Privacy Policy

1.1 Universal Sections

This Privacy Policy applies to all users of the eCardWidget platform, regardless of their location. The following sections outline our general practices for collecting, using, and protecting personal data.

1.2 Regional Specifications

In addition to the universal sections, this Privacy Policy includes specific clauses that address regional data protection requirements, such as:

• GDPR-specific rights (e.g., data portability)
• CCPA-specific disclosures
• PIPEDA compliance (e.g., accuracy and individual access)

2.1 Account Holders (Data Controllers)

Account Holders are the primary users of the eCardWidget platform and are considered data controllers. As an Account Holder, you are responsible for:

• Determining the purposes and means of processing personal data collected through your use of the platform
• Configuring and using the eCardWidget software in accordance with your own data processing instructions
• Managing your account, creating, and customizing eCards
• Obtaining consent from Directory Members and ensuring the accuracy, lawfulness, and compliance of the personal data you collect
• Responding to data subject requests and ensuring compliance with applicable data protection laws
• Indemnifying eCardWidget for any claims, damages, or losses arising from your misuse of the platform

2.2 eCardWidget (Data Processor)

eCardWidget acts as a data processor on behalf of Account Holders. Our responsibilities include:

• Providing a self-service platform for Account Holders to configure and use
• Implementing appropriate technical and organizational measures to ensure the security of personal data
• Assisting Account Holders in fulfilling their obligations by providing necessary tools and functionalities
• Notifying Account Holders of any data breaches or security incidents, generally within 72 hours of confirmation in line with applicable law

2.3 Directory Members

Directory Members, also referred to as Employees, Team Members, or other roles depending on the Account Holder's use-case, are individuals added to an Account Holder's directory. They can be selected as recipients for eCards sent through the platform. Account Holders are responsible for obtaining consent from Directory Members and ensuring the accuracy of their personal data.

2.4 Senders

Senders are individuals who use the eCardWidget platform to send eCards. They may be Account Holders, Directory Members, or anyone with access to the eCard form. Senders provide their personal information, such as name and email address, when sending an eCard.

2.5 Recipients

Recipients are individuals who receive eCards sent through the eCardWidget platform. Their personal data, such as name and email address, is provided by the Sender. Recipients can block future eCards from an Account Holder via a link in the email they received.

3.1 Account Holder Data

We collect the following information from Account Holders: name, email address, password, organization details, IP address, billing information, and potentially other data via their own custom fields.

3.2 Directory Member Data

We collect the following information about Directory Members: names, work email addresses, job-related details (such as position, department, employee ID, and manager), hire date / work anniversary, birth month and day (we do not store the birth year), optional profile images, optional custom dates, and any additional custom field data defined by the Account Holder.

3.3 Sender Data

We collect the following information from Senders: name, email address, IP address, optionally billing information for paid eCards, and any additional custom field data defined by the Account Holder.

3.4 Recipient Data

We collect the following information about Recipients: names, email addresses, and any additional information provided by the Sender in the eCard.

3.5 Usage Data

We collect information about how and when Account Holders, Directory Members, and Senders use the eCardWidget platform, including IP addresses, browser types, operating systems, and actions taken within the application. This data helps us improve our services and maintain the security of the platform.

3.6 Health Information

eCardWidget is not intended to collect or store health-related data, including PHI. Please do not submit medical or clinical information through the platform.

3.7 Demo and Contact Requests

When you request a demo or contact us through a form on our website, we collect the details you enter (name, work email, company, organization type, team size, area of interest, and any comments) together with technical context that helps us respond appropriately (your IP address and approximate location, browser language, time zone, and the page you came from). We use this information to schedule and prepare the demo, to follow up on your request, and to understand which pages lead to demo requests. Our legal basis is taking steps at your request before entering into a contract (GDPR Article 6(1)(b)) and our legitimate interest in responding to business enquiries (Article 6(1)(f)). Requests are delivered to our team by email through SMTP2GO and retained for as long as needed to handle the enquiry and any resulting relationship. Scheduling is handled by Calendly, which loads only after you submit the form and processes the name and email you provided to book the meeting. If you have accepted marketing cookies, a hashed (one-way encoded) version of your email may be shared with Google to measure which advertisements led to a demo request; it is never shared in readable form and is not used when you have declined marketing cookies.

Email List Opt-In

By creating an account, Account Holders agree to be added to our email list for promotional and informational purposes. You can unsubscribe via the link in the email or by contacting us. Directory Members, Senders, and Recipients do not receive promotional emails.

Artificial Intelligence and Machine Learning

Personal data submitted through the core eCardWidget platform (such as eCard content, recipient lists, and account data) is not used to train artificial intelligence or machine learning models. Customer support interactions conducted through AI-assisted support tools provided by our customer support sub-processor are processed by those tools as part of their normal operation; those interactions are governed by that sub-processor's privacy policy.

SMS / Text Messaging (Optional Feature)

eCardWidget offers an optional SMS delivery feature that allows a sender to deliver an eCard to a recipient's mobile number.

• Recipient mobile numbers are entered by the sender (a paying Account Holder) into the eCardWidget send form solely to deliver that eCard. We do not sell, rent, or share these numbers, and we do not use them for our own marketing. SMS consent is never shared with third parties for their own marketing purposes.
• Sender attestation of relationship. Before an SMS can be sent, the sender must affirmatively confirm that the recipient knows them and expects to hear from them. The message cannot be submitted until this attestation is made. We record the sender's identity, IP address, timestamp, and recipient number for each attestation.
• STOP and HELP are honored. A recipient may reply STOP at any time to unsubscribe immediately; opt-outs are enforced across all sender accounts. Reply HELP for support contact information.
• Message and data rates may apply. Message frequency varies by sender activity. Carriers are not liable for delayed or undelivered messages.

SMS delivery is provided through our sub-processor Twilio. For further detail on how SMS consent is obtained and handled, see https://ecardwidget.com/sms-consent.

9.1 Universal Rights

Depending on your location and subject to applicable law, you may have certain rights regarding your personal data, such as the right to access, correct, delete, or object to the processing of your data. To exercise these rights, please contact us using the information provided in the "Contact Us" section below.

We will respond within the timeframe required by the applicable regulation — generally within one month for GDPR requests and within forty-five (45) days for CCPA requests, with the possibility of a one-time extension where permitted by law.

9.2 GDPR-Specific Rights (EEA Residents)

• Right to access your personal data
• Right to rectify inaccurate personal data
• Right to erase your personal data (right to be forgotten)
• Right to restrict processing of your personal data
• Right to data portability (we will provide a copy of your personal data upon request)
• Right to object to processing of your personal data
• Right to lodge a complaint with a supervisory authority

9.3 CCPA-Specific Rights (California Residents)

• Right to know about the personal information we collect, use, and disclose
• Right to request deletion of your personal information
• Right to non-discrimination for exercising your CCPA rights

Please note that eCardWidget does not sell or share personal information for cross-context behavioral advertising. If we ever change this practice, we will provide a clear opt-out mechanism in advance.

9.4 PIPEDA Compliance (Canada)

We comply with the principles of PIPEDA by:

• Consent: Obtained from Account Holders during sign-up and from Directory Members through Account Holders.
• Purpose limitation: Personal information collected solely for the purposes outlined in this Privacy Policy.
• Collection minimization: Only the minimum amount of personal information required to provide the service.
• Safeguards: Technical and organizational measures to ensure security and confidentiality.
• Access and correction: Account Holders can access and update information through the platform; Directory Members, Senders, and Recipients can contact the relevant Account Holder.