Privacy policy

Who is responsible for your data

The controller of your personal data is CARD ID PRINT S.R.L., registered office: str. Dr. Emil Savini nr. 8, bl. H4, sc. B, et. 3, ap. 1, 700318 Iași, Iași County, Romania; fiscal code (CUI) RO23792333; Trade Register no. J2008001369227. Contact: [email protected], +40 744 427 831.

This policy covers this website, the UltraDesigner app and the orders placed through them.

What data we process

• Account data: your e-mail address and the details you add to your account, and the data needed to keep you signed in.
• Your designs and uploads: texts, logos, pictures, the instructions you give to the AI features and the pictures they create.
• Order data: products, options, quantities, quotes, the delivery name, address and phone number, and billing details.
• Payment status: whether and when an order was paid. Card details go only to the payment processor.
• Messages you send us.
• Technical data that every web request carries: IP address, time, requested address and browser identification, used to deliver the pages and to keep the service secure.

Why we use it and on what legal basis

• To provide the service you ask for: your account, the designer, downloads, printed orders, delivery and support — performance of a contract (art. 6(1)(b) GDPR).
• To keep accounting and tax records of orders and payments — legal obligation (art. 6(1)(c) GDPR).
• To keep the service secure, prevent abuse, apply the limits of free AI use and defend legal claims — our legitimate interest (art. 6(1)(f) GDPR).

We send you e-mails about your account and your orders. We send no marketing messages and run no analytics without your consent (art. 6(1)(a) GDPR). We make no decisions about you based solely on automated processing.

Who receives the data

We do not sell personal data. Only these recipients receive data, and only what they need:

• Cloudflare, Inc. — the network that delivers the website and the app: all traffic passes through it (IP address and request data).
• Replicate, Inc. — image generation: the instruction you give and any picture you send for AI editing.
• Meta (api.meta.ai) — text AI: the text you type to the AI assistant.
• The payment processor — card payments; it handles your card details directly.
• The courier chosen for the order — the delivery name, address and phone number of a printed order.
• Public authorities, when the law requires it.

The website, the app and your data are hosted on our own server in Romania.

Transfers outside the European Economic Area

Cloudflare, Replicate and Meta are companies based in the United States, so data sent to them may be transferred outside the EEA. Such transfers rely on the EU-US Data Privacy Framework, where the provider is certified under it, or on the European Commission standard contractual clauses.

How long we keep it

• Account data, designs and uploads: as long as you keep your account. You can delete projects and uploads at any time in the app.
• When you delete your account, your personal data is erased; an anonymised record of past orders, without personal data, is kept.
• Accounting documents (invoices and supporting documents of payments): for the period set by the accounting law, Legea contabilității nr. 82/1991 — 5 years for supporting documents.
• Work done without an account stays only in your browser until you delete it or clear the site data.
• Messages you send us: as long as needed to answer them and to handle the related order.

Your rights

Under the GDPR you have the right to:

• access your data and receive a copy of it;
• have inaccurate data rectified;
• have your data erased;
• restrict the processing;
• data portability;
• object to processing based on our legitimate interest;
• withdraw a consent at any time, without affecting what was done before;
• lodge a complaint with the Romanian data protection authority, ANSPDCP: B-dul G-ral Gheorghe Magheru nr. 28-30, sector 1, București, www.dataprotection.ro.

How to use your rights

You can delete projects, uploads and your account in the app. For any other request, write to [email protected]. We answer within one month; we may ask you to confirm that the request comes from you.

Security

The website and the app are served over an encrypted connection (HTTPS). Payment card details never reach our servers. Signing out ends your session on that browser.

Cookies and browser storage

What the website and the app keep in your browser is described in the cookie policy.