Privacy Policy

The data controller within the meaning of the General Data Protection Regulation (GDPR) is: Bryan Tüscher databryan, trading as KeepsakeDeck In den Herrengärten 15 35510 Butzbach Germany Email: hello@keepsakedeck.com We have not appointed a Data Protection Officer; we are not subject to a statutory obligation to do so under § 38 German Federal Data Protection Act (BDSG). Please direct requests under Articles 15–22 GDPR to the email address above. This is an English translation for information purposes. The German version is authoritative; German law applies.

We operate a platform for personalized playing-card decks at keepsakedeck.com. This policy explains what personal data we collect, for which purposes, on what legal basis, to whom we disclose it and what rights you have. Particular notice: To create personalized cards we process uploaded photos using AI services (Google Gemini, Microsoft Azure Face API and Azure OpenAI). Image generation by Google may take place in the USA. See sections 5 and 6 for details.

Depending on how you use the service, we process the following categories of personal data: • Contact data: email address (waitlist, order confirmation, pre-order); optionally name and phone for B2B enquiries. • Order and payment data: order number, billing address, shipping address, amount, payment status. Card details are processed exclusively by our payment provider Stripe; we do not see or store complete card or bank data. • Product data: photos you upload for personalization, and any text or layout input (e.g. names to be printed on the cards). • Communication data: contents of emails and support tickets. • Technical data: IP address, user-agent, referrer, timestamps, device and browser information, requested URL, error logs. • Consent data: your consent choices and timestamps (cookie/consent banner).

We process the data listed above for the following purposes and on the following legal bases: • Pre-contractual steps and performance of the contract (waitlist signup, pre-order, order fulfilment, production, shipping, invoicing, support): Art. 6(1)(b) GDPR. • Legal obligations (commercial and tax retention, bookkeeping, defence against legal claims): Art. 6(1)(c) GDPR. • Legitimate interests (abuse and fraud prevention, platform stability and security, product improvement, assertion of legal claims): Art. 6(1)(f) GDPR. • Consent (optional analytics and error-tracking services, marketing newsletter via double opt-in, explicit consent to the AI-assisted processing of your photos – face localization and generation of the card artwork – given via a separate checkbox before card creation starts): Art. 6(1)(a) GDPR; as a precaution Art. 9(2)(a) GDPR insofar as facial images are regarded as biometric data. • Non-essential cookies and comparable storage technologies only with your consent: § 25(1) German Telecommunications-Digital-Services Data Protection Act (TDDDG) in conjunction with Art. 6(1)(a) GDPR.

When you configure a personalized deck, you upload photos from which we create card artwork. We use Google's Gemini API (processing also in the USA) and Microsoft Azure services (West Europe region, Netherlands) for this. Before card creation starts we obtain your explicit consent to this processing via a separate checkbox; you can withdraw it at any time with effect for the future (email to hello@keepsakedeck.com or an erasure request via /en/datenschutz/anfrage).

5.1 Face detection on your device

On the photo step, our site finds the faces in your photos directly on your device, in your browser. Your browser loads the detection model (MediaPipe BlazeFace) from our own server; your photos do not leave your device for this. For a group photo, your browser cuts out one crop per face. Nothing is uploaded until you start card creation on the consent step, and then only the photos or crops you assigned to the figures. Faces and photos you do not assign to a figure stay on your device. If we cannot start card creation after that (for example because of a daily limit), the photos already uploaded stay stored until they are deleted automatically after 7 days at the latest. Azure Face API (older parts of the configurator only): The Azure Face API is used only for face localization. Technically, we call the service with the parameters `returnFaceId=false` and the detection model `detection_03`. The service returns only rectangle coordinates (`faceRectangle`) indicating where a face is located in the image. No biometric template, no FaceID and no persistent identifier is created or stored at Azure. The image transits Azure West Europe solely for this localization. Legal basis: Art. 6(1)(b) GDPR (performance of the contract: producing the ordered deck) and your explicit consent (Art. 6(1)(a) GDPR, as a precaution Art. 9(2)(a) GDPR), which we obtain via a separate checkbox because the legal classification of facial images sits at the border of biometric data. In fact, no biometric templates are generated on our side. Group photo in the earlier version of the photo step: if you use "Upload a group photo" there, we send the chosen photo to Azure West Europe for face localization right there, i.e. before the consent step. We say so immediately before you choose the photo. We do not store this photo; only the face crops come back, and until you confirm them they stay in your browser only. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). No identification takes place, so in our assessment Art. 9 GDPR does not apply. Further processing to create the cards only happens after your consent in the consent step.

5.2 Image generation via Google Gemini and Azure OpenAI

To generate the court cards (King, Queen, Jack, Joker) we transmit your photos or the face crops located in them together with a prompt and style references to Google's Gemini API (Google LLC, USA; EU contracting entity: Google Ireland Ltd.). Under the paid API Google processes these contents solely to provide the service and does not use them to train its models; processing may take place on servers in the USA (third-country transfer based on the EU-U.S. Data Privacy Framework and standard contractual clauses, see section 6). For image analysis (e.g. pet detection) we use Azure OpenAI (`gpt-4o`) in the West Europe region; Microsoft does not use your content for training. Number cards and aces contain no personal data and are produced without AI. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and your consent under section 5.1.

5.3 Automated decision-making (Art. 13(2)(f), Art. 22 GDPR)

The card artwork is generated automatically from your uploads and your inputs. This automated processing does not produce any decision with legal effect and has no similarly significant impact on you within the meaning of Art. 22(1) GDPR. It merely produces the graphical output of the service you ordered. You review each figure before ordering and can reject it or have it regenerated.

To deliver our services we engage the following providers as processors (Art. 28 GDPR) or as independent controllers. For all EU-US transfers we rely on standard contractual clauses under Art. 46(2)(c) GDPR in combination with the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023), where the provider is self-certified.

We only store personal data for as long as necessary for the respective purpose or as required by statutory retention obligations. • Waitlist entries: until you unsubscribe (link in every email) or for 24 months after last interaction. • Order and invoice data: for the duration of contract performance and afterwards pursuant to § 147 German Fiscal Code / § 257 German Commercial Code (eight years for invoices and accounting records, ten years for books and records). • Deck sessions: 48 hours from creation (30 days if you expressly choose so); decks that were not ordered and their records are deleted afterwards by a cleanup job. • Uploaded original photos: processed only during card creation and deleted automatically no later than 7 days after upload (storage lifecycle rule); after successful payment confirmation we delete them immediately. Temporary access links (SAS URLs) are limited to 24 hours. • Generated card artwork of an ordered deck: for the deck view, complaints and reorders for up to 24 months after the order; on request we delete it earlier (section 9). Intermediate generation artefacts are deleted automatically after 90 days. • Technical logs (Sentry, Vercel): 30 days for error events at Sentry, 90 days for request logs at Vercel. • Consent choices: until you withdraw; afterwards for up to three years for accountability purposes (Art. 5(2) GDPR). Longer retention is possible if necessary to establish, exercise or defend legal claims (Art. 17(3)(e) GDPR).

We use cookies and comparable storage technologies. Non-essential cookies are only set after your consent (§ 25(1) TDDDG). You can change your choices at any time via 'Cookie settings' in the footer.

8.1 Essential

These services are required for operation and are used without consent: Stripe (payment security), Cloudflare Turnstile (abuse protection) and the application's session management. Legal basis: Art. 6(1)(f) GDPR and § 25(2) no. 2 TDDDG (strict necessity).

8.2 Analytics & error tracking (opt-in)

Only after your explicit consent do we load PostHog (product analytics) and Sentry (error tracking). Without your consent these services are not loaded and no corresponding cookies are set. Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG.

8.3 Marketing (currently inactive)

This category is reserved for future campaign tools. No marketing services are loaded today. Should we enable any in the future, they will only run after your prior consent.

Under the GDPR you have the following rights. An informal email to hello@keepsakedeck.com is sufficient to exercise them. Please identify yourself clearly so that we do not disclose data to unauthorized persons. Depicted persons who did not order a deck themselves may also contact this address (right to one's own image, § 22 German Art Copyright Act).

• Access (Art. 15 GDPR): you may request information about the personal data we process about you.
• Rectification (Art. 16 GDPR): you may request correction of inaccurate data or completion of incomplete data.
• Erasure (Art. 17 GDPR): you may request deletion of your data to the extent statutory conditions are met and no retention obligations apply.
• Restriction of processing (Art. 18 GDPR): you may request that processing be restricted.
• Data portability (Art. 20 GDPR): you may request to receive the data you provided in a structured, commonly used, machine-readable format.
• Objection (Art. 21 GDPR): you may at any time object to processing based on Art. 6(1)(f) GDPR, in particular to direct marketing.
• No solely automated decision (Art. 22 GDPR): no automated decision with legal effect or similarly significant impact takes place (see section 5.3).
• Right to lodge a complaint (Art. 77 GDPR): you may lodge a complaint with a supervisory authority at any time, in Germany with the state authority competent for your place of residence or with the Hessian Commissioner for Data Protection and Freedom of Information (Postfach 3163, 65021 Wiesbaden).

You may withdraw a given consent at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out prior to withdrawal remains unaffected.

You can also request access or erasure directly via our form.

Our service is directed at persons aged 18 and above. We do not knowingly process data of persons under 16 without the consent of the holders of parental responsibility (Art. 8 GDPR). When uploading photos showing minors, by accepting our Terms you warrant that you have obtained the required consent from the holders of parental responsibility (see Terms & Conditions).

We apply technical and organizational measures pursuant to Art. 32 GDPR, in particular TLS encryption in transit, encrypted storage of sensitive data, access controls, least-privilege access to photo uploads, audit logs and regular reviews of our processors.

We adjust this privacy policy when processing activities change or new legal requirements apply. The version indicated above ('Last updated') is authoritative. We will inform you of material changes in good time by email or via a notice on the platform.