Privacy policy

1. Who is responsible for your data

YourNotebook, a trading name of THECARDGENIE.COM LTD, a company registered in England and Wales (company number 17299111) is the data controller for the information described here. Contact us at hello@thecardgenie.com, or at the postal address at the foot of this document.

2. What we collect

If you only look around the site. Nothing that identifies you. This site sets no cookies, runs no analytics and carries no advertising or tracking scripts. There is no consent banner because there is nothing to consent to.

Your IP address, when you use the personalisation studio. The studio's image, preview and copy-drafting features cost real money per request, so each one is rate-limited per IP address. The address is used as a counter key and nothing else - not to profile you, not to guess where you are.

What you type. The words you want engraved, and — if you use the drafting help - the few facts you write about the person the notebook is for.

What you upload. A photograph, if you have chosen a design that takes one.

Your order. When ordering opens: your name, delivery address, email address and what you bought. Card details are handled by our payment provider and never reach us.

Emails you send us, and our replies.

3. Your photograph, and the AI that processes it

This is the part most worth reading, because your photograph does not stay with us.

When you upload a photograph, we first re-encode it on our own server. That step rotates it upright, reduces its size, and drops the metadata your camera attached - including any location tag. The image that travels onward is a plain JPEG with no camera data in it.

We then send that image to fal.ai, an AI infrastructure provider, where two things happen:

• A detection model checks that the photograph contains a usable face - how many, and whether they are large enough to engrave. It answers with counts and box positions. It does not recognise anyone, and we never ask it to. Because nothing here is used to identify a person, we do not treat your photograph as biometric data.
• An image-editing model converts the photograph into the line art that the laser cuts. That artwork, not your photograph, is what ends up on the cover.

Two consequences we would rather you knew before you upload than afterwards:

1. Your photograph is stored on fal.ai's systems, because both models are given a URL to fetch rather than the bytes themselves.
2. fal.ai is based outside the United Kingdom, so this involves a transfer of your personal data abroad. See section 6.

If you would rather not have a photograph processed this way, every text-only design on this site works without one.

4. Your words, and the AI that reads them

Two separate things happen to text, both at Anthropic, and neither involves your photograph:

• Drafting. If you ask the site to suggest wording, the few facts you write about the person are sent to a Claude model, which returns a first draft into the editor. You then edit it. Nothing is engraved that you have not approved.
• Screening. Text is checked by a Claude model before it can be engraved. We block hate speech, credible threats, sexual content involving children, explicit sexual content and material promoting terrorism, and we allow ordinary affection, in-jokes, mild rudeness and swearing. An engraved cover cannot be undone, which is why we check rather than hope.

A refusal is a refusal to engrave, not a decision about you, and it has no legal effect on you. If you think a refusal is wrong, email us and a person will look at it.

Anthropic is based outside the United Kingdom. See section 6.

5. Why we are allowed to do this

• Turning your photograph into artwork, and drafting your words - steps taken at your request before a contract, and then performance of that contract (UK GDPR Art 6(1)(b)).
• Making, packing and delivering your order - performance of your contract (Art 6(1)(b)).
• Screening text before engraving - our legitimate interests in not cutting unlawful or abusive content into a product we make (Art 6(1)(f)).
• Rate-limiting by IP address - our legitimate interests in keeping the site available and not having its running costs driven up by automated abuse (Art 6(1)(f)).
• Keeping order records - a legal obligation, for tax and accounting (Art 6(1)(c)).
• Answering your emails - steps at your request, or our legitimate interests in running a shop people can talk to.

6. Who else handles your data, and where

Every one of these is based outside the United Kingdom:

• fal.ai - your uploaded photograph, and the artwork made from it.
• Anthropic - the words you type, and the drafts returned to you.
• Our hosting provider - the running of the site, and its server logs.
• Our rate-limiting provider - your IP address, as a short-lived counter.
• Our payment provider, when ordering opens - your payment, your name and your delivery address.

Transfers outside the United Kingdom are made under the transfer terms in each supplier's data processing agreement, which incorporate the UK's approved safeguards. Confirming those agreements are signed and current for this business is on our pre-launch list, and we would rather tell you that than imply a paperwork position we have not verified.

We do not sell your data, and we do not share it for advertising.

7. How long we keep things

Your uploaded photograph: honestly, we do not yet delete it. Uploads sit on fal.ai's storage, including uploads that were rejected before any artwork was made, and today we have no automatic deletion. We consider that unacceptable and it is being fixed before ordering opens: a fixed retention window and a working deletion route. Until then, if you want an upload removed, email us and we will remove it - and you are entitled to ask, under section 8.

Your words exist in your browser as you type them, and are sent to the screening and drafting services as described above. We do not build a record of drafts you abandoned.

Your order — what you bought, where it went, what was engraved — is kept for six years after the end of the tax year it falls in, because tax law requires it. We keep the engraved artwork with it, so a lost or damaged order can be remade without asking you to type it all again.

Your IP address exists only as a rate-limit counter and expires with that counter, within the hour.

Emails are kept for as long as they are useful for support, and then deleted.

8. Your rights

You can ask us to:

• give you a copy of the data we hold about you;
• correct it if it is wrong;
• delete it, where we do not need it for an order or for tax records;
• restrict or object to how we use it, including anything we do on the basis of legitimate interests;
• give you a portable copy of what you gave us.

Email hello@thecardgenie.com and we will answer within one month. There is no charge.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you gave us the chance to put it right first.

9. Children

This shop is not aimed at children and we do not knowingly collect data from them. Adults do buy notebooks personalised with a child's name or photograph; if you do that, you are responsible for having the right to use it. If you believe a child has sent us their own data, tell us and we will delete it.

10. Security

The site is served over HTTPS only, with a strict content security policy and a set of security headers that stop it being framed or its content type guessed. Uploads are size-capped and re-encoded before they go anywhere. Payment card details never touch our systems. No system is perfect, and we will tell you promptly if something goes wrong that affects you.

11. Changes

If we change how any of this works - most likely when ordering opens, or when the retention fix in section 7 lands - we will change this document and update the date at the top.