Privacy notice
Your data, kept simple.
This notice explains what CardSoul collects, why, and your rights under Malaysia’s Personal Data Protection Act 2010 (PDPA).
What we collect
- Waitlist: your email, the Soul you chose, and when you agreed to be emailed.
- Account: your email, optional name, and your password stored only as a secure scrambled code (we can’t read it).
- Saved designs: the card photo you upload in Soul Studio, a small preview image, and your design settings.
- Custom Soul briefs: your email, the details you write, and — if you add one — a shrunk copy of your card photo and preview.
- Orders: your email, name, phone, delivery address and what you bought. Card payments are handled by Stripe; we never see or store your card number.
- Security: a one-way scrambled code made from your internet address, used only to stop spam and abuse. We never store the address itself.
If you only try a card in Soul Studio without saving or sending, the photo stays in your browser and never reaches us.
Why we use it
To run your account, design your custom Soul, deliver your order, and email you about the Soul you chose. We don’t sell your data or share it for advertising.
Cookies
We use one essential cookie to keep you signed in. No advertising or tracking cookies.
Who helps us
Our hosting and database (Vercel, Neon), payments (Stripe) and email delivery (Resend). They may store data outside Malaysia and only process it to provide their service to us.
How long we keep it
Until you delete your account or ask us to remove it. Order records may be kept longer where the law requires them for tax and accounting.
Your choices
You can delete your account and its data any time from your account page. You can also ask to see, correct or delete your data, or stop emails. Our contact email will be listed here shortly.
Last updated: October 2026.