Privacy policy
Last updated: 1 October 2026
1. Who we are
Tavern Creative Limited, trading as Vibe Card, is the data controller for the personal information described in this policy. Our legal details and ICO registration are in section 13.
If you have any question about your data, email hello@vibe-card.com.
2. What this policy covers
This policy explains what personal information we collect when you browse, buy from, or sell through vibe-card.com, why we collect it, who we share it with, how long we keep it, and what rights you have.
It also covers people who have never used the site: if someone has sent you a card through Vibe Card, section 8 is for you.
3. Information we collect about you
When you browse
We count page views with Vercel Web Analytics. It sets no cookie and uses no identifier that follows you between websites: a visit is told apart by a hash of the request that Vercel discards after 24 hours, and what is kept is the page, the page you came from, your country and city, and your browser and device type, as aggregate figures. We use no advertising pixels or tracking cookies. Nothing on this site follows you between websites, and nothing builds a profile of you.
What we do set falls into three groups. Cookies that keep you signed in and that protect the sign-in form itself. A cookie that remembers you closed a notice, so the same message does not reappear on every page. And storage in your own browser holding your basket and a few small preferences, such as whether you collapsed a panel. That storage stays on your device, and we read your basket only when you send it to us by going to the checkout.
Our hosting provider records the IP address of each request in its platform logs, as every web host does.
If you use the search box, what you type is stored so we can improve search results. Search queries are not linked to your account. Please do not type personal information into the search box; it is designed for finding cards.
When you open a card's page, we record that the card was viewed and when, so we can see which cards are looked at. That record is not linked to you or to your account.
When you create an account
Your email address, your name, and a password we store only as a one-way hash. If you sign in with Google, we receive your name, email and profile picture from Google, and we store the sign-in tokens Google issues so you can stay signed in.
Your preferences: theme, whether you want to see adult-humour cards, and which of our optional emails you want.
Optional emails. There are two kinds, tips (getting the most out of Vibe Card) and news (new designs, latest releases and offers). Neither is sent unless you turn it on, when you first sign in or in your account settings, and both start off. When you turn one on we record the date and time, which screen you used and the version of the wording you saw, so we can show that you chose it. Turning one off stops it at once; the record of when you turned it on is kept. Emails about your orders and your account are not optional: they are the record of what you bought and of your account, and they are sent to everyone.
If you tell us your date of birth so that we can show you adult-humour cards, the stored item is the date you turn 18, worked out from the date of birth you give us. We do not keep the date of birth. The date is used only to decide whether adult humour is shown to you.
When you buy
Your delivery address or addresses, if you save them. The email address you gave at payment. What you bought, what you paid, and the delivery service you chose. Whether you earned or used a 10 Club loyalty stamp.
Your card payment details never reach us. Payment is taken by Stripe on Stripe's own page, and we receive only a confirmation and a reference.
About the person you are sending to
To post a card we need the recipient's name and address. If you write a message for the inside of the card, we store that too, because we print it. If you save the recipient to your address book, or add their birthday so we can remind you, we keep those details until you remove them or close your account.
Section 8 explains how we treat information about people who are not our customers.
When you sell through Vibe Card as a creator
Your display name, biography, contact details, links, example images, commission rate, and any messages between you and us. Your artwork and the notes you write about it. Section 5 explains how artwork is processed.
When you ask for a card we do not have
If you describe a card you could not find, we keep what you wrote and any detail you add later. The description is tidied and turned into search terms by OpenAI (section 5), so we can match it against new cards.
You do not need an account. Every request is kept and shown to card designers in the tidied, anonymous form described below as soon as you make it, whether you leave an email address or not.
If you are not signed in, you may leave an email address, and leaving it is how you ask us to email you when a card like it arrives: the form says so beside the field. We record when you gave it and the version of that wording, and send one email to the address with a link. The address is used for nothing else: until the link is clicked, that email is the only one ever sent to it. The click is our record that the address is yours and that you asked, and it turns on the emails about cards like it. If the link is not clicked within 7 days, we remove the address from the request; the request stays, with nothing that says who made it. If you later sign in with the same address, your requests join your account. If you leave no address, we keep the request the same way and never email anyone about it.
Our card designers see what people are looking for so they can design for it. They see a tidied version of your description, grouped with other people asking for the same kind of card, with no name, email or anything else that identifies you. Please leave names out of what you write. A description that is hateful, targets a person or group, or is sexual is never shown to them.
If you are signed in, we use your account's email address, and you choose whether to be emailed with a box that starts unticked; we record when you ticked it and the version of the wording you saw. Either way, we send at most one email a day about your requests. Every email has a link to stop, and you can stop any request from your account. A request ends 60 days after you made it, and then no more emails are sent about it.
When you leave feedback
If you use the Feedback tab, we keep the face you chose (a score from 1 to 5), the note if you write one, the page you were on, whether you were signed in, the size of your screen and the time. It is not linked to your account, and we keep it for twelve months. Please do not put personal details in the note, such as your name, email address, phone number or anyone's address: we do not need them to read it, and it is not linked to you.
When you contact us or report a problem
What you write, and any photograph you upload. A photograph of a card can show a recipient's address and the message inside, so please crop it to the fault where you can.
4. Why we use it and our lawful basis
| What we do | Basis |
|---|---|
| Take your order, print your card, post it, send you a receipt and updates | Performing our contract with you |
| Keep account, order and payment records | Legal obligation (tax and accounting), and legitimate interest in running the business |
| Post a card to the person you chose | Legitimate interest: fulfilling the order you placed. See section 8 |
| Keep your address book and send birthday reminders | Performing our contract with you, for the features you chose to use |
| Send you the optional tips and news emails | Consent, given by turning each one on, from 19 September 2026. You can withdraw it in your account settings or by clicking unsubscribe in any of those emails, and it stops at once |
| Email you when cards matching your request arrive | Consent: signed in, by ticking the box when you ask or later on the request; without an account, by leaving your email address, confirmed by the link we send. You can withdraw it with the link in any of those emails or from your account, and it stops at once |
| Send one email to confirm the address left on a request made without an account | Legitimate interest in checking the address is yours before any email about cards is sent to it |
| Show card designers what customers are looking for, without who asked | Legitimate interest in having the cards customers want designed |
| Store search queries | Legitimate interest in improving search |
| Keep feedback left on the Feedback tab | Legitimate interest in knowing what people find good or hard about the site |
| Count page views with Vercel Web Analytics | Legitimate interest in knowing which pages are used, with no cookie and no identifier that follows you between websites |
| Detect fraud, abuse and repeated refund claims | Legitimate interest in protecting the business and other customers |
| Review creator applications and pay commission | Performing our contract with the creator |
5. How we use AI
We use OpenAI's services in four ways, and it is worth being precise about what does and does not leave us.
Cataloguing cards. When a creator uploads a design, we send the artwork and the creator's notes about it to OpenAI to generate the listing: title, description, categories and search keywords. Creators agree to this in the Creator Terms.
Search. When you type a search, the text of your query is sent to OpenAI to be converted into a form our search engine can match against cards. This is how "something for my brother who likes football" finds the right card.
Card requests. When you describe a card we do not have, the description is sent to OpenAI to tidy it, to take out anything that identifies a person, to check it is suitable to show our card designers, and to convert it into the same searchable form. Your name and email are not sent with it.
Improving a card message. When you press Improve wording while writing a card, the text of that message is sent to OpenAI to suggest other wording. Nothing else goes with it: not your name, your email address, or the name or address of the person the card is for. Under OpenAI's terms for businesses using its API, it is not used to train OpenAI's models; we have not opted in to that. It is sent only when you press the button, and not otherwise.
What never goes to OpenAI: your name, your email address, any postal address, the name or address of anyone you send a card to, and the message you write inside a card unless you press Improve wording on it. None of that is ever sent to an AI service, unless you type it into a search, a card request or a message you ask us to improve.
6. Who we share your information with
We do not sell your information. We share it with the services we need to run the site:
| Service | What they receive | Where |
|---|---|---|
| Stripe | Your name, email, billing and delivery address, and payment details, to take payment | EU and US |
| Vercel | Hosts the site. Sees every request, including your IP address, and runs our code. Counts page views with Vercel Web Analytics, as described in section 3 | UK edge, US processing |
| Neon | Hosts our database, so everything in section 3 | UK (London) |
| Vercel Blob | Stores card artwork, previews, and any photo you upload with an issue | UK (London) |
| OpenAI | See section 5 | US |
| Google Workspace | Sends our emails. Every email we send passes through Google, including the internal one that tells us to print your order, which contains the recipient's address and your message | EU and US |
| Royal Mail | The recipient's name and address, on the envelope | UK |
Transfers outside the UK are covered by the UK International Data Transfer Agreement or the UK Addendum with each provider.
7. How long we keep it
| Information | Kept for |
|---|---|
| Your account | Until you close it, or after three years without signing in, when we will email you before deleting it |
| Orders and payment records | Six years from the order, for tax and accounting law |
| Recipient names, addresses and inside messages on an order | Twelve months from dispatch, then removed from the order record. The order itself stays, without the recipient details |
| Your saved address book and reminders | Until you remove them or close your account |
| Scheduled sends | Until printed, or until you cancel them |
| Search queries | Twelve months |
| Card page views, not linked to you | Twelve months |
| Issue reports and uploaded photos | Twelve months after the issue is closed |
| Creator artwork | While the design is listed, and for 30 days after it is rejected or withdrawn, then deleted |
| Email sending records | Twelve months |
| Your consent to the optional emails: when, which screen, which wording | While your account exists, so we can show you chose them |
| Card requests, and your choice to be emailed about them | Until you close your account. Card designers stop seeing a request when it ends |
| Card requests made without an account | 30 days after the request ends, unless you sign in with the address you gave first, when they join your account |
| The email address left on a request made without an account | Removed after 7 days if the link we send is never clicked; otherwise kept with the request. The record of the one email we sent to confirm it is kept with our other email sending records |
| Messages you send us through the contact form | Twelve months, then deleted |
| Feedback from the Feedback tab, not linked to your account | Twelve months, then deleted |
8. If someone has sent you a card
If you have received a Vibe Card, the person who sent it gave us your name and address so we could post it, and may have written a message for the inside. You did not give us that information yourself, so this section explains what we hold and what you can do.
What we hold. Your name and postal address, the message written to you, and the date the card was sent. If the sender saved you in their address book, we may also hold your birthday or another date they chose to be reminded of, and any note they made about you. We do not hold your email address or phone number unless the sender wrote it into the message.
Why. To print and post the card, which is the sender's contract with us, and to run the address book and reminder features the sender chose to use. Our lawful basis is legitimate interest.
What we do not do. We do not contact you, market to you, or share your details with anyone except Royal Mail and the services in section 6.
What you can do. Email hello@vibe-card.com with your name and postcode and we will tell you what we hold, correct it, or delete it. We do this by hand, and we will do it within one month. Deleting your details from a sender's address book means they will need to enter them again to send you another card.
9. Your rights
You can ask us to:
- See what we hold about you
- Correct it
- Delete it
- Give you a copy in a usable format
- Stop using it for marketing, or object to other uses
- Restrict what we do with it while a question is resolved
Email hello@vibe-card.com. We handle these requests by hand and will respond within one month. You can close your account from your account settings. Closing it deletes your saved addresses, address book, reminders, saved payment methods, favourites, 10 Club stamps and preferences. Your order records are kept for the period in section 7, because the law requires it, with your account no longer attached to them; a card you have already paid for is still printed and posted. If you have a creator account, that must be closed first. Order records are kept for the period in section 7 because the law requires it, but we remove the recipient details from them on request unless an order is still open.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.
10. Security
Passwords are stored as one-way hashes. Card payment details never touch our systems. All traffic to the site is encrypted. Our database and file storage are encrypted at rest by our providers. Access to order and customer data is limited to the people who need it to fulfil orders.
11. Children
You must be 16 or over to create an account. Some cards contain adult humour. We show them only to customers who have told us they are 18 or over, by giving us their date of birth once; section 3 says what we keep of that. Anyone under 18 does not see them, and cannot turn them on.
12. Changes
We will post changes here and, for anything significant, email account holders. The date at the top shows when this was last changed.
13. Legal details
Vibe Card is a trading name of Tavern Creative Limited, registered in England and Wales, company number 11100975. Registered office: Suite 7 Cobbs Wood House, Ashford, Kent TN23 1EP. VAT number GB302033670. ICO registration ZB110990.
Questions? Ask us, or reply to any email from Vibe Card.