Privacy notice

Who we are

Tappy Birthday is a trading name of Bradley Liston-Head, a sole trader based at 38 Crofters Lane, Sutton Coldfield B75 5UJ. We're responsible for your personal data (the "controller"). Questions about it: hello@tappybirthday.co.uk.

What we collect and why

• Your order: your name, email address and phone number (if you give it), plus what you tell us about the birthday person and everyone in the card. We need this to make and deliver your card, which is our contract with you.
• Photos you send: you upload them on our website after paying, or email them to us. We use them to draw the cartoons. Same reason: the contract. Photos shrunk by the upload page lose their hidden details, such as where they were taken.
• Payment: Stripe takes your payment. We see who paid, how much and when, but never your full card number.
• Emails: if you email us, we use what you send to reply. That's in our legitimate interest, and yours.
• Records: we keep order and payment records because tax law says we have to.

The people in your card aren't part of our contract with you, so for their names, photos and details we rely on our legitimate interest in making the card you've ordered for them. We get their details from you, not from them, and use them only to make the card they're in. Cards often include children, so we're especially careful with those.

No decisions about you are made by automated means.

Your card

Your card lives at a private link. It isn't listed anywhere on our website, and we ask search engines not to index it, but anyone you give the link to can open it, and they could pass it on. It shows cartoons, names and the words you gave us. It never shows your photos.

Who we share it with

Only the companies that help us run Tappy Birthday:

• Stripe, which takes payments.
• Netlify, which hosts this website and your card, and stores the photos and brief you upload until they're deleted.
• Our email provider, which stores the emails you send us, including any photos.
• Anthropic, maker of the AI tool Claude, which helps us build cards. We share your brief and photos with it only to make your card, and we've switched off the setting that lets Anthropic use our chats to improve its models.

Stripe, Netlify and Anthropic are based in the US, so your data may be processed there. When it is, it's covered by the protections UK law requires for sending data abroad, such as the UK-US data bridge or standard contract clauses. Ask us if you'd like the details. We don't sell your data, and we don't use it for advertising.

How long we keep it

• Photos and briefs you upload: deleted automatically 30 days after you upload them.
• Photos you email, and any copies we make while drawing your card: deleted within 30 days of delivering your card.
• Your card: online for at least 12 months from delivery. Ask and we'll take it down sooner.
• Order and payment records: as long as HMRC requires, which is at least 5 years after the 31 January tax return deadline for that year.
• Other emails: deleted once we no longer need them, and within 2 years.

Cookies and storage

We don't use advertising or analytics cookies. The order page saves your answers in your browser's storage, so you don't lose them, and so the thanks page can show your order and how many photos you've sent. It stays on your device and we can't see it. Clearing your browser's data for this site removes it. Stripe's checkout page uses its own cookies, which Stripe's privacy policy explains.

Your rights

You can ask us for a copy of your data, and ask us to correct it, delete it, limit how we use it or move it somewhere else. You can also object to how we use it. Email hello@tappybirthday.co.uk and we'll reply within one month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. We'd rather you told us first, so we can try to put it right.