Privacy Policy

Last updated: April 2026

1. What We Collect

When you create a greeting card, we collect: recipient name, optional sender name, optional relationship description, selected occasion and tone preferences, and the message text you choose or edit. We do not require you to create an account or provide your email address.

We also collect anonymous usage data (which buttons you click, which card options you select) to improve the service. This data is stored in our own database and is not shared with third-party analytics providers.

2. How We Use Your Data

  • To generate personalized greeting card messages and images
  • To process your payment via Stripe
  • To display the card to the recipient via a unique URL
  • To improve our service through anonymous analytics

3. Payment Information

Payments are processed by Stripe. We never see, store, or have access to your full credit card number. Stripe's privacy policy applies to payment data. See stripe.com/privacy.

4. Data Retention

Card data (names, messages, images) is retained indefinitely to keep card URLs active. Anonymous analytics data is retained for up to 2 years. You may request deletion of your card data at any time (see Section 7).

5. Third-Party Services

  • Stripe — payment processing
  • Google Cloud (Vertex AI) — image generation
  • Anthropic — message generation
  • Cloudflare — image storage and delivery
  • Vercel — application hosting

We do not sell your data to any third party. Data shared with these providers is limited to what is necessary to deliver the service.

6. Cookies

We use a minimal session identifier stored in your browser to track your card creation progress. We do not use advertising cookies or third-party tracking cookies.

7. Your Rights

Under GDPR, CCPA, and similar regulations, you have the right to:

  • Request access to your personal data
  • Request deletion of your card and associated data
  • Object to processing of your data

To exercise these rights, email privacy@bodega.app with your card URL or token and we will process your request within 30 days.

8. Children's Privacy

This service is not directed to children under 13. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date.