Privacy

This page explains what we collect when you use Gilded Frog, why, who helps us, and how long we keep it. The short version: we use your photos only to make your cards, we delete them and your addresses 30 days after your cards are posted (or 30 days after you start a card, if you don't buy it), and we never use your photos to train AI.

Jacob Haslam, trading as Gilded Frog, is responsible for your data (the “controller”). Our details are under Who we are, at the end of this page.

What we collect

• Your pet's photos, name and type. You send these so we can make your card. If a person appears in a photo, we only use it as a reference for your pet: people are left out of the pictures we create, and we don't try to recognise anyone. Please only send photos of other people if they're happy for you to.
• The pictures and cards we make for you. We create your pet's picture in the card maker, before you pay, so we also hold pictures for cards that aren't bought, until they're deleted (see How long we keep it).
• The names and addresses on your list, and your greeting and message, so we can print your cards and post them.
• Your email address and payment details when you buy. Payment is handled by Stripe, so we never see your card number. See Emails we send for what we use your email address for.
• Your review, if you leave one: your stars, your words, the name you choose to show (such as “Sarah K.”) and, if you add one, your photo of the card. We remove the photo's hidden details (such as where it was taken) when you send it. Your review is published with your chosen name; your photo is only shown if you tick the box saying we can. See How our reviews work.
• Your email address, if you join the waiting list. We use it only to tell you when we open and when the last posting date is coming. Reply to any of those emails, or use the link to stop them, and we'll remove you. We delete the list at the end of January, once Christmas is over.
• Birthday reminders, if you ask for them after you order: your email address, your pet's name and kind, and the day and month of each birthday you give us, with the first name of anyone you'd like reminding about (never the year). We keep when you asked and the words you agreed to. Every reminder has a link to stop them all, which deletes them straight away.
• Your account, if you make one (see Your account below).
• A device cookie and a scrambled version of your internet address. We use these only to stop our card maker being misused. We can't work out your address from the scrambled version.
• Where you came from, if you arrived from one of our own links (a link in our TikTok or Pinterest profile, or one of our adverts, carries a short tag, like ?ref=tiktok). The tag stays in the page address while you look round, and is saved with your order or your waiting-list sign-up, so we can count which places bring us orders. It's only used for our own totals, never shared, and nothing is stored on your device for it, so it doesn't depend on accepting cookies.

Emails we send

• About your order: your receipt, and when your cards are posted.
• One request for a review, about five days after your cards are posted, asking how they were. We send it to everyone who orders, once per order. Each one has a link to stop us asking again.
• Now and then, news of new cards. The law lets a shop email its customers about things like what they bought, as long as they can say no. You can say no when you order, by ticking “No thanks, don't email me about new cards” at checkout, and from any of those emails, with one click. We keep whether you ticked the box, the words you saw and when, and once you've said no we won't ask again. These emails are only ever about our own cards.

Your account

You never need an account to buy from us. If you make one, this is what it holds and how long we keep it.

• Your email address (and your name, if you give it or Google or Apple shares it), and how you sign in. If you sign in with Google or Apple, they confirm your email address and give us an id for you; we never see your password there. Apple can give us a private relay address instead of your real one, and your account works the same way with it.
• Your orders. Orders you place while signed in, and paid orders placed with your account's email address, show in your account. They're the same orders as before, kept and deleted on the same dates (see How long we keep it).
• Saved cards. A card you start while signed in is saved to your account, so you can finish it on another device. This includes the photos you added. Saved cards follow the same rule as any unfinished card: they're deleted, with their photos, 30 days after you started them. We never keep photos longer because you have an account.
• Your address book: the names and addresses you save, so you can send to the same people next time. Only save people you send cards to. They stay until you remove them or delete your account.
• Your pets: the names and kinds of the pets you've ordered cards for, and the last design, for a quick start next time. No photos.
• Birthday reminders you've asked for, which you can see and stop in your account.
• Passkeys, if you add one: only the public half, which can check a sign-in but can't make one. The private half never leaves your device.
• Sign-in records: the devices signed in (the browser's name and when it was last used), kept for 30 days after each was last used. Sign-in codes last 15 minutes and are deleted within a day. We keep them, and your session, only in a scrambled form that can't be used to sign in.
• Marketing emails, only if you tick the box for them. It's never ticked for you and nothing else depends on it. We keep when you agreed and the words you agreed to, and you can stop them in your account or from any of those emails.
• The welcome offer. To make sure it's used once per email address, we keep a scrambled (one-way hashed) copy of the address once it's been used, even after your account is deleted. It can't be turned back into your email address.

We keep your account while you use it. If nobody signs in to it for two years, we delete it. You can download a copy of everything in it, or delete it, at any time from its Details section. Deleting it removes your saved cards and their photos, your address book, your pets, your birthday reminders, your passkeys and sign-ins straight away. Orders you've already paid for are still made and posted, and then deleted on the usual dates below.

Why we use it

• To make your cards and post them, because that's what you asked us to do (performing our contract with you).
• To run your account, if you make one, because you asked us to (performing our contract with you).
• To send you offers and news by email, only if you tick the box for them (your consent, which you can withdraw at any time).
• To email you now and then about new cards after you've bought from us, unless you tick the box to say no at checkout. This is in our legitimate interests, and the law on marketing emails allows it for a shop's own customers. You can stop them at any time from any of those emails.
• To ask you once for a review of your order, and to publish the reviews people send us, so other customers can see what we're like. This is in our legitimate interests, and you can ask us to remove your review at any time.
• To send the waiting list emails and birthday reminders you asked for (your consent, which you can withdraw at any time from any of those emails).
• To prevent misuse of the card maker, which is in our legitimate interests and yours.
• To keep records of our sales, because tax law requires it.
• To keep a short record of each order for 6 months after it's posted, so we can answer a question about it or show that we posted it if a payment is disputed. This is in our legitimate interests.

We don't sell your data, we don't use it for advertising, and we never use your photos or pictures to train AI.

The pictures we create are checked automatically before you see them, and your photos and message may be checked automatically too, to stop the card maker being misused. We don't make any decision about you by automated means alone that has a legal or similarly significant effect on you. If a check stops something you think it shouldn't, email us and a person will look at it.

Who helps us

These companies process data for us under contracts that require them to keep it safe:

• Google (its Gemini service) creates the artwork from your photos and checks each picture before you see it. We use its paid business service, whose terms say it doesn't use what we send to improve its products, and keeps it only for a limited time to prevent misuse.
• Stripe takes payments. Stripe is also responsible in its own right for how it uses payment details to prevent fraud and meet its legal duties, under its own privacy policy.
• Google and Apple, only if you choose to sign in with them. They tell us your email address (and your name, if you let them).
• Resend sends our emails, including sign-in codes.
• Prodigi prints your cards and posts them, so it receives the card artwork and the addresses you give us. Cards posted to Canada or Australia are handed to an international post service (such as FedEx) for delivery, with our own email address for any customs questions.
• Cloudflare stores photos and pictures (in the EU), delivers our website, and runs a quiet security check (Turnstile) before a picture is created, to tell people from automated misuse.
• Railway runs our website and database.

Some of these companies are based in the United States, and Cloudflare stores photos in the EU. The EU is covered by the UK's adequacy rules. For the United States, your data is protected either by the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”), where the company is certified under it, or by the ICO's International Data Transfer Addendum to the EU's standard contractual clauses in its contract with us. Email us if you'd like to know more about these safeguards.

How long we keep it

• Your photos, pictures, cards, names and addresses, and your greeting and message: deleted automatically 30 days after your cards are posted. Cards can be booked to arrive months ahead, so we keep what we need to make and post them until then. If you start a card and don't buy it, we delete it, with its photos and the picture we created, 30 days after you started it. If an order is never posted (for example, it was refunded), we delete it 30 days after it was started. If a paid order gets stuck (a problem at the printer, say), we keep it while we sort it out, for at most 90 days after the order or its arrival date.
• The scrambled internet address and device cookie behind our misuse limits: kept with each card you start (and deleted with it), and in a log of pictures created, where the address and device are blanked after 2 days. Sign-in and look-up attempts keep a scrambled address for a day or two.
• A short record of each paid order: the order number, the date, what was bought, the amount, the payment reference, the tag of the link you came from (if any) and when and how it was posted, with any tracking number. No photos, names or addresses. We keep it for 6 months after the order is posted (or paid, if it's never posted), in case there's a question about it or a payment is disputed, then delete it.
• Sales records: we keep our sales totals for each month for 6 years after the end of the tax year, as HMRC requires. They hold no personal details. Stripe also keeps its own record of each payment, under its own privacy policy.
• The waiting list: deleted at the end of January, once Christmas is over, or sooner if you ask.
• Birthday reminders: kept until you stop them (from any reminder, or your account) or delete your account.
• Your email choices (whether you said no to emails about new cards, or to review requests, and when): kept for 2 years after your last order or your last change, then deleted.
• Reviews: the link in a review request works for two months, and we delete what it needs (your email address, the order number and the design) 90 days after we send it. A published review, with its photo, stays on our site until you ask us to remove it. A review we've removed under our review rules is kept for a year, in case there's a question about it, then deleted.
• If a payment is disputed (a chargeback), we keep that order's details until the dispute is settled, as evidence, then delete them on the usual dates.
• Backups: we take a backup of our database once a day, so we can recover if something goes wrong. Each backup is kept for 6 days and then deleted, so anything we delete is gone from our backups within 6 days too.

If someone sent you a card

The person who ordered your card gave us your name and address so we could post it to you. We use them only to print and post that card, sharing them only with the companies listed under Who helps us that make and deliver it, and we delete them 30 days after it's posted. If you'd like to ask about them, email [email protected].

If someone asked us to remind them of your birthday, they gave us your first name and the day and month of your birthday, and nothing else. We use them only to send them a reminder, and we delete them when they stop their reminders. Email us if you'd like yours removed.

Your rights

You have the right to:

• ask for a copy of the data we hold about you;
• ask us to correct it if it's wrong;
• ask us to delete it sooner;
• ask us to limit how we use it;
• object to our using it for our legitimate interests, such as preventing misuse of the card maker;
• ask for a copy of the data you gave us in a format you can reuse, or for us to send it to someone else;
• withdraw your consent to marketing emails at any time, without affecting anything sent before;
• say no to marketing emails at any time, whether you ticked a box for them or not.

If you have an account, you can also download a copy of it or delete it yourself, from its Details section. For anything else, email [email protected] and we'll reply within a month. If you're unhappy with how we've handled your data, please tell us first: email us, and we'll confirm we've received your complaint within 30 days and tell you what we're doing about it. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Cookies and what we store on your device

We keep this to a minimum. Nothing here tracks you across other websites, and we don't use advertising cookies or analytics services.

• Device cookie (gm_device): stops the card maker being misused. It's needed for the site to work safely.
• Your card in progress and your light or dark choice: kept in your browser so your card isn't lost if you close the page, and the site looks the way you chose. You can clear them at any time in your browser settings.
• Your last card's details: your pet's name, who it was signed from, your message and the birthday person's name, kept in your browser for 30 days after you make a card, so your next card can offer them with a tap. Never your photos or addresses. You can clear them at any time in your browser settings.
• Your basket and checkout details: the cards in your basket, and the name, email and addresses you type at checkout, kept in your browser so the people you send cards to are one tap away next time. They stay on this device until you clear them in your browser settings.
• Sign-in cookies (gf_session, and gf_oauth or gf_pk for a few minutes while signing in): keep you signed in to your account, if you have one, for up to 30 days after you last used it. They're needed for signing in to work, and they're deleted when you sign out.
• Security check (Cloudflare Turnstile): when a picture is created, Cloudflare checks the request comes from a person, not an automated script. It's needed to keep the card maker safe, and it isn't used to track you.

When you pay, you type your card details into Stripe's secure fields on our checkout page. They go straight to Stripe, never to us, and Stripe uses its own cookies there to keep payments secure and to stop fraud.

Age

You need to be 18 or over to buy from us.