Privacy Policy
Effective Date: January 1, 2026 · Compliant with GDPR (EU/UK) & CCPA (California)
1. What Information We Collect
- From Room Creators: We collect your email address solely to deliver purchase receipts, account recovery links, and essential deck generation notifications.
- From Guests & Contributors: We collect only the guest name, roast text message (max 200 characters), and any uploaded photos you choose to provide. We do not require guests to create accounts or link social media profiles.
- Payment Details: We do not collect, process, or store credit card numbers, CVVs, or bank details on our servers.
2. Third-Party Service Processors
To guarantee fast global performance and enterprise-grade security, we partner with industry-leading cloud infrastructure providers:
Cloudinary
High-performance media CDN for secure image storage and WebP delivery.
NeonDB
Serverless Postgres database providing encryption-at-rest and strict isolation.
Stripe & LemonSqueezy
PCI-DSS Level 1 certified processors handling all transactions safely.
3. Data Retention & Automatic Expiry
RoastCard rooms and associated guest submissions are stored securely in cloud storage for a maximum of 12 months following deck generation. After 12 months, media assets may be permanently deleted to protect user privacy.
We provide the Offline HTML Archive (Keepsake) feature so recipients and creators can permanently keep an interactive, offline copy of their deck on their personal devices forever with zero reliance on cloud servers.
4. Right to Deletion & Data Rights (GDPR / CCPA)
You retain total control over your memories. Room Creators and individual contributors can request immediate data deletion, image takedown, or data export at any time:
To request full data deletion, email our privacy team directly at privacy@roastcard.com with your room link or contribution details. Requests are verified and fulfilled within 48 hours.