Privacy Policy

Last updated: November 10, 2026

The short version: your photos are used only to make your game. Before you order, they stay in your browser and are sent to our AI image provider just to create the cards. If you order, we receive them to produce your game and delete our copies 60 days after it ships. Our service providers (like the AI provider and our printing partners) handle data under their own policies. We don’t sell your data, we don’t use your photos for advertising, and we don’t do facial recognition.

1. Who we are

This Privacy Policy explains how Card My Face, operated by Card My Face, a business based in Israel (“we,” “us”), collects, uses and protects personal information when you use our website and order a game. It is part of our Terms of Service.

2. What we collect

Photos and game details you upload or enter: a photo of each player, their names, gender (used only to choose character outfits), the characters you pick, and your family or group name.
Order details when you buy: your name, email address and shipping address, which you give through PayPal at checkout, plus what you ordered and the price paid. We never receive your full card or bank details – PayPal handles payment.
Messages you send us, for example to customer support.
Basic technical data that any website receives, such as your IP address and browser type, kept in our hosting provider’s standard server logs for security and troubleshooting.

3. How we use it

to create your preview cards and, if you order, your full game;
to print, pack and ship your order and send you order-related messages;
to provide customer support, handle reprints and refunds, and prevent fraud and abuse;
to meet our legal, tax and accounting obligations.

We don’t use your photos or cards for advertising or marketing, and we don’t show them publicly, unless you give us separate written permission.

4. Where your data is kept before you order

While you build a game, your photos, names and cards are saved only in your own browser (on your device), so you can come back to your game later. They are not stored on our servers. You can delete them at any time with the “Start over” button or by clearing your browser’s site data. To create the cards, each photo is sent through our server to our AI image provider (see below); our server passes it along and doesn’t keep it.

5. Who we share data with

We share personal information only with service providers who help us run the service, and only what they need:

AI image provider (OpenAI) – receives the photos and character descriptions to create the card illustrations. Under OpenAI’s API terms, data sent through its API is not used to train its models, and it may be kept for up to 30 days for abuse monitoring before deletion.
Payment processor (PayPal) – processes your payment and gives us your name, email and shipping address. PayPal’s own privacy policy applies to the information you give PayPal.
Printing and shipping partners in the United States – receive the finished card images (the illustrations, not your original photos) and your shipping details to print your game and deliver it.
Email and hosting providers – our email delivery service (Resend) carries order files to us, and our hosting provider runs the website.
Authorities – if required by law, or to protect our rights, our customers or others.
A buyer of our business – if the business is sold or reorganized, under this same Privacy Policy.

We do not sell or rent your personal information, and we don’t share it for targeted (cross-context behavioral) advertising.

6. No facial recognition or biometric data

We do not use facial recognition and do not create, collect or store face templates, face geometry or any other biometric identifiers. Photos are used only as a visual reference for drawing the character illustrations.

7. How long we keep it

Photos, card images and order files: we delete our copies 60 days after your order ships – long enough to handle any reprint or delivery problem. You can ask us to delete them sooner (but then we can’t reprint).
Order and payment records (name, email, address, what you bought and paid, without the photos): kept as long as tax and accounting laws require.
Unordered games: stay only in your browser until you delete them. We don’t keep them.

Third-party service providers. The deletion periods above apply to the copies we hold. The independent companies that help us provide the service – including the AI image provider, PayPal, our email and hosting providers, and our printing and shipping partners – process and keep the data they receive under their own privacy policies, terms and retention practices, which we don’t control and aren’t responsible for. We choose providers we believe are reputable, share only what each one needs to do its job, and, where possible, ask them to delete order files once they’re no longer needed.

8. Children’s privacy

Our website is for adults (18+) and is not directed to children. We don’t knowingly collect personal information from children under 13. Photos of children are uploaded by their parents or guardians (or with their permission) for the sole purpose of creating the family’s game. If you believe a child has given us information, or you are a parent who wants a photo of your child deleted, email us and we’ll delete it.

9. Your choices and rights

You can ask us at any time to:

tell you what personal information we hold about you and give you a copy;
correct it;
delete it (except records we must keep by law).

Email us at support@cardmyface.com and we’ll respond within 30 days. We may need to verify your identity first. We won’t treat you differently for using these rights.

California and other US state residents: depending on where you live, you may have additional rights under your state’s privacy law, including the right to know, delete and correct personal information and to opt out of its sale or sharing. The categories we collect and why are described above. We don’t sell or share personal information as those laws define it, and we don’t use sensitive personal information to infer characteristics about you. You may use an authorized agent to make a request. If we deny your request, you can appeal by replying to our answer.

10. Cookies and browser storage

We don’t use advertising or tracking cookies. The site uses your browser’s storage only for things it needs to work – saving the game you’re building and your settings. PayPal may set its own cookies when you check out. If we add analytics in the future, we’ll update this policy first.

11. Security

We use reasonable measures to protect your information, including encrypted (HTTPS) connections and trusted service providers. No method of transmission or storage is 100% secure, but we work to protect your data and keep only what we need.

12. International transfers

We are based in Israel, and our service providers operate in the United States and other countries. By using the site, your information may be processed outside your state or country, with protections as described in this policy.

13. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date shows when it last changed. If we make important changes, we’ll make them clear on the site.

14. Contact us

Questions or requests about your privacy? Email us at support@cardmyface.com.