Privacy Policy

2.1 Our commitment

Only Cards respects the privacy of senders, recipients, and visitors.

This Privacy Policy explains how personal information is collected, used, stored, shared, and protected when people use our website, applications, and related services.

Data controller / business operator: [LEGAL NAME] Privacy contact: Info@onlycardss.com Address: [ADDRESS]

2.2 Information collected

Depending on the service used, we may collect:

• Names and contact information.
• Account and authentication information.
• Recipient names, phone numbers, and email addresses.
• Card messages, photographs, and voice recordings.
• Card preferences and personalization details.
• Purchase records and transaction references.
• Customer support communications.
• Device information, IP addresses, browser information, and security logs.
• Cookies, analytics identifiers, and marketing preferences where applicable.
• Records of consent where required.

We seek to collect only information reasonably necessary for legitimate, disclosed purposes.

2.3 How information is collected

Information may be collected directly from users, from senders creating cards for recipients, through use of our services, or from providers supporting payment, security, analytics, or delivery.

Recipients may receive cards even if they have never registered with Only Cards.

2.4 Purposes of processing

We use information to:

• Create and deliver digital greeting cards.
• Allow recipients to access their cards.
• Maintain accounts and saved cards.
• Process transactions where payments are available.
• Provide support and resolve disputes.
• Detect fraud and prevent abuse.
• Secure and maintain our systems.
• Improve functionality and performance.
• Meet legal, accounting, and regulatory requirements.
• Send optional marketing where lawful and appropriately authorized.

We do not sell private card messages, photographs, or voice recordings to advertisers.

2.5 Legal bases for UK and EU processing

Where UK GDPR or EU GDPR applies, personal information is processed under an appropriate legal basis, which may include:

Contract: Processing necessary to provide a service requested by a customer.

Legitimate interests: Proportionate activities such as preventing fraud, securing the platform, and handling appropriate service inquiries, subject to applicable balancing requirements.

Legal obligation: Processing necessary for tax, accounting, regulatory, or other legal requirements.

Consent: Processing that requires consent, such as certain marketing or non-essential tracking technologies.

The precise lawful basis depends on the processing activity and the circumstances.

Where we rely on consent, it may be withdrawn as permitted by law.

2.6 Recipient information

Senders may provide recipient contact details so we can deliver a requested card.

We use those details for the delivery and administration of the card, security, and related support.

Receiving a card does not automatically subscribe a recipient to marketing.

Recipients can contact us regarding their personal information and applicable privacy rights.

2.7 Private card content

Messages, photographs, and voice recordings are processed to provide the requested card experience.

Private content is not used for public advertising without separate permission.

Access may be available to the sender, intended recipient, and authorized personnel or providers where necessary for legitimate operational purposes.

Users should avoid including unnecessary sensitive information.

2.8 Payment information

Where payments are available, independent payment processors may handle payment-card details.

We may receive limited transaction information, such as order references, payment status, amounts, and billing details necessary for accounting and customer support.

Relevant payment providers may act as separate controllers or processors depending on their role.

2.9 Sharing with service providers

We may share necessary information with providers supporting:

• Website and application hosting.
• Cloud storage and databases.
• SMS and email delivery.
• Payment processing.
• Customer support.
• Security and fraud prevention.
• Analytics and performance monitoring.

Providers should receive only the information reasonably necessary for their services and must be subject to appropriate safeguards where required.

We may also disclose information when legally required or to protect legitimate rights and safety.

2.10 International transfers

Only Cards may serve customers in Australia, Ireland, the United Kingdom, and other countries.

Information may be stored or processed in jurisdictions outside the user’s country.

Where international transfer restrictions apply, we will use legally appropriate safeguards.

Current hosting and processing countries: [LIST ACTUAL COUNTRIES] Relevant transfer safeguards: [INSERT VERIFIED DETAILS]

2.11 Data retention

We retain information for periods appropriate to its purpose and applicable legal obligations.

Account records: [PERIOD OR CRITERIA] Sent and received card content: [PERIOD OR CRITERIA] Recipient contact details: [PERIOD OR CRITERIA] Transaction records: [PERIOD OR CRITERIA] Security logs: [PERIOD OR CRITERIA] Support communications: [PERIOD OR CRITERIA]

Where legally permitted, users may request deletion of eligible information.

Some records may need to be retained for legal, security, or accounting purposes.

2.12 Information security

We use reasonable technical and organizational measures designed to protect personal information.

These may include access restrictions, authentication, secure connections, monitoring, and other appropriate safeguards.

No internet-based system can guarantee absolute security.

Users should protect account credentials and avoid sharing private card links publicly.

2.13 Privacy rights

Depending on location and applicable law, individuals may have rights to:

• Access personal information.
• Correct inaccurate information.
• Request deletion.
• Restrict or object to certain processing.
• Withdraw consent.
• Request data portability.
• Complain to a relevant privacy regulator.

Requests can be sent to Info@onlycardss.com.

We may need to verify identity before acting on certain requests.

We will respond within applicable legal timeframes.

2.14 Children and family photographs

Only Cards is not intended for unsupervised account creation or purchases by children.

Cards may be addressed to children, and users may upload family photographs.

Senders should have appropriate permission to upload and share photographs or personal information relating to children.

We do not knowingly use children’s private card content for behavioral advertising.

2.15 Marketing

Marketing communications will be sent only where permitted by applicable law.

Where consent is required, it will be obtained before marketing is sent.

Recipients will have appropriate methods to unsubscribe or withdraw consent.

Receiving a greeting card does not by itself constitute consent to receive marketing.

2.16 Cookies

We may use cookies or similar technologies for essential website operation, security, preferences, analytics, and marketing where enabled.

Non-essential tracking will be subject to appropriate consent controls where required.

Further information appears in our Cookie Policy.

2.17 Automated processing

[DISCLOSE ANY AUTOMATED DECISION-MAKING OR PROFILING THAT REQUIRES NOTICE, INCLUDING SIGNIFICANT DECISIONS, IF APPLICABLE.]

2.18 Privacy complaints

Contact Info@onlycardss.com if you believe your information has been handled improperly.

We will investigate and respond in accordance with applicable requirements.

Where available, you may also complain to the Office of the Australian Information Commissioner, Ireland’s Data Protection Commission, the UK Information Commissioner’s Office, or another competent regulator.

2.19 Changes

This policy may be updated to reflect changes in law, technology, or our operations.

The latest version will be published on our website.