Privacy Policy
1. Controller
Parais Gergely, sole proprietor (egyéni vállalkozó), 8045 Isztimér, Jókai utca 3., Hungary, registration number 62671981, e-mail: hello@sendawick.com (the "Controller", "we"). We have not appointed a Data Protection Officer; use the e-mail above for all privacy matters.
2. Who this Policy is for
Part A applies to people who order a Page ("Customers"). Part B applies to people a Page is about or addressed to ("Recipients"), whose data we receive from the Customer, not from them (Art. 14 GDPR). Part C applies to everyone.
Part A: Customers
3. What we process, why and on what legal basis
| Data | Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|---|
| Your e-mail address, the card's random ID, chosen plan, link lifetime, scheduled delivery time (Extra) | Creating and delivering your Page, sending you the link and the Recipient's reply, telling you if the Page is removed, support | (b) performance of a contract |
| Photos you upload on the Premium and Extra plans (up to 10 on Premium and 20 on Extra; resized in your browser before upload) | Displaying them on the Page after the animation | (b) performance of a contract; for people shown in the photos, your confirmation that you are entitled to share their likeness |
| Extra features: quiz answers (only the score, for example 4/5), the time zone of your browser (to open "one a day" letters and advent windows on the right day), and the amount, line and link of a money gift | Showing the Page as you set it up; e-mailing you the Recipient's quiz score | (b) performance of a contract |
| Packs: your e-mail address, the order number, the pack type, a fingerprint of the code (not the code itself; if the code e-mail to you cannot be sent, the code goes once to our own mailbox so that we can pass it on to you) and which Pages were made with it | Sending you the code, checking it when you use it, handling refunds | (b) performance of a contract; (c) accounting records |
| Your voice message (Premium and Extra; up to 30 seconds, recorded in your browser), your hand-drawn signature (the line coordinates), the hidden gift you add (its name, code or note, link) and the song link you add | Displaying and playing them on the Page after the animation | (b) performance of a contract |
| Yearly reminder (Extra, only if you switch it on): the month and day, the card details needed to prefill a new order, and a record of your consent (time and policy version) | One e-mail a week before the date each year, with a link to a prefilled order and a link to stop the reminder | (a) consent, which you can withdraw at any time with the stop link in every reminder |
| Recipient's first name, your name, occasion, relationship, the free-text details, the generated text | Generating and displaying the Page | (b) performance of a contract |
| Payment status, order reference (received from the Merchant of Record; we never see card details) | Order fulfilment, refunds, accounting | (b) contract; (c) legal obligation (accounting) |
| IP address and e-mail address as one-way hashes, kept for one hour (IPv6 addresses are counted by their /64 network prefix, also hashed) | Limiting the number of previews per hour to prevent abuse | (f) legitimate interest in running a secure service |
| Technical event log (card ID, event type such as "preview created" or "paid", technical detail, time; for the withdrawal acknowledgement, a keyed tag of your IP address made with a secret key, not the address itself) and Cloudflare's security logs | Security, abuse prevention, debugging; proof of the order and of your acknowledgement of the loss of the right of withdrawal | (f) legitimate interest |
| Bot check on the order form (Cloudflare Turnstile) | Stopping automated abuse of the preview generator | (f) legitimate interest |
| Aggregated page-view and page-speed statistics (Cloudflare Web Analytics; no cookies, no fingerprinting, no cross-site tracking), and our own anonymous daily counts of how far visitors got in the order form and how many previews (and failed preview requests, by cause), checkouts, payments and first openings happened (day, step and language only, no card or person identifier) | Understanding which pages are used and how fast they load | (f) legitimate interest |
| Only if you accept the Meta Pixel in the cookie bar: the pages you view on our site, the occasion viewed, the start of a checkout, your IP address and technical data of your browser, the _fbp/_fbc cookie identifiers; after a purchase, the order number, the amount and a one-way hash (SHA-256) of your e-mail address | Measuring and targeting our Facebook and Instagram ads (Meta Pixel and Conversions API) | (a) consent (with Article 5(3) of Directive 2002/58/EC), which you can withdraw at any time with "Cookie settings" |
| Wall of wishes (Extra plan): the name and the short text that friends of the Customer type on the collect link, shown on the Page | Displaying the friends' wishes on the Page; the Customer can hide a line with a private link | (f) legitimate interest of the Customer and the friend in delivering a shared greeting; the friend enters the data themselves and can ask us to remove it |
| The time the Page is first opened on a device other than yours | E-mailing you once that the Page was opened (part of the order) | (b) contract; towards the Recipient (f) legitimate interest. We do not record who opened the Page, where or on which device, and we store nothing on the Recipient's device for this. |
| Support correspondence, abuse reports | Handling your requests and complaints | (b) contract; (c) legal obligation (consumer law); (f) legitimate interest |
We do not send marketing e-mails (the yearly reminder is sent only if you ask for it), do not create profiles ourselves (Meta may use Meta Pixel data for ad targeting only if you consent, see Section 7), do not make automated decisions with legal effect about you, and do not sell personal data.
4. Special categories of data
Please do not type health information, details of sex life or sexual orientation, religion, political opinions or similar sensitive details about anyone, yourself included. Some occasions (for example a get-well card) can by their nature hint at such things. We do not analyse or extract such data: the AI is told not to mention diagnoses or medical details, we use the text only to render your Page, and we delete it according to Section 8.
Part B: Recipients
5. Notice for Recipients (Art. 14 GDPR)
Someone who knows you ("the Customer") ordered a personalised greeting page from us and gave us your first name and possibly a few details about you, such as shared memories. We received this data from the Customer, not from you. We process it only to create, host and display the Page the Customer ordered and, if you choose to reply, to send your reply to the Customer. When you first open the Page, we record the time and tell the Customer by e-mail that it was opened; we do not record who opened it, where or on which device. Legal basis: our and the Customer's legitimate interest in delivering a personal greeting (Art. 6(1)(f)), balanced against your rights; the Customer confirmed to us that they were entitled to share your details. We keep the Page for the period the Customer chose (365 days for Basic; for Premium and Extra until removal or until the Service is discontinued) and then delete it. Categories of data: first name, relationship to the Customer, the details the Customer described, the generated text, photos the Customer uploaded (which may show you), the Customer's voice message, signature, hidden gift and song link if they added one, quiz questions and your score (your first score is e-mailed to the Customer, and the Page tells you this), open-when letters, advent calendar messages, the numbers and lists of an "Our year" book, the amount and link of a money gift, the time you first opened the Page, and your optional reply. We do not use your data for any other purpose, do not contact you, and do not share it except with the service providers listed in Section 7.
You have the right to object to this processing and to remove the Page at any time: press "Do not show this card again" at the bottom of the Page (the Page disappears immediately and automatically) or e-mail hello@sendawick.com with the link; we act on e-mailed requests within 48 hours. You also have the rights described in Section 10.
Part C: Everyone
6. Your reply on the Page
If a Recipient sends a reply through the Page (for example "Yes" or a short message of up to 280 characters), we store the reply with the Page and e-mail it to the Customer. This is done to perform the Customer's contract and in the Recipient's interest in responding.
Free reply card. If you, as a Recipient, make a card in return through the "Send a card back" button, we e-mail its link to the Customer; you never see the Customer's e-mail address. Your own e-mail address is optional on a reply card; if you give it, we use it only to tell you when the Customer opens your card. The data of a reply card is handled as described in Part A, with you as the Customer.
7. Processors and other recipients of data
We use the following service providers, which act on our documented instructions under data processing agreements (Art. 28 GDPR):
- Cloudflare, Inc. (USA) and its EU affiliates: hosting, database (Cloudflare D1) and photo storage (Cloudflare R2), both created with the "EU" jurisdiction so that stored data is kept in the European Union, content delivery, DDoS protection, the Turnstile bot check on the order form, cookie-free Web Analytics, Browser Rendering (making the video file of the Extra plan), and forwarding of e-mail sent to hello@sendawick.com. Edge processing may occur at Cloudflare locations worldwide. DPA: cloudflare.com/cloudflare-customer-dpa. For improving Turnstile, Cloudflare acts as an independent controller of the data the bot check collects (cloudflare.com/turnstile-privacy-policy).
- Anthropic Ireland, Limited / Anthropic, PBC (Ireland / USA): generation of the personal text of the Page. We send only the occasion, the Recipient's first name, the relationship and the details you typed (for the "Our year" book, also the numbers and lists you typed); we never send your own name or your e-mail address. Under its commercial terms Anthropic may not train models on this data and deletes inputs and outputs within 30 days unless flagged for abuse; under Anthropic's policy, content flagged for abuse may be kept for up to 2 years. DPA: anthropic.com/legal/data-processing-addendum
- Resend, Inc. (USA): sending transactional e-mails (the link to your Page, the Recipient's reply, the "opened" notice, the quiz score, the removal notice, the yearly reminder and the pack code). DPA: resend.com/legal/dpa
- Google LLC (USA): the mailbox behind hello@sendawick.com is a Google Workspace / Gmail mailbox, so support e-mail you send us is stored there.
- Sold through Link, LLC (formerly Lemon Squeezy LLC), 222 Main Street Suite 500, Salt Lake City, UT 84101, USA: our Merchant of Record. For payment, invoicing, tax and fraud prevention the MoR is an independent controller of your data under its own privacy policy (https://www.lemonsqueezy.com/privacy); it shares your e-mail address and the order reference with us so that we can deliver the Page.
- Meta Platforms Ireland Ltd. (Ireland), only if you accept the Meta Pixel: for collecting the Meta Pixel data on our site and passing it, together with the purchase report of the Conversions API, to Meta, we and Meta are joint controllers (Art. 26 GDPR; the essence of the arrangement is Meta's Controller Addendum, facebook.com/legal/controller_addendum). You can exercise your rights with either of us. For the further processing (ad measurement, targeting and improving its products) Meta is an independent controller (facebook.com/privacy/policy); the data may be transferred to Meta Platforms, Inc. in the USA under the EU-US Data Privacy Framework. The card pages sent to Recipients never contain the Meta Pixel.
Song player on a Page. If the Customer added a song, the Page shows a play button. Only when the Recipient taps it does the player load from Spotify AB (Sweden) or Google LLC / YouTube (USA, in privacy-enhanced mode, youtube-nocookie.com), which then act as independent controllers under their own privacy policies. Before the tap nothing is loaded from them.
We may also disclose data if required by law, to establish, exercise or defend legal claims, and to authorities under Regulation (EU) 2022/2065 where applicable.
8. Retention
- Page content (names, details, generated text, photos, friends' wishes, reply): Basic Pages until the link expires (365 days after payment); Premium and Extra Pages until the Customer or Recipient removes the Page or the Service is discontinued. Unpaid previews expire 72 hours after creation. Expired and removed records are deleted by an automated daily clean-up; the database keeps point-in-time backups for up to 30 days after that.
- Order record: the card row with your e-mail address is deleted together with the Page. The proof-of-order entries of the event log (card ID, MoR order number, plan, time) are kept for 8 years, as required by Hungarian accounting law (Act C of 2000, Section 169).
- Order-form data: after payment, the details you typed and the AI text variants are deleted, except what the yearly reminder needs (recipient, sender, relationship, details, sign-off) while a reminder is switched on; when you stop the reminder, these are deleted too.
- Packs: the buyer's e-mail address on a pack record is deleted one month after the pack expires; the pack record itself (order number, type, number of cards) remains.
- Yearly reminder: while it is switched on; it ends with the stop link in the reminder e-mail, when the Recipient removes the Page, or when the Page is deleted.
- Rate-limit hashes: 1 hour (IPv6 addresses are counted by their /64 network prefix, also hashed). Technical event log: deleted together with the card, except the proof-of-order entries (payment, withdrawal acknowledgement, refund, removal, plan trimming, pack use, reminder consent, underpaid order), which are kept for 8 years; the withdrawal acknowledgement entry stores a keyed tag of the IP address made with a secret key (HMAC), not the address. Cloudflare security logs: as set by Cloudflare for our plan.
- Support and abuse correspondence: 3 years after closure (limitation of claims); abuse reports that led to removal: 5 years in minimised form.
- AI provider: inputs and outputs deleted within 30 days, except content flagged for abuse (up to 2 years under Anthropic's policy) (Section 7).
- Meta Pixel cookies (_fbp, _fbc): 90 days in your browser, deleted earlier when you withdraw consent; Meta keeps the data it received under its own policy. Your choice in the cookie bar (sw-consent-v1): in your browser until you change it or clear your browser data.
9. International transfers
Our providers are headquartered in the United States. Where personal data is transferred outside the EEA, we rely on: (i) the EU-U.S. Data Privacy Framework adequacy decision for providers certified under it; and/or (ii) the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) incorporated in each provider's DPA, together with supplementary measures (encryption in transit and at rest, EU data-location settings, data minimisation). You may request a copy of the relevant clauses at hello@sendawick.com.
10. Your rights
Under the GDPR you may: access your data; have it corrected; have it erased; restrict processing; receive the data you gave us in a portable format; object to processing based on legitimate interest (including as a Recipient); and withdraw consent at any time without affecting earlier processing. Write to hello@sendawick.com. Because there are no accounts, please quote the order e-mail address and the card link (Customers) or the card link (Recipients) so that we can identify the relevant data. We respond within one month.
11. Complaints
You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH), 1055 Budapest, Falk Miksa utca 9-11, Hungary; postal: 1363 Budapest, Pf. 9; e-mail: ugyfelszolgalat@naih.hu; naih.hu, or with the supervisory authority of the EU country where you live or work. You may also bring a claim before the courts.
12. Security
Data is encrypted in transit (TLS) and at rest by our hosting provider; access is limited to the Controller; Page links use long random identifiers that cannot be guessed and are excluded from search engines. No system is perfectly secure; if a breach is likely to result in a high risk to you, we will inform you as required by Art. 34 GDPR.
13. Children
We do not knowingly accept orders from persons under 18. If you believe a child has provided us data, contact hello@sendawick.com and we will delete it.
14. Changes
We will post the new version here with a new version number and effective date. Material changes affecting existing Pages will be notified by e-mail to Customers.