Privacy Policy

Who this covers

This policy covers the Slappcard website, the card designer, checkout, the fan pages that cards open, and support. It applies to artists who buy cards, fans who open them, and anyone who visits.

Slappcard is run by Slappcard LLC, a Kentucky limited liability company. Our mailing address is PO Box 582293, Elk Grove, CA 95758. In this policy, "we", "us" and "our" mean Slappcard LLC. This policy takes effect on October 2, 2026.

What we collect and store

Depending on how you use Slappcard, we keep:

• Account details: the name and email address from your sign-in (email, Google or Apple) and your role on the site.
• Designs and uploads: your card designs, artwork, music files and the text you write.
• Orders: what you ordered, the name, delivery address and phone number you give us for shipping, the billing details Stripe passes back, and whether payment went through. Stripe collects your card number. We never see or keep it.
• Fans: the email address a fan gives to unlock a card, a first name (optional on some cards), and a phone number only when the artist chose to ask for one. We also keep whether the fan ticked the box to get news from the artist, and the wording they saw. When a card is first unlocked or claimed we also keep the browser type, to spot abuse.
• Listening: plays, skips and downloads of the tracks on a card. They are kept under a scrambled key made from the fan's email, never the email itself.
• Scans: each visit through a card is counted with the card, the time, whether it came from a QR code or a tap, the name of the website it came from, and campaign tags. Scan counts never carry a fan's email.
• Proofs: when you review a proof, your typed name, your answer, any note you write, and how many times the link was opened.
• Messages: what you send through support, contact, consultation and mailing list forms, including any photo you attach.
• Usage and errors: how the site is used if you accept analytics, and error reports (see Cookies and analytics).

Fan emails and the artist who owns the card

A fan email left through a card goes to the artist who owns that card. It is added to that artist's fan list, where the artist can read it. The artist can export only fans who ticked the box to get news and fans from before the card asked; other fans can be viewed but not exported. It is not sold, and no other artist receives it.

The artist sees every unlock, whether or not the fan ticked the box to get news. When the box is ticked, we record that the fan agreed to hear from that artist. The artist sends that news, not Slappcard. To stop it, the fan can use the artist's own unsubscribe or email us and we will take the address off the artist's list.

Artists decide how to use their fan list and are responsible for using it lawfully. Once an artist exports a list, we cannot control what happens to the copy.

How we use information

We use what we collect to:

• run the site, sign you in and keep your account secure;
• take payment, then print and ship your order;
• show fan pages and deliver downloads to fans;
• send order, account and support emails, and our own mailing list to people who signed up for it;
• count sales and scans, and see how the site is used;
• stop spam, bots and abuse, including unusual patterns of fan sign-ups on a card;
• find and fix errors; and
• meet legal and tax duties.

Who we share it with

We do not sell personal information. We share it with the services that make the site work:

• Clerk: sign-in and accounts.
• Stripe: payments, refunds and tax calculation.
• Resend: sending our emails.
• Convex: the database and file storage where your data and uploads live.
• Vercel: hosting the website, and simple page view counts on the live site that use no cookies.
• Cloudflare: bot checks on our sign-up, mailing list, support and consultation forms, and page view counts if that is switched on.
• Cal.com: booking a consultation call, if you use the booking calendar on our site.
• PostHog: analytics and session recordings in your browser only after you accept, plus the few server events described under Cookies and analytics.
• Sentry: error monitoring.
• AI assistants (Anthropic): our staff use AI tools, such as Claude, that may process customer data to run and support the service.
• Printing and shipping partners: your design and delivery address, so your order can be made and sent.

Other times we share it

Artists receive fan emails as described above. We may also share information when the law requires it, to protect people or the site, or as part of a sale or merger of the business.

Cookies and analytics

Some cookies are needed for the site to work: sign-in and security cookies from Clerk, the bot check from Cloudflare, and our own cookie that keeps a card unlocked on your device. If you arrive through a referral link or enter a referral code, we keep that code in your browser so the right artist gets credit: in a cookie for 30 days, and in this site's browser storage until you clear it.

Analytics cookies and session recordings are off until you press Accept on the banner. Until then PostHog keeps nothing in your browser. If you press Decline, or your browser sends Do Not Track or Global Privacy Control, they stay off and the banner is hidden.

If you accept, PostHog records how pages are used, including clicks and session recordings on public pages. Text on account, cart, checkout, order and design pages is hidden in recordings, and so is any email field. Sentry session replay also starts only after you accept, with all text hidden.

If you accept and you are signed in, PostHog ties that page use to your account number, so it is one person across the site and our server. It never uses your email address or name for this.

Error reports go to Sentry whether or not you accept, so we can fix bugs. We remove email addresses and private links before they are sent.

Our server also sends PostHog a few events, and these do not depend on the banner or on cookies. They are: a checkout started (with the number of lines, a workspace number and whether the buyer was a guest); a checkout expired (with the amount and workspace number); a payment failed (with the decline code and amount); these three are tied to the buyer's account number (a guest's checkout start uses the workspace number); an order paid (with the amount, the number of cards and the order reference, and tied to the buyer's account number when the buyer was signed in); a card unlocked with an email (with the card code); and a card claimed (with the card code, whether the account already owned it, and the account number). They never carry a name or an email address, and we remove email addresses from them before they are sent. We use them to count sales and see where checkout stops.

We may also count page views with Cloudflare Web Analytics, which does not use cookies.

Our own server also counts page views, and whether a visit comes from a person or an automated program, without analytics cookies. It uses a one-way code made from the day, your network address and your browser type that changes every day and is never stored with the address itself, so it cannot follow you from one day to the next. To tell new visitors from returning ones we keep one small cookie, sc_seen, in your browser. It holds only the date of your first visit, lasts 400 days, and identifies no one.

Vercel also counts page views on the live site, with no cookies and nothing stored on your device. Addresses that contain a private link, such as a card, proof, order or claim link, are shortened before they are sent, and the admin area is not counted.

We give each visit a random number that is kept only in the page's memory, never in a cookie or on your device, so page views, events and error reports from the same visit can be matched without knowing who you are.

Your banner choice is kept in your browser. To see the banner again, clear this site's data in your browser settings.

How long we keep information

We do not delete account, order, payment, refund or commission records on a timer. An account is disabled rather than erased, and we keep order, payment and commission records, email send logs and the history of staff actions for as long as we need them for taxes, accounting, disputes and legal duties. A fan's sign-in session ends after 90 days and is then deleted.

An unpaid design that has not been saved to an account is deleted about 48 hours after your last edit, even if you were signed in, along with the files stored only on it. Designs saved to an account are kept; ask us if you want one removed. Other uploads that no design, order or release uses are meant to be cleared about seven days after they arrive, but that cleanup is not switched on yet, so such files may be kept longer until it is. Uploads used by a paid order, a published release or a claimed card are kept.

A fan's email stays on the artist's fan list until the artist or the fan asks for it to be removed.

How we protect it

Connections to the site are encrypted. Links on individual cards use random codes, and the private order and proof links cannot be guessed. Only staff who need customer information to do their job can see it. Order and proof pages use private links, so please do not share them.

No system is perfectly secure. If you think your account was accessed by someone else, tell us right away.

Your choices

You can ask us to show, correct, export or delete the personal information we hold about you. Email contact@slappcard.com or call 1-877-925-1907 and a person will answer. We may need to confirm it is you. When we erase a person, we delete or anonymise their fan, mailing list and support records, and we can disable their account. We keep order and tax records, and the record that an address unsubscribed or bounced so we do not email it again.

Every email from our own mailing list has a one-click unsubscribe link. A fan who no longer wants an artist's news can use the artist's own unsubscribe or ask us to take the email off the artist's list. You can also decline analytics on the banner.

Depending on where you live, for example California or Canada, you may have more rights. We respond to requests as the law requires.

Children

Slappcard is not meant for children under 13, and we do not knowingly collect their information. You must be 18 to place an order. If you think a child gave us information, email us and we will remove it.

Where information is handled

Our service providers may handle information in the United States and in other countries.

Changes to this policy

We may update this policy. The effective date near the top says when the current version took effect, and an update is posted on this page.

Contact

Privacy questions and data requests: email contact@slappcard.com or call 1-877-925-1907. Our mailing address is PO Box 582293, Elk Grove, CA 95758.