Legal
Privacy Policy
This policy explains what CardCraft collects, why we collect it, who we share it with, and the rights you have under Indian law, including the Digital Personal Data Protection Act, 2023.
Last updated 8 September 2026
Who we are
CardCraft is the invitation service at cardcraft.date. For privacy questions or grievances, write to hello@cardcraft.date.
What we collect
When you check out: a required recovery email and an optional phone number. An account is optional; if you create one, we store your name, email, and a hashed password.
When you build an invitation: names of the couple, host line, ceremony titles, dates, times, venues, addresses, and notes. These stay in your browser until you pay; after checkout they are stored with your order.
When you pay: order amount, currency, Razorpay order and payment identifiers, payment status, and timestamps. Card numbers are handled by Razorpay, not by CardCraft.
When you use the site: a 24-hour, order-scoped HttpOnly cookie after email-code verification, an optional account session cookie, and technical logs such as time, path, and error messages. Guest pages do not require an account.
How we use it
We use this information to take payment, publish and update the guest page and social preview, recover the order by email, prevent abuse, and reply when you write to us. We do not sell personal information or use guest-invitation content for advertising.
We also keep an internal record of how the invitation-builder is used — for example, which design was chosen, which ceremonies were added, and the content of fields as they are completed — to understand and improve the product. This record is not shared with anyone and is not used for advertising.
Guest invitations
The public guest page shows the names, ceremonies, dates, and venues you entered. It is available to anyone with the link. Do not put information on the invitation that you do not want a guest, or someone who receives the link, to see.
How long we keep it
Account and order records stay until you ask us to delete them, or until we close an unused account. Payment identifiers may be kept as long as tax and dispute rules require. Expired verification codes and email delivery records are retained only as needed for security and support. Our internal record of invitation-builder activity for a given order is deleted together with that order when you ask us to delete your data. After deletion or a full refund, the guest page and social image stop being served.
Your card, its photos, guest replies and the builder activity behind it are deleted 30 days after your last ceremony. We email you a week before that happens.
Security
Passwords are hashed. Management codes expire after 10 minutes, allow five attempts, work once, and create a 24-hour order-scoped session. Guest links are unlisted and marked not to be indexed. No website is perfectly secure; share the guest URL only with people you intend to invite.
Your rights
You may ask to access, correct, or erase personal data we hold about you, or to withdraw consent where we rely on it. Use Your orders to see your purchases, or send a request from the deletion page. We may need to confirm it is you. Razorpay and banks may still hold payment records we cannot erase.
Children
CardCraft is for adults arranging a wedding. We do not knowingly create accounts for children under 18.
Changes
We will update this page when our practices change. The date at the top is the current version.
Contact
Privacy and deletion: hello@cardcraft.date, or the deletion page.