Privacy Policy

1. Who we are

TouchCard is operated by TouchCard GbR, based in Hamburg, Germany. We sell personalised Braille birthday cards online and ship across Europe.

Contact: hello@touchcard.com

2. What data we collect

We collect the minimum data needed to fulfil your order and improve our service:

• Order data: Your name, recipient's name, delivery address, email address, and your card message.
• Newsletter: Your email address if you opt in to receive notifications about new card designs.
• Analytics: Anonymous page visit data via Cloudflare Web Analytics (no cookies, no personal data, no tracking across sites).
• Cookie preference: Your accept/decline choice is stored locally in your browser (localStorage).

3. How we use your data

• To produce and ship your Braille card.
• To send order confirmation and dispatch notifications by email.
• To send occasional newsletter emails about new designs (only if you subscribed — you can unsubscribe at any time).
• To understand how visitors use our website (aggregate, anonymous analytics only).

4. Who we share data with

We do not sell your data. We share data only with:

• Postal services: Delivery address to ship your card.
• Payment providers: Stripe (when enabled) processes payment details — we never see or store your card number.
• Cloudflare: Hosts our website and provides anonymous analytics.

5. How long we keep data

• Order data: Retained for 2 years for customer service and legal compliance, then deleted.
• Newsletter emails: Until you unsubscribe.
• Analytics: Aggregated, anonymous — no personal data stored.

6. Your rights (GDPR)

Under EU data protection law, you have the right to:

• Access — request a copy of your personal data.
• Correction — ask us to fix inaccurate data.
• Deletion — ask us to delete your data ("right to be forgotten").
• Portability — receive your data in a machine-readable format.
• Withdraw consent — unsubscribe from newsletter or withdraw cookie consent at any time.

To exercise any of these rights, email hello@touchcard.com. We'll respond within 30 days.

7. Cookies

We use no third-party tracking cookies. The only data stored in your browser is:

• Your cookie consent preference (localStorage).
• Newsletter subscription data if the backend is unavailable (localStorage fallback).

Cloudflare Web Analytics does not use cookies and does not track individual users.

8. Security

Our website is served over HTTPS via Cloudflare. Payment processing (when enabled) is handled by Stripe, which is PCI DSS Level 1 certified. We never store credit card details on our servers.

9. Changes to this policy

If we make significant changes to this policy, we'll update the date below and, where appropriate, notify existing customers by email.

Last updated: May 2026