Privacy policy

This policy explains what information Card Supply Co. collects and how we use it.

What we collect

  • Order information — your name, email, phone (optional), shipping address and the items you buy. You enter this on our checkout page.
  • Payment information — entered into secure fields provided by GoDaddy Payments and sent directly to them. We never see or store your full card number.
  • Email sign-ups — if you join our email list (for example through the 10% welcome offer), we keep your email address, when and where you signed up, and the consent you gave.
  • Unfinished checkouts — when you type your email on our checkout page, we save it with the items in your cart so we can remind you if you don't finish (see below).
  • Reviews — if you review a product, we keep your rating, review text, optional display name and the order it relates to.
  • Browsing — your cart is stored in your own browser. Our server keeps standard technical logs (such as IP address and pages requested) for security and troubleshooting, for up to 30 days.
  • Site analytics (first party) — when you browse, our own server records which pages you view and actions like adding to cart or starting checkout, together with a random visitor ID and session ID stored in your browser, the website or campaign that referred you (referring site name and UTM tags), device type, screen-size range, page speed, scroll depth, time on page, and technical errors. Before anything is saved we shorten your IP address (to its network range) and replace it with a one-way code that changes every day, so we never store your IP address. We do not record what you type, your name, email, address or card details, and we strip other details from web addresses. Analytics records are deleted after 90 days.
  • Advertising measurement (Meta) — unless you opt out, we use the Meta Pixel, which lets Meta Platforms (Facebook/Instagram) receive information about your visit (pages and products viewed, cart and checkout actions, purchases and their value, plus your browser's identifiers and Meta cookies) to measure and improve our ads. For purchases and sign-ups we may also send this through Meta's Conversions API from our server; any email, phone, ZIP code, state and country included are first converted to an irreversible SHA-256 code (“hashed”) and are never sent in readable form. Meta's use of this data is governed by Meta's privacy policy.

How we use it

To process, ship and support your order, prevent fraud, meet legal and tax obligations, understand and fix problems with our website (analytics), and measure our advertising. We do not sell your personal information for money. Sharing data with Meta for ad measurement may be considered “sharing” for cross-context behavioral advertising (and, under some definitions, a “sale”) under California law — you can opt out at any time (see below).

Emails we send

  • Order emails — an order confirmation (receipt) after you pay, and a shipping notice with your tracking number. These are about your purchase and are sent even if you unsubscribe from marketing.
  • Welcome email — if you sign up for our list, we email your welcome code. Welcome codes are one use per customer and not valid on subscriptions.
  • Checkout reminders — if you enter your email at checkout but don't complete the order, we may send up to two reminders (about 1 hour and about 24 hours later) with a link back to your cart. The second may include a one-time welcome code if you've never ordered from us. We stop as soon as you place an order.
  • Review requests — about a week after your order ships, we may email once to ask for a review of what you bought. Reviews are published only after we check them, with a “Verified buyer” badge, and are never edited to change their meaning. We don't pay for or incentivize reviews.

Every marketing email (welcome, reminders, review requests) has a one-click unsubscribe link, and we honor unsubscribes immediately. Emails are sent through our email delivery provider, which processes your address only to deliver them.

Who we share it with

GoDaddy Payments (payment processing — see GoDaddy's privacy policy), our email provider (order emails), shipping carriers (to deliver your order), and — unless you opt out — Meta Platforms, Inc. (advertising measurement, as described above). Our first-party analytics stay on our own server and are not shared or sold.

Your privacy choices & how to opt out

  • Page versions and checkout security — we sometimes show two versions of a page to learn which works better; a first-party cookie (csc_ab, one letter, 30 days) remembers which version you saw. Our checkout may run a Cloudflare Turnstile security check to block automated card fraud, which shares your IP address and browser signals with Cloudflare for that purpose.
  • Do Not Sell or Share My Personal Information — turn off the Meta Pixel and Conversions API for your browser, and/or turn off our first-party analytics. Your choice is saved in a first-party cookie for 13 months.
  • Global Privacy Control (GPC) — if your browser or extension sends a GPC signal, we automatically treat it as a request to opt out of sale/sharing: the Meta Pixel does not load and no server-side events are sent to Meta for that browser.
  • You can also email support@cardsupplyco.com to opt out; we'll apply it to information tied to your email.

Approximate location

For our analytics we derive an approximate location (city, state/region and country) from your IP address using a database stored on our own server — the IP address isn't sent to anyone for this and isn't stored. IP Geolocation by DB-IP.

Retention

Order records are kept as long as needed for tax, accounting and warranty purposes. Analytics records are deleted after 90 days. Server security logs are kept for up to 30 days.

Your rights

You can ask us to access, correct or delete your information by emailing support@cardsupplyco.com. California residents have additional rights under the CCPA/CPRA: to know what personal information we collect, use and disclose; to delete or correct it; to opt out of its sale or sharing; and to limit use of sensitive personal information (we don't use sensitive personal information to infer characteristics about you). We honor these requests, may need to verify your identity first, accept requests from an authorized agent, and will not discriminate against you for using these rights. In the past 12 months we have not sold personal information for money; we have shared device and browsing identifiers and commerce activity with Meta for advertising measurement as described above. We do not knowingly sell or share the personal information of consumers under 16.

Last updated: 2026-10-11.