How we use your information

Who we are

KYCA.cards is the controller – the party responsible under data protection law – for the information described on this page.

Write to hej@kyca.cards about anything to do with your information. We don't have a data protection officer – we answer your questions ourselves.

KYCA.cards is run by KYCA ApS, Danish CVR no. 45054098, Aage Berntsens Alle 38, DK-2750 Ballerup.

What we collect

• Your card's detailsWhat you type in the guide and the studio: names, dates, times, places and addresses, who guests should reply to (a name, phone number or email), the card's wording, your requests and changes – and for place cards and menus, your guests' names and the menu.
• ImagesYour own photos for the card, and pictures of cards you like – or a link to one, which we then fetch. When we store an image, we remove its metadata, such as GPS location.
• When you payFor printed cards: your email, name and delivery address, which you enter at Stripe, and what you bought. For print-at-home files, Stripe asks for your email, your country and, where sales tax needs it, your postal code; we keep what you bought and what you paid, and your email in your account (see below). For files delivered immediately in the EU or Norway, we also keep confirmation, with a timestamp, that you accepted immediate delivery and acknowledged losing your right of withdrawal. Payment details – card number, wallets, Klarna and the like – go only to Stripe and the payment provider. Once the payment is confirmed, we send an order confirmation to the email you entered at Stripe.
• Your accountOnce you've paid, we make an account for the email you paid with, so you can log in under “My orders” and see your orders and where they are. The account keeps the email, when it was made and when you last logged in. There's no password: you get a 6-digit code by email. When you ask for a code, we keep the code and the email only as unrecognisable checksums (hashes), with your hashed IP address so no one can ask for thousands of codes.
• If you want us to let you knowYour email, if you ask to hear when we can print for you.
• StatisticsWhich pages and cards are seen and chosen, with the shop, language, occasion and size, how fast pages load, and errors in the page. No cookies, no IP address, and nothing you typed or uploaded. The random ID used for statistics lasts only while the page is open – but when you make a card, we keep that ID with your project, so your next visit to the project counts as the same visitor, along with where the visit came from: another site's domain, the link's campaign labels and whether it was an ad click. We also count what our design assistant uses for your card: which model, how much and what it costs – never what is written to it or by it.
• Technical dataA hashed (unreadable) form of your IP address when you start a card or place an order, so we can stop abuse. Our application logs at Vercel, with IP addresses, are kept for a day; Vercel separately keeps security records under its own policy.
• Other people on the cardA card often names other people – the couple, the guests, whoever collects the RSVPs – and may show their photos. If you're one of them, we got your details from the person who made the card, and we use them only to make that card. Some occasions, such as a confirmation, or a menu can say something about faith or health; we don't use that for anything else either.

You don't have an account with us: your card lives at a private link. Anyone with the link can open the card, so share it only with people you want to see it.

What the design assistant sees

Our design assistant makes and changes cards with language and image models from Anthropic (Claude), OpenAI (GPT) and Google (Gemini). We send the requests through OpenRouter, a US service that passes each one on to the model that answers it.

The models see your card's wording and details, your requests and changes, pictures of cards you like, and images of the card itself – including your own photos once they're in it. We never send your own photos on their own, and they're never used as a reference for other cards.

When a card is finished, we keep a template of the design in which we replace the names, dates and places with placeholders, as far as we can find them. The template is visible only in your own project – including anything we missed.

The design assistant makes no decisions about you. It suggests a card, and you decide whether to use it.

Why – and on what legal basis

• Making, changing and saving your cardSo you can see it, change it and come back to it. Legal basis: providing the design service you asked for, also before you buy (Article 6(1)(b) of the GDPR).
• Taking payment and delivering what you buyPrinted cards are printed and shipped; print-at-home files open in the studio at your card's link. Legal basis: our agreement with you (Article 6(1)(b)). The timestamped confirmation documents the immediate-delivery agreement and compliance with our legal duties to inform you about withdrawal rights (Article 6(1)(b) and (c)).
• BookkeepingDanish bookkeeping law requires us to keep orders and payments. Legal basis: a legal obligation (Article 6(1)(c)).
• Your account and “My orders”Showing you your orders, where they are and the parcel's tracking, and sending you the code you log in with. Legal basis: our agreement with you (Article 6(1)(b)).
• Other people on the cardWe use other people's names, contact details and photos because you and we share a legitimate interest in making the card you asked for (Article 6(1)(f)).
• StatisticsSeeing which pages and designs work, where visitors get stuck, what our design assistant costs, and which visits end in an order – that's why we keep the visit's random ID with your project and pass it to Stripe when you pay. Legal basis: our legitimate interest in improving the shop (Article 6(1)(f)). You can object to this.
• SecurityThe hashed IP address and logs keep the service running and stop anyone from starting thousands of cards. Legal basis: our legitimate interest in a secure service (Article 6(1)(f)).
• Letting you know when we can printYour email, if you ask. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time.
• Do you have to give us this information?No law requires it. What the guide asks for as required is needed to make the card you ask for, and a delivery address to ship printed cards; without it we can't. Everything else is optional.

Who helps us

We don't sell your information or share it for advertising. These companies process it for us, on our instructions:

VercelUS · servers in Washington, D.C.

Runs the website. Everything the site handles passes through Vercel, which also logs requests.

ConvexUS · database in Virginia

Stores the cards, your details for them, and orders.

BackblazeUS · files in Amsterdam

Stores images, cards and PDF files.

StripeIreland · US

Takes the payment: email, name, address and payment details. For fraud prevention and its legal duties as a payment company, Stripe is a controller in its own right – as are Klarna and Stripe's Link if you pay with them.

GelatoNorway · prints near the recipient

Will print and ship printed cards: when an order goes to print, Gelato gets your name, delivery address and the print file, and the carrier the name and address. We don't send Gelato any customer information yet.

ResendUSA · sends from Ireland

Sends the order confirmation: your email, what you bought, the names and date on your card, your card's link and, for printed cards, your name and delivery address – and the code you log in to “My orders” with, to your email. Resend keeps the email and its log for 30 days.

PostHogEU (Frankfurt)

The statistics, without cookies and without what you type.

OpenRouterUS

Passes the design assistant's requests on to the models.

Anthropic, OpenAI, GoogleUS

The language and image models behind the design assistant.

If the law requires it, we may have to hand information over to the authorities.

Information outside the EU

The website runs on Vercel's servers in the US, and Convex stores the cards, your details for them and the orders in the US. OpenRouter, Anthropic, OpenAI and Google process the design assistant's requests in the US, and Resend stores the order confirmations in the US. Backblaze, Stripe and PostHog are US companies; even though your information is stored in the EU, they can access it from there.

Vercel, Backblaze, Stripe, PostHog, Resend and Google say they're certified under the EU-US Data Privacy Framework, and transfers to them rely on it. Transfers to OpenRouter, Anthropic and OpenAI rely on the European Commission's standard contractual clauses in their data processing agreements, and transfers to Convex, which isn't certified under the framework, on Convex's data processing agreement. Write to us if you'd like a copy.

How long we keep it

• Cards, details and imagesWe keep your project so you can come back and order again, until you ask us to delete it. We then delete it within 30 days. We don't delete old projects automatically yet – when we do, we'll say so here.
• Orders5 years from the end of the financial year the order belongs to, as Danish bookkeeping law requires.
• Account and loginThe account for as long as we keep your orders (see above), or until you ask us to delete it. A code works for 10 minutes and we delete it after a day; a login lasts 400 days (just over a year), or until you log out.
• Email for updatesUntil we've written to you, or you ask us to delete it.
• Statistics and logsStatistics are kept in PostHog for up to 7 years; the visit's ID stays with your project for as long as the project exists. Our logs at Vercel are kept for a day; Vercel also keeps its own security records under its own privacy policy.

Cookies and browser storage

We use no cookies for advertising and nothing that follows you around other sites. This is everything our pages store in your browser – each for something you use on the site:

• NamePurposeHow long
• kyca-storefrontRemembers which shop – country and language – you used last, so kyca.cards opens it again.How long: Until you close the browser – 1 year if you choose the country and language yourself
• ainativeprint:draft:v1What you've typed in the guide, so it isn't lost if the page reloads. Deleted when you send it.How long: Until you send it
• ainativeprint:access-code:v1The access code, if you were given one.How long: Until you clear it
• kyca:market-notice-dismissedThat you closed the note about your shop.How long: Until the tab closes
• kyca-accountKeeps you logged in to “My orders”. Set only when you log in.How long: 400 days, or until you log out
• kyca-loginWhile a login code is on its way: which code to check, and the email you typed.How long: 10 minutes

Our statistics run in the page with a random ID that exists only while the page is open; they store nothing on your device (they only check for a moment that browser storage works, and remove the test). When you open your project again, the page gets the ID from your project on our side, not from your device.

We see your country from your connection when a page asks, so we can suggest your own country's shop. We keep it in page memory only; if you close the suggestion, the tab remembers that country code until it closes.

When you pay, you're on Stripe's own page (checkout.stripe.com). It sets its own cookies to prevent fraud – see Stripe's privacy policy.

Your rights

You can ask us to show you the information we hold about you, to correct or delete it, to give it to you in a commonly used format, and to limit what we use it for. You can object to what we do on the basis of our legitimate interest – the statistics, for example. If you've given consent, you can withdraw it at any time; that doesn't affect what we did before you withdrew it.

Write to hej@kyca.cards. Please include the link to your card, and if you bought something, write from the email you paid with – that's how we find your information. We answer as soon as we can, and within one month at the latest.

Complaints

We're based in Denmark, and the Danish data protection authority, Datatilsynet (datatilsynet.dk), supervises us. If you're unhappy with how we use your information, you can file a complaint with Datatilsynet.

US state privacy rights

We don't sell or share your personal information, as those terms are defined in US state privacy laws, and we don't use it for targeted advertising or profiling.

Wherever you live in the US, you can ask us what we hold about you, and ask us to correct or delete it: write to hej@kyca.cards. We answer within one month and won't treat you differently for asking.

Changes

If we change how we use your information, we'll update this page and the date at the top.