Privacy Policy

Information you provide

• Card details: the names, messages, dates and other text you add to a design, and the choices you make, such as music, timing and the closing card.
• Photos and uploads: the photos you add to a card, and any music or images you upload for it. Photos often show you and other people, such as family and friends.
• Purchases: when you buy a download, Stripe collects your payment details. We receive the email address you give Stripe, what you bought, the amount, the payment status and a transaction reference. We never see or store your card number.
• Messages: what you send through our contact and custom-design forms — your name, email address, message and any design or date you mention.
• Feedback: ratings and comments you leave on a card, and your choices when you compare two designs.

Information collected automatically

• A random identifier stored in your browser, which links you to the cards you make. CardRiot has no accounts, so this is how we know which cards are yours.
• Technical information such as your IP address, browser and device type, and the times you use the Services, which our hosting providers process to deliver and protect the Services. We keep the IP address and browser type sent with a contact message, to stop spam.
• When you make a card or compare designs, a one-way hash of your IP address, used only to limit automated use. It changes every day for cards and every hour for comparisons, and it is never stored with your card or your vote.
• Which version of a card you download, and when.

If you use CardRiot in ChatGPT

When you use CardRiot inside ChatGPT, OpenAI sends us the details and photos you choose to share for your card, an anonymised identifier for your ChatGPT account, and general information such as your language and approximate location. We use this only to make your card and to keep the Services secure. We don’t receive your ChatGPT conversation history. What we send back is shown to you in ChatGPT, where OpenAI’s privacy policy applies.

• We place your photos and words into the design you choose, to make your card.
• Some designs send a reduced copy of a photo to our AI provider, OpenAI, to find where the faces are so the photo can be framed well, or to describe features such as hairstyle so a drawn character can look like the person in it. A few designs restyle a photo with an AI image model.
• Some designs send the names and words you enter to an AI model, to write lines for the card.
• We don’t use photos to identify anyone, we don’t create face-recognition templates, and we don’t use your photos or card details to train AI models.

We use personal data to:

• Make your cards, show you previews, and let you edit, remake and download them.
• Process purchases and provide what you paid for.
• Reply to your messages and custom-design requests.
• Prevent spam, abuse and fraud, and keep the Services secure.
• Understand which designs people like, from feedback, comparisons and downloads, so we can improve them.
• Comply with legal obligations and establish, exercise or defend legal claims.

We do not sell your personal data or share it with third parties for their own marketing. We don’t use advertising or analytics trackers.

Where data-protection law requires a legal basis, we rely on:

• Contract: making and delivering the cards you ask for, and processing your purchases.
• Legitimate interests: securing, troubleshooting and improving the Services and preventing abuse, where those interests are not overridden by your rights.
• Consent: where the law requires it. You may withdraw consent at any time.
• Legal obligation: keeping payment records and responding to lawful requests.

We share only what is reasonably necessary with:

• Amazon Web Services, which hosts the Services and stores photos and videos in the United Kingdom.
• MongoDB, whose Atlas service hosts our database of card details and records.
• OpenAI, for the AI features described above, and when you use CardRiot inside ChatGPT.
• Stripe, which processes payments.
• Slack, where our team receives the messages you send through our forms.
• Professional advisers, authorities or other parties, where required by law, necessary to protect rights and safety, or connected with a merger, financing, reorganisation or sale of the business.

These providers may process data only to provide services to us, or as described in their own notices when you deal with them directly.

• Card details, photos and videos: kept so you can come back to your card and download it again, until you ask us to delete them.
• Messages you send us: kept while we deal with your request and afterwards as part of our support records, until you ask us to delete them.
• Purchase records: kept for as long as tax and accounting law requires.
• Technical logs: kept by our hosting providers for security and troubleshooting.

We act on deletion requests within 30 days, subject to reasonable backup cycles and information we must keep for legal, security, fraud-prevention or financial-record purposes.

We don’t use advertising or analytics cookies. Your browser’s local storage holds the random identifier that links you to your cards, and a count of the designs you’ve compared. If you clear it, that browser will no longer be linked to the cards you made before. Stripe sets its own cookies on its checkout page.

Our company is based in the Dubai International Financial Centre, and our servers are in the United Kingdom. Some of our providers process data in other countries, including the United States. Where required, we use recognised safeguards for international transfers, such as contractual protections, and assess providers’ security and privacy commitments.

We use reasonable technical and organisational measures designed to protect personal data, including encrypted connections, access controls, and private storage that can only be reached through links that expire after a few hours. No system or transmission method is completely secure, so we cannot guarantee absolute security.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal data, receive a portable copy, withdraw consent, or complain to a data-protection authority.

To make a request, email support@skuto.ai. As CardRiot has no accounts, include the link to your card or the email address you paid with, so we can find your data. We may need to verify your identity before completing a request. Some rights are subject to legal exceptions.

The Services are not directed to children under 13, and we don’t knowingly collect personal data from them. A person under 18 may use the Services only with the consent and supervision of a parent or legal guardian.

Many cards celebrate children. A parent or guardian, or someone with their permission, may add a child’s name and photo to a card. If you believe a child’s information was shared with us without that permission, contact us and we will delete it.

We may update this Policy as the Services or legal requirements change. We will post the revised version here and update the effective date. If a change is material, we may provide additional notice through the Services.

For questions or privacy requests, contact: