Privacy Policy

1.1 Universal Sections

This Privacy Policy applies to all users of the eCardWidget platform, regardless of their location. The following sections outline our general practices for collecting, using, and protecting personal data.

1.2 Regional Specifications

In addition to the universal sections, this Privacy Policy includes specific clauses that address regional data protection requirements, such as:

• GDPR-specific rights (e.g., data portability)
• CCPA-specific disclosures
• PIPEDA compliance (e.g., accuracy and individual access)

2.1 Account Holders (Data Controllers)

Account Holders are the primary users of the eCardWidget platform and are considered data controllers. As an Account Holder, you are responsible for:

• Determining the purposes and means of processing personal data collected through your use of the platform
• Configuring and using the eCardWidget software in accordance with your own data processing instructions
• Managing your account, creating, and customizing eCards
• Obtaining consent from Directory Members and ensuring the accuracy, lawfulness, and compliance of the personal data you collect
• Responding to data subject requests and ensuring compliance with applicable data protection laws
• Indemnifying eCardWidget for any claims, damages, or losses arising from your misuse of the platform

2.2 eCardWidget (Data Processor)

eCardWidget acts as a data processor on behalf of Account Holders. Our responsibilities include:

• Providing a self-service platform for Account Holders to configure and use
• Implementing appropriate technical and organizational measures to ensure the security of personal data
• Assisting Account Holders in fulfilling their obligations by providing necessary tools and functionalities
• Notifying Account Holders of any data breaches or security incidents, generally within 72 hours of confirmation in line with applicable law

2.3 Directory Members

Directory Members, also referred to as Employees, Team Members, or other roles depending on the Account Holder's use-case, are individuals added to an Account Holder's directory. They can be selected as recipients for eCards sent through the platform. Account Holders are responsible for obtaining consent from Directory Members and ensuring the accuracy of their personal data.

2.4 Senders

Senders are individuals who use the eCardWidget platform to send eCards. They may be Account Holders, Directory Members, or anyone with access to the eCard form. Senders provide their personal information, such as name and email address, when sending an eCard. A sender who starts a group eCard, board or RSVP, or who adds pages, photos, GIFs, video or audio to a card, is also a Participant (see §2.6).

2.5 Recipients

Recipients are individuals who receive eCards sent through the eCardWidget platform. Their personal data, such as name and email address, is provided by the Sender. Recipients can block future eCards from an Account Holder via a link in the email they received.

3.1 Account Holder Data

We collect the following information from Account Holders: name, email address, password, organization details, IP address, billing information, and potentially other data via their own custom fields.

3.2 Directory Member Data

We collect the following information about Directory Members: names, work email addresses, job-related details (such as position, department, employee ID, and manager), hire date / work anniversary, birth month and day (we do not store the birth year), optional profile images, optional custom dates, and any additional custom field data defined by the Account Holder.

3.3 Sender Data

We collect the following information from Senders: name, email address, IP address, optionally billing information for paid eCards, and any additional custom field data defined by the Account Holder.

3.4 Recipient Data

We collect the following information about Recipients: names, email addresses, and any additional information provided by the Sender in the eCard.

3.5 Usage Data

We collect information about how and when Account Holders, Directory Members, and Senders use the eCardWidget platform, including IP addresses, browser types, operating systems, and actions taken within the application. This data helps us improve our services and maintain the security of the platform.

3.6 Health Information

eCardWidget is not intended to collect or store health-related data, including PHI. Please do not submit medical or clinical information through the platform.

3.7 Demo and Contact Requests

When you request a demo or contact us through a form on our website, we collect the details you enter (name, work email, company, organization type, team size, area of interest, and any comments) together with technical context that helps us respond appropriately (your IP address and approximate location, browser language, time zone, and the page you came from). We use this information to schedule and prepare the demo, to follow up on your request, and to understand which pages lead to demo requests. Our legal basis is taking steps at your request before entering into a contract (GDPR Article 6(1)(b)) and our legitimate interest in responding to business enquiries (Article 6(1)(f)). Requests are delivered to our team by email through SMTP2GO and retained for as long as needed to handle the enquiry and any resulting relationship. Scheduling is handled by Calendly, which loads only after you submit the form and processes the name and email you provided to book the meeting. If you have accepted marketing cookies, a hashed (one-way encoded) version of your email may be shared with Google to measure which advertisements led to a demo request; it is never shared in readable form and is not used when you have declined marketing cookies.

3.8 Group eCard, Board and RSVP Participant Data

For Participants we collect: name and email address (entered by the Participant, by the organizer who invited them, through a Directory lookup, or by the person who recognized or named them); IP address and browser details; the access token in the link they used; when they were invited, opened the card or board, signed, posted, commented, reacted or were reminded; the messages, signatures, pages, posts, comments and reactions they add; the names and email addresses of people they invite, recognize or name; honoree and recipient names and email addresses; RSVP answers, guest names and headcounts; and organizer settings such as due dates and reveal dates. Organizers can see who was invited and who has opened, signed or contributed. Posts and comments on a board are visible to everyone who has access to the board, and a board's view-only embed link shows its visible posts to anyone who can open the page it is embedded in.

3.9 Photos, Video, Audio and Recordings

Account Holders and, where a form allows it, senders and Participants can add photos, GIFs, uploaded video, short clips recorded in the browser with the camera and microphone (up to 30 seconds, with sound), and audio tracks to a card, page or post. These files can contain personal data, including the faces, voices, names and surroundings of the people in them. We store the file, a poster image or thumbnail, the file type and size, the time of upload, the account it belongs to and the IP address of the uploader. Photos added through the page tools are resized in the browser before they are saved, which removes embedded camera metadata such as location. We do not use facial recognition, voice recognition or any technology that identifies people from their image or voice, and we do not create or keep biometric identifiers or templates. Your browser asks for permission before the camera or microphone is used, and nothing is recorded until you start a recording.

3.10 Gift Pool Contributions and Participant Gift Card Purchases

When a Participant chips in to a gift pool or buys a gift card for a recipient or honoree, we collect their name, email address, the amount, the brand chosen and the identifiers that Stripe assigns to the payment and any refund. Card numbers are entered into Stripe's payment form and go directly to Stripe; eCardWidget never receives or stores them. The payment is made to the Account Holder's own Stripe account, and the Account Holder can see contributor names, email addresses and amounts. The organizer of a group eCard sees who contributed and how much; other signers see only the total. Stripe emails the contributor a receipt.

Email List Opt-In

By creating an account, Account Holders agree to be added to our email list for promotional and informational purposes. You can unsubscribe via the link in the email or by contacting us. Directory Members, Senders, and Recipients do not receive promotional emails.

Artificial Intelligence and Machine Learning

Personal data submitted through the core eCardWidget platform (such as eCard content, recipient lists, and account data) is not used to train artificial intelligence or machine learning models. Customer support interactions conducted through AI-assisted support tools provided by our customer support sub-processor are processed by those tools as part of their normal operation; those interactions are governed by that sub-processor's privacy policy.

GIFs and Stickers (GIPHY)

The GIF and sticker search in the page tools is provided by GIPHY, Inc. When you search, your search terms, IP address and browser details go from your browser directly to GIPHY, and GIPHY's privacy policy applies to that request. We request family-safe ("G"-rated) results. GIFs placed in a card or board are loaded from GIPHY's servers whenever the card or board is viewed, so GIPHY also receives the viewer's IP address and browser details. We do not send GIPHY your name, email address or account details.

Embedded Video Players

Videos linked from YouTube, Vimeo or Wistia are streamed by that provider when the card is viewed and are never copied to eCardWidget. The provider receives the viewer's IP address and browser details and may set its own cookies; YouTube is loaded through its privacy-enhanced (youtube-nocookie.com) domain. Those providers' privacy policies apply to what they collect.

Media Storage and Processing (Cloudflare)

Photos, video, audio and poster images uploaded to a card, page or post are stored in Cloudflare R2 object storage, processed on Cloudflare's platform (for example, to transcode, resize or generate a poster image) and delivered through Cloudflare's content delivery network from cdn.ecardwidget.com. Uploads go from your browser to Cloudflare over a short-lived signed address. Media that is attached to a card or board can be opened by anyone who has its web address, so do not upload anything you need to keep confidential.

SMS / Text Messaging (Optional Feature)

eCardWidget offers an optional SMS delivery feature that allows a sender to deliver an eCard to a recipient's mobile number.

• Recipient mobile numbers are entered by the sender (a paying Account Holder) into the eCardWidget send form solely to deliver that eCard. We do not sell, rent, or share these numbers, and we do not use them for our own marketing. SMS consent is never shared with third parties for their own marketing purposes.
• Sender attestation of relationship. Before an SMS can be sent, the sender must affirmatively confirm that the recipient knows them and expects to hear from them. The message cannot be submitted until this attestation is made. We record the sender's identity, IP address, timestamp, and recipient number for each attestation.
• STOP and HELP are honored. A recipient may reply STOP at any time to unsubscribe immediately; opt-outs are enforced across all sender accounts. Reply HELP for support contact information.
• Message and data rates may apply. Message frequency varies by sender activity. Carriers are not liable for delayed or undelivered messages.

SMS delivery is provided through our sub-processor Twilio. For further detail on how SMS consent is obtained and handled, see https://ecardwidget.com/sms-consent.

9.1 Universal Rights

Depending on your location and subject to applicable law, you may have certain rights regarding your personal data, such as the right to access, correct, delete, or object to the processing of your data. To exercise these rights, please contact us using the information provided in the "Contact Us" section below.

We will respond within the timeframe required by the applicable regulation — generally within one month for GDPR requests and within forty-five (45) days for CCPA requests, with the possibility of a one-time extension where permitted by law.

9.2 GDPR-Specific Rights (EEA Residents)

• Right to access your personal data
• Right to rectify inaccurate personal data
• Right to erase your personal data (right to be forgotten)
• Right to restrict processing of your personal data
• Right to data portability (we will provide a copy of your personal data upon request)
• Right to object to processing of your personal data
• Right to lodge a complaint with a supervisory authority

9.3 CCPA-Specific Rights (California Residents)

• Right to know about the personal information we collect, use, and disclose
• Right to request deletion of your personal information
• Right to non-discrimination for exercising your CCPA rights

Please note that eCardWidget does not sell or share personal information for cross-context behavioral advertising. If we ever change this practice, we will provide a clear opt-out mechanism in advance.

9.4 PIPEDA Compliance (Canada)

We comply with the principles of PIPEDA by:

• Consent: Obtained from Account Holders during sign-up and from Directory Members through Account Holders.
• Purpose limitation: Personal information collected solely for the purposes outlined in this Privacy Policy.
• Collection minimization: Only the minimum amount of personal information required to provide the service.
• Safeguards: Technical and organizational measures to ensure security and confidentiality.
• Access and correction: Account Holders can access and update information through the platform; Directory Members, Senders, and Recipients can contact the relevant Account Holder.