Privacy Policy

Last updated: July 2026

Salutations ("we", "us", "our") operates the website salutations.app. This policy explains what personal data we collect, why we collect it, and your rights under the UK GDPR and EU GDPR.

The data controller is Salutations. For any privacy-related queries, contact us at privacy@salutations.app.

1. What data we collect and why

Board owners

• Email address — collected when you create a board. Used to send you a verification link, your admin URL, unlock codes, renewal reminders, and expiry notices. Legal basis: contract (providing the service you requested).
• Payment information — if you pay to unlock a board, payment is processed by Stripe. We receive only a confirmation and your email address. We do not store card details. Legal basis: contract.

Card contributors (people who post to a board)

• Name — the display name you enter on your card. Shown on the board.
• Message — the text you write. Shown on the board.
• Photo or video (optional) — uploaded and stored if you choose to attach one. Shown on the board.
• Approximate posting time — a timestamp recorded when your card is submitted.

Legal basis for processing contributor data: legitimate interests of the board owner in collecting messages for the intended recipient, and your consent given by choosing to submit a card.

All visitors

• Access logs — Cloudflare, our infrastructure provider, may log standard web request metadata (IP address, user agent, request path, timestamp) for security and performance purposes. We do not use these logs for profiling. See Cloudflare's privacy policy.

2. Cookies and local storage

We use a small number of functional cookies. We do not use advertising or tracking cookies.

• mb_auth_<boardId> — stores a hashed token if you have entered a board password. Allows you to re-visit a password-protected board without re-entering the password. Expires after one year.
• mb_card_<cardId> — stores a delete token set when you post a card. Allows you to edit or delete your own card without being the board owner. Expires after one year.

These cookies are strictly necessary for the service to function as intended and do not require consent under the UK PECR / EU ePrivacy Directive.

3. How long we keep your data

• Board data (owner email, board settings, cards, photos) — retained for as long as the board exists. Free boards are locked after 14 days and permanently deleted 30 days after locking. Paid boards that expire and are not renewed are locked and deleted on the same schedule.
• Payment records — Stripe retains payment records in accordance with their own retention policy and applicable law.
• Infrastructure logs — retained by Cloudflare per their own policy (typically a few days for standard logs).

4. Who we share data with

We do not sell personal data. We share data only with the following service providers, who process it on our behalf:

• Cloudflare — hosting, content delivery, and DDoS protection (US, with EU data transfer safeguards). Privacy policy.
• Stripe — payment processing (US, with EU Standard Contractual Clauses). Privacy policy.
• Resend — transactional email delivery (US). Privacy policy.

5. International transfers

Our service providers are based in the United States. Transfers of personal data outside the UK/EEA are made under appropriate safeguards — UK International Data Transfer Agreements (IDTAs) or EU Standard Contractual Clauses — as required by applicable law.

6. Your rights

Under UK and EU GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data ("right to be forgotten").
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email privacy@salutations.app. We will respond within one month.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or, if you are in the EU, with your local supervisory authority.

7. Security

We use industry-standard measures to protect your data, including HTTPS encryption in transit and access controls on our storage. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

8. Children

Salutations is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has submitted data through our service, please contact us at privacy@salutations.app and we will delete it promptly.

9. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page will reflect any changes. Continued use of the service after changes are posted constitutes acceptance of the updated policy.

10. Contact

For any questions about this policy or how we handle your data, contact us at privacy@salutations.app.

---

Salutations — Celebrate Someone  ·  Quick Start  ·  FAQ  ·  Privacy  ·  Terms