Privacy Policy

Who we are

Petal You is provided by PetalYou LLC, 4539 N 22nd St, Ste R, Phoenix, AZ 85016. Privacy questions and requests: privacy@petalyou.com.

Information Petal You processes

• Account information such as email address, password hash, age confirmation, session and security records. If you sign in with Google or Facebook, we receive your email address from that provider (and, for Facebook, an app-specific account number so we can recognise you next time). We don’t receive your password, friends list or posts, and we never post to Facebook for you.
• Order and payment-status information, including what you ordered, the price, and payment status. Card details are handled by our payment provider (Stripe); Petal You does not receive or store full card numbers.
• Recipient information: recipient email addresses or mobile numbers, optional names, delivery schedule and delivery status.
• Card and invitation content: text, event details, uploaded photos or videos, animation choices, and recipient interactions such as RSVPs and thank-you replies.
• Usage and security data such as timestamps, card views and previews, abuse reports, limited logs and privacy-protected network identifiers used for fraud and abuse prevention.

How information is used

We use information to provide accounts, process purchases and refunds, create and deliver cards and invitations, process media, measure which cards are popular, secure the service, prevent abuse (including automatically checking sender names, messages and invitation notes for links, scams and threats, and enforcing the limit of 5 free sends per month, which uses your order history), provide support, maintain records, and comply with legal obligations. We do not sell personal information, and we do not use recipient contact information for marketing.

Recipients

Recipients do not need a Petal You account. We use a recipient's contact details only to deliver the card or invitation a sender asked us to send. Recipients' RSVPs and thank-you replies are shared with the sender. A recipient who wants their contact details or replies removed can contact us at the privacy email above.

Cookies and browser storage

We use a secure sign-in cookie to keep you logged in. The DIY card editor may save your unfinished draft in your browser so you don't lose it. We do not use advertising cookies, ad pixels or third-party analytics. We count card views, previews and sends ourselves to see which designs are popular; these counts are tied to the card design, not to your identity. Pages load fonts from Google Fonts, which receives your browser's IP address when fonts are loaded.

Do Not Track and Global Privacy Control. We don’t track you across other websites or use your information for targeted advertising, so there is nothing for these browser signals to switch off. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of any sale or sharing of your personal information — which we don’t do in any case.

Emails we send

We send emails needed for the service: card and invitation deliveries, event updates and cancellations, a notice if something you sent couldn’t be delivered, receipts, sign-in and account messages, and notices about RSVPs or thank-you replies. We don’t send marketing emails unless you choose to receive them, and every marketing email will include a way to unsubscribe.

Media storage and processing

Uploaded media is stored for the service. It is kept in private storage, may be scanned, validated, re-encoded or transcoded, and is shown to recipients only through secure links and short-lived media access.

Service providers

We use service providers to run Petal You on our behalf, including: Amazon Web Services (hosting, database, file storage and delivery), Stripe (payments and refunds), Amazon SES (sending card and notification emails), Google and Meta/Facebook (optional sign-in), and Google Fonts. These providers may process information in the United States.

Recipient links

Recipient links use hard-to-guess tokens and expire after 100 days by default. Senders can end a recipient link at any time by deleting the card in My Petal. Anyone who obtains an active recipient link may be able to view the associated card, so recipients should avoid forwarding private links unless they intend to share them.

Retention and deletion

We keep information only as long as needed:

• Recipient links work for 100 days after a card or invitation is sent. After that, recipients see that the card is no longer available.
• Your copy in My Petal stays available to you for 1 year after it was sent. After 1 year, the card’s content is deleted automatically: uploaded photos and videos, messages, recipient names and contact details, and RSVPs and thank-you replies.
• Delete sooner: you can delete a sent or cancelled card or invitation in My Petal at any time, which deletes the same content right away.
• Unused uploads: photos or videos uploaded for a DIY card or invitation that is never sent are deleted after 7 days.
• Order and payment records (date, product, amount, payment and refund status — without the recipient’s details or your message) are kept for 7 years for tax, accounting and dispute purposes, then deleted. Records needed for security, fraud prevention or legal reasons may be kept longer where required. Every card and invitation email includes an opt-out link. If someone opts out, an email to an address bounces, or the recipient marks a Petal You email as spam, we keep a one-way scrambled (hashed) form of that address so we don’t email it again; we can’t read the address back from it.

How to delete your data

Signed in to Petal You (with email, Google or Facebook)? Open My Petal, scroll to Your account & data and choose Delete my account. This deletes your account, your cards and invitations, uploaded photos and videos, and the link to your Google or Facebook sign-in. Minimal payment records may be kept as described above. You can also remove Petal You from your Facebook account under Facebook Settings → Apps and Websites. If you can’t sign in, email us and we’ll delete your data for you.

Security

Petal You uses technical and organizational safeguards intended to reduce unauthorized access, including private media storage, authenticated sender controls, tokenized recipient links, restricted media access and server-side security controls. No online service can guarantee absolute security.

Children

You must be at least 13 to create a Petal You account, and users under 18 need a parent or guardian's permission. Petal You is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it or take the other steps required by law. Parents who believe their child under 13 has given us information can contact us at the privacy email above.

Your choices

• Cancel a scheduled delivery, or delete a sent card or invitation (which ends its links), in My Petal.
• Delete a card and its uploaded media in My Petal, subject to required record retention.
• Download a copy of your data or delete your account in My Petal, or ask us to access, correct or delete your personal information by emailing the privacy contact above.

Your privacy rights

Whatever state you live in, you can ask us to:

• Access the personal information we hold about you, and receive a copy in a portable format;
• Correct information that is inaccurate;
• Delete your personal information or your account (we keep only what the law requires, such as minimal order records — see “Retention and deletion”);
• Opt out of any sale or sharing of personal information, targeted advertising or profiling — although we don’t do any of these.

Residents of states with consumer privacy laws — including California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah and Virginia, among others — have these rights under their state’s law. We extend the same rights to everyone.

How to make a request. The quickest way is in My Petal: use Download my data for a copy of your information, or Delete my account to delete it. Because you’re signed in, no further checks are needed. You can also email privacy@petalyou.com; we then confirm the request by sending a message to your account’s email address, and if you can no longer use that address, we may ask you about details only you would know (such as when you signed up or a recent order). We never ask for card numbers or ID documents. You can use an authorized agent; we may ask the agent for proof that you gave permission and ask you to confirm the request directly. Recipients without an account can ask too: we confirm through the email or phone number the card was sent to.

Timing and cost. We respond within 45 days. If we need more time (up to 45 more days), we’ll tell you why. Requests are free, unless they are clearly unfounded or excessive.

Appeals. If we decline your request, you can appeal by replying to our decision with “Appeal” in the subject line. We’ll answer within 45 days and explain the outcome. If you’re still not satisfied, you can contact your state attorney general.

No discrimination. We won’t treat you differently, charge you more or give you a lesser service for using your privacy rights.

Sale, sharing and sensitive information

We do not sell personal information, “share” it for cross-context behavioral advertising, or use it for targeted advertising or profiling. We never have. We do not knowingly sell or share the personal information of anyone under 16.

The only “sensitive” information we hold is your account sign-in details (your email and an encrypted form of your password). We use them only to keep your account secure and provide the service — never to infer things about you.

California residents

When you use Petal You, we may collect the following categories of personal information: from you directly, from the people who send you cards, and automatically when you use the site. We use them for the purposes in “How information is used” and disclose them only to the service providers listed above, for those purposes:

• Identifiers — name you give, email address, mobile number, account ID, network identifiers. Kept while your account is open; recipient details for up to 1 year after a card is sent.
• Commercial information — orders, payments and refunds. Minimal records kept for 7 years.
• Internet activity — card views, previews, sends and security logs. Kept for as long as needed for security and to measure card popularity.
• Audio, visual and written content — photos, videos, messages, event details, RSVPs and replies. Up to 1 year after a card is sent, or until you delete it.
• Sensitive personal information — account sign-in details only, as described above.

“Shine the Light.” We don’t share personal information with third parties for their own direct marketing.

Nevada residents

We do not sell “covered information” as defined by Nevada law. You can still send an opt-out request to the privacy email above, and we will record it.

Where information is processed

Petal You is operated from, and intended for people in, the United States. Information is stored and processed in the United States.

Changes

We may update this policy. If we make significant changes, we’ll post a notice on the site or email you before they take effect. The “Last updated” date shows the latest version.