Privacy

Who is responsible

HocusPost decides what happens to the personal data described here, which makes us the controller under the GDPR. You can reach us at the address at the bottom of this page.

What we collect

• The photo you upload, and any version of it produced by applying a filter.
• The recipient's name and postal address, your message, and a return address if you add one.
• Your email address, taken from the payment page so we can send a receipt and tell you when the card is posted.
• Addresses you deliberately save to your address book.
• Addresses other people enter themselves, when you share a link asking them to. They go into your address book and are shown to nobody else; you can close the link at any time.
• A random identifier in a cookie, so an anonymous visitor keeps their own cards between page loads.
• A one-way keyed hash of your IP address. We cannot turn it back into an IP address; it exists only to stop one visitor generating unlimited images at our expense.
• Payment details are entered on Stripe's own page. We never see or store your card number.

Why we are allowed to use it

• To print and post your card, and to answer you about it: performing the contract you entered into.
• To stop abuse of the image generator and to keep the service standing up: our legitimate interest in running the shop.
• To keep records a tax authority may ask for: a legal obligation.

Who else sees it

Only the companies that make the product work, and only the part each of them needs. They act on our instructions and may not use your data for their own purposes.

• StripepaymentsEU / US
• Print.oneprinting and posting the cardEU (Netherlands)
• OpenAIapplying the filter to an uploaded photoUS
• Supabasedatabase and image storageEU (Frankfurt)
• Resendsending and receiving emailEU / US
• VercelhostingEU (Frankfurt)

Sending data outside Europe

Applying a filter sends your photo to OpenAI in the United States, and some of our other suppliers operate there too. Those transfers rely on the European Commission's standard contractual clauses. If you would rather your photo never left Europe, do not apply a filter: an uploaded photo you send as it is stays within the EU.

How long we keep it

• Photos you upload, and the pictures filters make from them: three days. A card you never send is deleted with them after three days. A card you ordered keeps only its finished design, which is kept with the order.
• Orders and receipts: seven years, because tax law requires it.
• Address book entries: until you delete them.
• Abuse-prevention hashes: thirty days.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask for it in a portable form. Email us and we will answer within a month. If you think we have handled your data badly you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Cookies

We set two: one that identifies your browser so your cards stay yours before you have an account, and one that keeps you signed in once you do. Both are necessary for the site to work, so neither asks for consent. We measure page views with Vercel Analytics, which counts visits without cookies and without profiling you.