Privacy Policy
Last updated: March 3, 2026
CinematicCard (operated by Sid Carver, "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website at cinematiccard.com.
1. Information We Collect
Personal Information You Provide
- Names and email addresses — for card delivery and purchase receipts
- Payment information — credit/debit card details processed securely through Stripe. We never store card numbers on our servers.
- Content you create — recipient names, ages, personal messages, photos, and music files uploaded for card creation
Automatically Collected Information
- IP address, browser type, device information, and pages visited (standard web server logs)
- Card view analytics (when a recipient opens their card)
2. How We Use Your Information
- To create and deliver your digital greeting card
- To process payments via Stripe
- To send scheduled email deliveries you request
- To send your purchase receipt and card link
- To improve our service and fix technical issues
We do not sell your personal information to third parties.
We do not use your data for advertising.
3. File Storage & Retention
- Photos and music you upload are stored securely on our servers for the purpose of generating your card.
- Card content (photos, messages, music) remains accessible via the card link indefinitely.
- You can request deletion of your card and all associated files by emailing [email protected].
- We delete uploaded files that are not associated with a completed purchase within 24 hours.
4. Third-Party Services
We use the following third-party services:
- Stripe — Payment processing. Stripe's Privacy Policy
- Resend — Email delivery service, used to send scheduled card delivery emails and receipts.
- Cloudflare — DNS, SSL, and CDN services.
5. Cookies
- We use minimal cookies for site functionality only.
- No advertising or tracking cookies.
- No third-party analytics trackers.
6. Data Security
- SSL/TLS encryption on all pages
- Payment data handled exclusively by Stripe (PCI DSS compliant)
- Photos and uploads stored in access-controlled server directories
- Parameterized database queries to prevent injection attacks
- Regular security updates and monitoring
7. Your Rights
You have the right to:
- Request access to your personal data
- Request deletion of your data and uploaded content
- Opt out of any future marketing emails
To exercise any of these rights, contact us at [email protected].
8. Children's Privacy
Our service is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us so we can delete it.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Your continued use of CinematicCard after changes constitutes acceptance of the updated policy.
10. Agentic Boundary Tokenization (ABT) — Data Handling
CinematicCard uses the ABT (Agentic Boundary Tokenization) protocol (v2) for all agent-initiated purchases.
Payment data is encrypted with AES-256-GCM in a sealed envelope; CinematicCard never receives raw payment credentials.
PII Retained per Product Type
Retention periods are published at /.well-known/abt-retention-policy.json.
- Single and bulk cards: email 30 days, message and name 7 days, tax records 7 years (IRC §6001 / FL statute)
- Cinematic Invitations: email 60 days, guest list 14 days, event date 30 days, tax records 7 years
Every envelope access appends a signed entry to an immutable hash chain.
Non-statutory data deletion is available on request by emailing [email protected].
11. Contact
If you have questions about this Privacy Policy or your personal data, contact us at:
[email protected]
