Privacy Policy

1. What We Collect

When you create a greeting card, we collect: recipient name, optional sender name, optional relationship description, selected occasion and tone preferences, and the message text you choose or edit. We do not require you to create an account or provide your email address.

We also collect anonymous usage data (which buttons you click, which card options you select) to improve the service. This data is stored in our own database and is not shared with third-party analytics providers.

2. How We Use Your Data

• To generate personalized greeting card messages and images
• To process your payment via Stripe
• To display the card to the recipient via a unique URL
• To improve our service through anonymous analytics

3. Payment Information

Payments are processed by Stripe. We never see, store, or have access to your full credit card number. Stripe's privacy policy applies to payment data. See stripe.com/privacy.

4. Data Retention

Card data (names, messages, images) is retained indefinitely to keep card URLs active. Anonymous analytics data is retained for up to 2 years. You may request deletion of your card data at any time (see Section 7).

5. Third-Party Services

• Stripe — payment processing
• Google Cloud (Vertex AI) — image generation
• Anthropic — message generation
• Cloudflare — image storage and delivery
• Vercel — application hosting

We do not sell your data to any third party. Data shared with these providers is limited to what is necessary to deliver the service.

6. Cookies

We use only essential cookies — no advertising cookies, no third-party tracking cookies, and no cross-site tracking of any kind. The cookies we set are:

• Admin session cookie — set only for authenticated operators on the /admin routes. Not set for regular visitors.
• Bot-gate cookie — a short-lived pass set after Cloudflare Turnstile verifies you are human on the card-creation flow. Used solely to avoid re-challenging you within the same browser session.
• Cloudflare Turnstile challenge cookie — set by Cloudflare's Turnstile widget during the bot-check. Governed by Cloudflare's privacy policy.

Analytics: We collect first-party usage events (which buttons you click, which card options you select) using an ephemeral in-memory analytics ID. This ID is not persisted in a cookie or in local storage, does not follow you across visits, and is not shared with any third-party analytics provider. No persistent tracking cookie is set for analytics purposes.

Because we set only essential or functional cookies, no blocking consent banner is required. If we ever introduce non-essential cookies (such as an advertising pixel or third-party analytics), we will update this section and provide an appropriate consent mechanism before doing so.

7. Your Rights

Under GDPR, CCPA, and similar regulations, you have the right to:

• Request access to your personal data
• Request deletion of your card and associated data
• Object to processing of your data

To exercise these rights, email privacy@frombodega.com with your card URL or token and we will process your request within 30 days.

8. Children's Privacy

This service is not directed to children under 13. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date.