Privacy Policy

Information you provide

• Account data: your email address (via Google Firebase sign-in) and authentication status.
• Photos you upload: the images you submit to generate a card. These may include photographs of you and of other identifiable people (for example, family, partners, or children). Please only upload photos you have the right to use and the consent to use (see our Terms).
• Card creations: the artwork and card details you generate and save to your cardbook.
• Order & shipping data: recipient name, shipping address, and phone number you enter at checkout.
• Payment data: processed by Stripe. We receive limited transaction details (amount, status, last digits) but do not store your full card number.
• Communications: messages you send us for support.

Information collected automatically

• Usage & device data: IP address, browser/device type, pages viewed, and general activity, used to operate and secure the Service.
• Cookies & local storage: we use browser local storage for essential functions such as your language preference and session. We do not use third-party advertising trackers.

• To generate your card artwork from the photos you upload;
• To create and maintain your account, wallet, and cardbook;
• To process payments and manufacture, ship, and track your orders;
• To provide customer support and send service-related messages;
• To secure the Service, prevent fraud and abuse, and enforce our Terms;
• To analyze and improve the Service; and
• To comply with legal obligations.

To create your card, the photo you upload is sent to our AI provider, Google’s Gemini API, which transforms it into card artwork. Your photo may show faces and other personal characteristics; we send only what is needed to generate your card.

We use the Gemini API as a paid (billed) service. Under Google’s paid-service terms, Google does not use your prompts, uploaded files, images, or generated output to train or improve Google’s products. Google may temporarily log this data for safety, abuse monitoring, security, and legal or regulatory purposes. We do not use your photos to train our own models. Google’s processing is subject to Google’s applicable terms.

We do not sell your personal information. We share it only with the service providers needed to run Card Phantom:

• Amazon Web Services (AWS) — cloud hosting and storage (servers located in the United States).
• Google Firebase / Google AI — account sign-in and AI image generation.
• Stripe — payment processing.
• Our printing partner — to manufacture your card, we transfer the card artwork, the foil/mask layer, and production details (such as holo style and quantity). We deliberately do not share your name or shipping address with the printer; they ship to a consolidation warehouse, not directly to you.
• Shipping and logistics carriers — to calculate shipping and deliver your order to the address you provide.
• Authorities — when required by law or to protect rights and safety.
• Successors — in connection with a merger, acquisition, or sale of assets.

Card Phantom is based in Canada. Your information may be processed in countries other than your own — including the United States (cloud hosting with AWS and AI processing with Google) and other countries where our manufacturing and logistics partners operate, to which your card artwork is transferred so your physical card can be produced and shipped. By using the Service, you understand and consent to these cross-border transfers, and we take steps to ensure your information is handled consistently with this Policy wherever it is processed.

Photos you upload to generate a card are automatically deleted from our storage within approximately 24 hours of upload. We retain the original uploaded photo only as long as needed to generate your card; we do not keep a long-term copy of it.

The card artwork generated from your photo is separate: it is kept in your cardbook until you delete it or your account is removed (your cardbook keeps your most recent creations), and a copy is used to manufacture any card you order. We keep your account, wallet, and order records for as long as your account is active and as needed to provide the Service and meet legal, tax, and accounting requirements. Print-ready production files are retained only as long as needed to fulfill the order and are then deleted.

Deleting a saved creation removes it from your account, but copies may remain temporarily in backups, logs, or production systems until they are cleared according to our retention schedule. Order records may be retained for legal, tax, accounting, fraud-prevention, and customer-support purposes even after you delete your account.

Depending on where you live (including under Canada’s PIPEDA and, for EU/UK users, the GDPR), you may have the right to access, correct, delete, or port your personal information, and to object to or restrict certain processing. To exercise these rights, or to delete your account, contact us at support@cardphantom.com. You can manage cookies through your browser settings.

Marketing emails. We send promotional emails only if you have opted in, and you can unsubscribe at any time using the link in the email or by contacting us. We send service and order-related messages (such as receipts and shipping updates) as part of providing the Service.

You must be at least 18 to use the Service. The Service is not directed to children or teenagers, and we do not knowingly collect personal information from anyone under 18. Photos that depict a minor may only be uploaded by that minor’s parent or legal guardian, or with the guardian’s explicit consent (see our Terms). If you believe someone under 18 has provided us personal information, contact us and we will delete it.

We use technical and organizational measures — including encrypted connections, access controls, and authentication — to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

We may update this Policy from time to time; material changes will be posted here with a new “Last updated” date. For any privacy questions or requests, contact us at support@cardphantom.com.