce your order, without separate purchaser contact information or order history. We may also disclose information where the law requires it, to respond to lawful requests, to enforce our Terms, or to protect the rights, safety, or property of Cardbop, our customers, or others.

Business transfers. If BabelOn Incorporated is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will require the recipient to honor this policy, and we will notify you of any material change.

We advertise Cardbop on other websites and apps. To do that, we use cookies, pixels, and similar tags from advertising partners such as Google and Meta, and we link Google Analytics to Google Ads. These tools send our advertising partners information such as your IP address, cookie and device identifiers, browser type, the pages you view, and actions you take on the site, such as starting checkout or completing a purchase. Our partners use it to measure our ads and to show our ads to people who have visited Cardbop or may be interested in it, and they may combine it with other information they hold and use it under their own policies.

Under California law this may be “sharing” personal information for cross-context behavioral advertising, and other state laws may treat it as “targeted advertising” or a “sale.” The categories involved are identifiers and internet and device activity. We do not otherwise sell personal information, and we do not sell or share the personal information of anyone we know to be under 16.

We do not place advertising pixels or ad-network tags on card pages, share pages, or pack pages, and Google Analytics advertising features do not run there, and we never use photographs, card content, or anything added to a card page for advertising. We do not load advertising pixels or ad-network tags for visitors in the European Economic Area, the United Kingdom, or Switzerland.

You can opt out at any time using the “Do Not Sell or Share My Personal Information” link at the bottom of every page, or by emailing contact@cardbop.com. If your browser sends a Global Privacy Control signal or a Do Not Track header, we treat it as a request to opt out for that browser. Opting out stops our advertising partners from receiving this information from that browser for advertising. It does not stop the measurement described in Analytics and cookies, and you may still see ads for Cardbop that are not based on your activity.

We measure usage in two separate ways, and they behave differently. This distinction matters, so we spell it out rather than calling it all “analytics.”

1. Google Analytics 4 (third party, uses cookies). This tells us which pages people find and which ones lead to someone making a card. It sets cookies and processes information such as your IP address, device, and the pages you view, and Google may use that data under its own policies. For signed-in users, we also send Google Analytics our account identifier as a User-ID to associate activity with that account; we do not send an email address as the User-ID. We also use Google signals and link Google Analytics to Google Ads, so this information is used for advertising unless you opt out, as described in Advertising and your right to opt out. We do not load Google Analytics for visitors in the European Economic Area, the United Kingdom, or Switzerland. No Google Analytics cookies are set for those visitors, which is why you will not see a cookie banner there.

2. Our own product analytics (first party, no cookies). When you use the card builder, we record a few events on our own servers — photos uploaded, draft saved, preview reached, pack published — together with counts like how many cards are in the order, and your account ID if you are signed in. This is how we find out where people get stuck. It sets no cookies and involves no third party.

To be clear about the difference: the EEA, UK, and Switzerland exclusion described above applies to Google Analytics. Our own first-party product analytics run for everyone, including visitors in those regions. We rely on legitimate interests for it, we do not use it to build advertising profiles or track you across other websites, and you can object at any time using the contact details below.

Strictly necessary cookies. A small number of cookies make the site work: keeping you signed in, remembering your cart and card drafts, and recording whether analytics should load. These are not used to track you across other websites. Drafts and photos in progress are also stored in your browser’s local storage on your own device.

You can block cookies in your browser, and you can opt out of Google Analytics with Google’s browser opt-out add-on. Blocking cookies may stop drafts and sign-in from working.

Order and account email — confirmations, shipping updates, and replies to your questions — is transactional. We send it because you bought something or contacted us, and you cannot unsubscribe from it while an order is in progress.

Newsletter email is sent only if you asked for it. You can stop it at any time. To unsubscribe, reply to any marketing email asking to be removed, or email contact@cardbop.com with “Unsubscribe” in the subject. Every marketing email we send tells you how to opt out and includes our postal address.

We act on opt-out requests within ten business days at the latest, and usually much sooner. We keep a suppression record showing that you unsubscribed — that record exists only so we do not add you back by mistake, and it is never used to email you.

Photos you upload are stored so your card can be rendered, printed, and re-opened later. The “isolate the subject” background-removal tool runs entirely on your own device — that photo is not uploaded anywhere for processing, and the model files come from our own servers rather than a third-party CDN.

You must own or have permission to use every photo you upload — including permission from anyone shown in it, and from a parent or guardian when that person is a child. Before you can check out, you confirm this with a checkbox, and we record that confirmation with your order. The full obligation is set out in Section 6 of the Terms of Service. We do not verify ownership of imagery and rely on your confirmation.

Your photos are shared with our printing partner so your card can be produced — the artwork only, without separate purchaser contact information or order history attached. We do not sell them or use them to train AI models.

We also keep a nightly backup copy of the photographs you upload, described in How long we keep it. When you delete a photograph or ask us to close your account, a backup copy may remain temporarily under the retention and deletion process in Section 12, except for anything the law requires us to preserve longer.

If you believe someone has uploaded a photo of you, or of your child, without permission, contact us at contact@cardbop.com and we’ll remove it. Copyright owners can send a notice under the process in Section 19 of the Terms.

Because our product involves photographs of people, we want to be unambiguous about this.

We do not perform facial recognition, and we do not collect, capture, store, or use biometric identifiers or biometric information — no faceprints, no face geometry, no fingerprints, no voice prints. We do not use photographs to identify anyone, to match a person across images, or to infer demographic characteristics.

The background-removal tool uses a general image-segmentation model that separates a foreground subject from its background. It does not detect or recognize faces and does not create a biometric template. It runs entirely in your own browser, on your own device: the photograph is not uploaded for processing, the model files are served from our own servers, and no photograph is sent to us or any third party for that background-removal processing. Photos you upload to save or produce a card are handled as described in Your photos. We therefore never collect, capture, receive through trade, possess, store, or profit from a biometric identifier or biometric information, and we have no biometric data to disclose, sell, lease, trade, or destroy.

When you share a card or a pack, we create a link containing a long random token. Anyone who has that link can view the card. There is no password, and we do not check who is opening it. The link itself is the only thing standing between the card and anyone who receives it.

The token is long enough that it cannot practically be guessed. What it cannot do is stop a link from being forwarded, posted, or screenshotted once you have sent it. Anyone you send it to can pass it on. Share and pack pages, and card pages, ask search engines not to index them; this does not prevent access by anyone with the link.

If the card shows a child, that matters. Sending the link publishes that child’s photograph and name to everyone who receives it or is forwarded it. Share deliberately, and prefer sending the link to named individuals over posting it in a group chat, a team app, or anywhere public.

Card pages. Every printed card carries a QR code that opens a page for that card, and the card’s owner can add a headline, a story, more photographs, and links to it. Nothing added is visible to anyone else until the owner publishes it. Once published, anyone who scans the card or has the link can see it, and because a card can be given away, traded, or sold, that can include people the owner never sent it to. Card pages also show the name of the person who made the card, and anyone who can view the page can see it. Photographs added to a card page are stored privately and appear only on that page, except that if the card is part of a group pack, the photographs and links added to it also appear in a gallery on the pack’s page.

Link expiry. Order and pack links may expire. The card-page link printed as a QR code on a physical card does not expire automatically, so the printed code can continue to work, but you can make that page private or delete it, or ask us to disable that link.

The controls you have. You can ask us to disable any link at contact@cardbop.com and we will do it. If you published a group pack, you can remove a card from it or take the whole pack down. Any person shown on a card or card page, and the parent or guardian of any child shown on a card or card page, can ask us to remove the image or other content, or disable the link, and we will.

We keep personal information only as long as we actually need it. We may delete any of it sooner than described below.

• Order records — kept for up to seven years for tax and accounting purposes.
• Card designs and photos — kept while your account or draft is active, so you can reorder or reprint, and deleted when you delete the design or ask us to close your account, subject to the backup and legal retention described below. Paid orders are different. When you close your account, we keep them, including their card artwork, with the link to your account removed, so that printed cards keep working, and we delete anything added to your card pages. Deleting a card page deletes our copy of its artwork and everything added to it, immediately or, if the card is still being printed, when it ships. This includes anything in a photograph that a privacy law treats as sensitive.
• Rights confirmations — kept with the order for as long as the order record, since their purpose is to evidence what you agreed to if a claim is made later.
• Account details — kept until you ask us to close the account.
• Contact messages — kept while we handle your question and for a reasonable period afterwards for support history.
• Newsletter records — kept until you unsubscribe, plus a suppression record afterwards so we do not re-add you.
• Product analytics events — individual events, which carry your account ID if you were signed in, are kept for 14 months and are then deleted or aggregated for trend analysis; Google Analytics keeps event data for 14 months and user data for 14 months after that user’s most recent activity, and its aggregated reports are not subject to those limits.
• Rate-limiting data — held in memory for minutes, never written to our database.

Backups. We keep a nightly backup copy of customer-uploaded photographs, including photographs added to card pages, in a Google Drive folder in an account that we control, along with a nightly copy of our card and order records, which include customers’ names, email addresses, phone numbers, and shipping addresses. It exists so that we can restore your information if our primary storage fails. We may keep backup copies of photographs for as long as the originals remain in our primary storage, and we keep each copy of our card and order records for no more than 30 days. When we delete files from our primary storage because you deleted them or closed your account, we remove them from the backup within 30 days. Before restoring a backup to active use, we exclude files and records already deleted or subject to a deletion request.

What deletion reaches. If you delete a design, or ask us to close your account or delete your photographs, we remove the photographs from our primary storage, and from the backup as described above. When we delete artwork we sent to our printing partner, we also ask them to delete their copy, but we cannot control whether or when they do, or confirm that they have. Apart from those temporary backup copies and the paid orders described above, we keep only the order records we are required to retain, a suppression record if you unsubscribed from our email, and anything the law requires us to preserve, including material subject to a legal hold or a preservation obligation, for as long as that obligation lasts. We handle deletion requests within the periods required by applicable law.

Wherever you live, you can ask us to:

• Access the personal information we hold about you, or get a portable copy;
• Correct anything inaccurate;
• Delete your information, subject to records we must keep;
• Object to or restrict certain processing, including our first-party product analytics;
• Withdraw consent you previously gave, such as for newsletter email;
• Disable a share link or remove a specific photo or card, or anything on a card page.

To make a request, email contact@cardbop.com or use the contact page. We will respond within the time your law allows — 45 days under California law, extendable once where permitted. We may need to verify your identity first, usually by confirming control of the email address on the account, and we will not charge you or treat you differently for exercising these rights.

Authorized agents. You may use an authorized agent to make a request. We will ask for proof of their authority and may still ask you to verify your own identity directly.

California. Under the CCPA as amended by the CPRA, you have the rights to know, access, delete, correct, and obtain a portable copy of your personal information; to opt out of sale or sharing (see Advertising and your right to opt out); to limit the use of sensitive personal information (we do not use it in ways that trigger this); and not to be discriminated against for exercising any of them. The categories we collect and our purposes are in Categories, sources, and purposes. California’s “Shine the Light” law also lets you request details of any disclosure to third parties for their direct marketing — we make none.

Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws give you broadly similar rights to access, correct, delete, and obtain a copy of your information, and to opt out of targeted advertising, sale, and profiling with significant effects. We do not profile you in ways that produce significant effects. To opt out of targeted advertising or sale, see Advertising and your right to opt out. If we deny your request, you may appeal by replying to our decision or emailing contact@cardbop.com with the subject “Privacy Appeal.” We will respond within 45 days with our decision and the reasons for it, and will tell you how to contact your state attorney general if you remain dissatisfied.

Washington. The My Health My Data Act concerns consumer health data. We do not collect, use, share, or sell consumer health data, and we do not operate a geofence around any health facility.

Illinois. The Biometric Information Privacy Act regulates the collection and possession of biometric identifiers such as scans of face geometry. We do not collect, capture, receive, possess, or profit from biometric identifiers or biometric information, and our background-removal tool does not create any. See Face and biometric data.

Nevada. We do not sell covered information as defined by Nevada law.

Our service is for adults. Cardbop is intended for and directed to adults. You must be at least 18 to hold an account, use the card builder, or place an order. We do not knowingly allow anyone under 18 to create an account, use the card builder, or place an order, we do not direct any part of the site to children, and we do not advertise to children. We do hold photographs and details of children, because adults put them on cards; that is described immediately below. If you believe someone under 18 has created an account or given us their own information directly, contact us at contact@cardbop.com and we will delete it under the process in Section 12, except for anything the law requires us to preserve.

Cards of children are different, and very common. A parent making a card of their kid, or a coach making a team pack, means we end up holding photographs and details of children — supplied to us by an adult. Youth sports is one of our largest categories and this is an expected use of the product.

What the adult is confirming. When you upload a photograph of a child, you confirm that you are that child’s parent or legal guardian, or that you have that parent or guardian’s permission to use the child’s photograph, name, and likeness on printed cards and, if you share a card or publish a group pack, to display them online through the share link or group pack as described in Section 6 of the Terms of Service. If you publish a group pack, you confirm the same thing for every child in it. If you publish a card page, you confirm the same thing each time you publish it or an update to it. We record that confirmation with your order. We do not verify it, we have no way to know who is in a photograph, and we rely on it. The full obligation is in Section 6 of the Terms of Service.

What we do and do not do with a child’s information. We use it to make and deliver the card, store your designs and backups, and display cards or group packs when you choose to share them, and card pages when you publish them, as described in this policy. We do not build profiles of children, we do not use their images or details for marketing, we do not sell them or share them for cross-context behavioral advertising, we do not use them to train machine-learning models, and we do not perform facial recognition on them or anyone else.

If you are a parent or guardian. You can contact us at contact@cardbop.com at any time to ask what we hold about your child, to have it deleted, to have a share link or group pack disabled, or to have a card or anything on a card page removed. You do not need to explain why you want a photograph removed, produce documentation for removal, or contact the person who uploaded it. Before disclosing information about a child, we may take reasonable steps to verify your identity and authority as the child’s parent or guardian. We will delete the photograph from our primary storage, with any backup copy removed as described in Section 12, except for anything the law requires us to preserve, and we will cancel and refund any order containing it that we can still stop before production, as described in the Terms of Service. We respond within the periods described in Your choices and rights.

We use reputable providers, encrypted connections (HTTPS), access controls, row-level security on our database, and bot and rate-limiting protection on our forms. Payment card data never touches our servers.

No method of storage or transmission is completely secure, so we cannot guarantee absolute security. You help by using a strong, unique password and keeping it to yourself. If we become aware of a breach affecting your personal information, we will notify you and the relevant regulators as required by law.

We are based in the United States, and most of your information is processed here, including by the service providers listed above. United States law may not offer the same protections as the law where you live.

Your card artwork is produced outside the United States. The artwork needed to make your cards — the photograph you uploaded and the text you put on the card — is sent to our printing partner and stored outside the United States for production, including in China. The artwork may contain photographs and names, but we do not send separate purchaser contact information or order history with it. Our printing partner receives the images and the words on the card. The laws where artwork is processed may not offer the same protections as United States law or the law where you live.

We ship only to United States addresses, so we do not offer goods or services to people in the EEA or UK. If you visit from there and we do handle your information — because you browsed the site or created an account — we rely on the legal bases above, and where a transfer mechanism is required we use the appropriate safeguards our providers offer, such as Standard Contractual Clauses. You have the right to complain to your local supervisory authority.

If we make meaningful changes we will update the date at the top of this page and, where the change is material, give additional notice such as an email or an in-product notice before it takes effect. If a change would let us use information we already hold in a materially different way, we will ask for your consent first where the law requires it. Otherwise the updated policy applies from the date shown at the top of this page.

Questions about privacy, or want to exercise a right? Email contact@cardbop.com or use the contact page.

The company responsible for your information is:
BabelOn Incorporated d/b/a Cardbop
1037 NE 65th St #226
Seattle, WA 98115
contact@cardbop.com