Privacy policy

Who we are

YourNotebook, a trading name of THECARDGENIE.COM LTD, a company registered in England and Wales (company number 17299111) is in charge of your data (the "controller", if you like a fancy word). Questions? Email hello@yournotebook.co.uk.

What we collect, and why

• Your order: name, delivery address, email and what you bought, so we can make it and post it. Card details go straight to our payment provider and never touch our systems.
• Your design: the words you want engraved, any photograph you upload, any place you search for on a map design, and the design itself once it is in your basket, so we engrave exactly what you approved.
• Your IP address: our studio tools cost us real money per go, so we rate-limit them by IP address, which we only ever use as a counter.
• Error reports: if a page breaks, our error-monitoring service tells us what broke, which page, your browser type and your IP address. One page view in ten also sends a load timing.
• Emails you send us, and our replies.
• Measurement, only if you agree to it: we count visits with Google Analytics, but only once you say yes. If you have said yes and you place an order, we tell it the order number, which design, how many and what you paid, so we can see which adverts lead to sales. It never sees your name, email, address, words or photo, and it is never put on your basket or on the page your order link opens. Change your mind any time in Cookie preferences.

Your order link. There are no accounts on this site, so order emails carry a link that opens your order without a password. That means anyone who has the link can see it: your order, your words, your name and delivery address, the delivery service, any tracking number and what you paid. Treat it like the email it came in. If we are drawing your cover, you approve it there, and we record which drawing it was and the moment you approved it (engraving is forever, so we like a receipt).

Your photo, your words and the AI

• We strip your photo's camera data (location included), then send it to an image-editing service, where an image-editing model turns it into line art. Your photograph is stored on that service's systems until it is deleted (see below).
• Nothing looks for faces, and nothing we do is aimed at identifying a person, so your photo is not treated as biometric data.
• Your words go to an AI agent for drafting, only if you ask for suggestions. That never involves your photograph. Nothing else reads your words with AI: a short list of phrases is swapped for our mark by plain software on our own server (see the content policy).
• Rather skip the AI? Every text-only design works without a photo.

Why we are allowed to

• Making your artwork, drafting your words, and making and delivering your order: because you asked us to, to fulfil our contract with you.
• Swapping a listed phrase for our mark before engraving: our legitimate interests in not engraving anything unlawful or abusive.
• Rate-limiting: our legitimate interests in keeping the site up and the bills sane.
• Keeping order records: because the law says we must keep them for tax.
• Answering your emails: because you asked, or our legitimate interests in being a shop people can talk to.
• Measurement: your consent, which you can withdraw any time.

Sharing your data

Some of the services that run this site are based outside the United Kingdom, so using the site means a transfer of your data abroad. We rely on each supplier's published data-protection terms, accepted when we signed up: either the UK says their country protects data properly, or their terms include the UK's approved transfer clauses. We have not negotiated bespoke agreements with any of them. If you want to know which applies to one of them, ask us and we will find out and tell you.

We never sell your data. The one advertising tag here is Google Ads: it tells Google that an advert you clicked ended in an order, with the order number and nothing else, and it is not used to aim adverts at you. Its cookies, and the order number, go only if you say yes to advertising. Without that yes, the Ads tag still sends a bare signal that a page was seen or an order placed, with no cookie, no order number, no identifier and no advert click id, so Google can estimate how many orders adverts lead to. The cookie policy names what is set and when.

We only hand data to anyone else if the law requires it (a court order, or a lawful request from the police), if someone tries to engrave a credible threat (see our content policy), or if someone says a photo you sent is theirs, in which case we may have to tell them who sent it and we will tell you. We will not hand anything over on an informal request.

How long we keep things

• Your photo: deleted after 30 days, including ones our checks rejected. The expiry is set at upload and enforced by the image-editing service, so it cannot quietly fail. 30 days lets us compare it with your engraving if you query it.
• Drafts you never add to your basket: not kept.
• Designs you never order: deleted after 30 days, when your basket expires.
• Orders (with the engraved artwork, so we can remake a lost one): six years after the end of that tax year, because tax law says so.
• Your order link: stops working 90 days after you order. Sent it to the wrong person? Email us and we will switch that one link off. We keep a note that it was issued, with the order.
• IP address counters: gone within the hour.
• Google Analytics, if you said yes: the _ga cookie lasts up to two years from your last visit; Google keeps what it measured for the period set on our account.
• Where you came from, if you said yes to measuring: the site, advert or newsletter tag that brought you, kept in our own cookie for 90 days and, if you order, with the order. It never leaves us.
• Emails: as long as they are useful for support.

Want something removed sooner? Just email us.

Your rights

You can ask us to give you a copy of the data we hold, correct it if it is wrong, delete it (unless we need it for an order or tax), restrict or object to how we use it, or give you a portable copy of what you gave us. Email hello@yournotebook.co.uk and we will reply within one month, free of charge.

Not happy? You can complain to the Information Commissioner's Office at ico.org.uk, though we would love the chance to put it right first.

The small stuff

• Children: this shop is not aimed at them. Putting a child's name or photo on a notebook? Lovely, just make sure it is yours to use. If a child has sent us their own data, tell us and we will delete it.
• Security: HTTPS everywhere, strict security headers, and uploads re-encoded before they go anywhere. If something goes wrong that affects you, we will tell you promptly.
• Changes: if anything here changes, so does the date at the top.