Privacy Notice

Last updated: 1 November 2026  ·  Effective: 25 September 2026

Picturepops makes personalised pop-up greeting cards. To do that we handle two things people care about: the photos you upload, and the address of the person you are sending a card to. This notice explains what we collect, why, who else sees it, and how long we keep it.

1. Who we are

Picturepops, Inc. is a Delaware corporation. Our mailing address is 2108 N St #14442, Sacramento, CA 95816. We operate picturepops.com. This notice covers the information we handle when you visit our site, place an order, or contact us.

Our contact details are in section 15.

2. Where we sell

We are a United States business and we ship to most of the world. Our marketing is directed at the United States. We do not accept orders for delivery to addresses in the European Economic Area, the United Kingdom or Switzerland. We do not advertise in those regions, we do not price in their currencies, we do not offer shipping to them, and we do not direct our site to them.

3. What we collect

Information you give us

• Order details. Your name, email address, billing address, phone number if you provide one, and what you ordered.
• Photos and message text. The images you upload for your card, and any personal message you write inside it.
• Recipient details. The name and postal address of each person you are sending a card to.
• Account details, if you create an account: your email address, password and order history.
• Your email address when you start a card. Our card maker asks for your email before you make your card. We use it to send you your card, to remind you about it, and, if you are in the United States, to send you Picturepops news. Every email we send has a link to unsubscribe.
• Messages you send us, if you contact support.
• What you type into our card search. When you describe who a card is for, an AI model reads your words to suggest cards (see section 7). Please don’t type anything you would not want sent to that provider.

Information collected automatically

• Device and usage data. IP address, approximate location derived from it, browser type, device type, pages viewed, and how you arrived at our site.
• Session recordings. A recording of how you use our site and the card builder: where you click, scroll and tap, and what the page showed you, including the photos you add to your card. We watch these to find what is confusing or broken and make the site easier to use. Recordings never include your payment details.
• Cookies and similar technologies. See section 8.

What we do not collect

We never see or store your full payment card number. Card details go directly to our payment processor. We do not run facial recognition, we do not use your photos to generate biometric data or to identify anyone in them, and we do not use your photos to train machine learning models.

We do not make any decision about you by automated means that produces a legal or similarly significant effect.

4. Your photos

Photos you upload are stored securely and are accessible only to the people and printing partners who need them to produce and fulfil your order, and to the small team who watch session recordings of the card builder to improve it (see section 3). Those recordings are kept by our analytics provider, PostHog, and are never used as marketing material.

Photos from Google Photos

You can bring photos in from Google Photos instead of from your device. If you do, we use Google’s own Photos Picker with a single read-only permission (photospicker.mediaitems.readonly), and we receive only the photos you pick in Google’s picker window. We never browse, search, index or list your Google Photos library, your albums, or anything else in your account.

The access token Google issues stays in your browser’s memory for that session. It is never stored, never written to a cookie, and never sent to our servers. You can withdraw our access at any time at myaccount.google.com/permissions.

Once you pick a photo, it is treated exactly like one you uploaded from your device, and the rest of this section applies to it.

Picturepops’ use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Photos of other people

A photograph of an identifiable person is that person’s personal information as well as yours. When you upload a photo of someone else, you are confirming that you are entitled to share it with us for the purpose of printing your card. If someone in a photo you uploaded contacts us and asks us to delete it, we will.

How long we keep photos

We keep the photos and message text you upload until you ask us to delete them. For an order, that lets us print your card, and reprint it if something goes wrong.

We do not guarantee that they will be there. Picturepops is not a photo storage or backup service. We may delete photos at any time, and we are not responsible if a photo you uploaded is no longer available. Always keep your own copy of anything you care about.

Deleting a photo

You can ask us to delete any photo at any time, and we will do it promptly. Email us at support@picturepops.com. The only exceptions are an order still in production, or an open payment dispute on an order, where we need the artwork until it is resolved.

If we ever want to feature a card you created in our own marketing, we will ask you first and you can say no.

5. People you send cards to

When you send a card, you give us the recipient’s name and postal address. We use that information only to address, post and deliver that card, and to handle any delivery problem. We do not add recipients to our marketing lists and we do not sell their details.

If you are a recipient and want to know how we got your address, or want it deleted, contact us using the details in section 15.

6. How we use your information

We use the information described above to:

• Produce, print and post your order, and reprint it if there is a problem
• Take payment, prevent fraud, and respond to chargebacks and other payment disputes
• Answer your support messages
• Send you order updates and delivery notifications
• Send marketing emails, if you have agreed to receive them. You can unsubscribe from any of them
• Understand how our site is used, fix problems, and improve our products
• Advertise our products, including on other platforms
• Keep tax and accounting records, and meet our other legal obligations

7. Who we share it with

We do not sell your personal information for money. We share it with the service providers we need to run the business, and only for the purposes below.

We use other providers in these same categories from time to time, and the named providers above change as our tools change. We update this table when they do. If you want the current list of providers in any category, email us and we will tell you.

We may also disclose information if the law requires it, to protect our rights or someone’s safety, or as part of a merger or sale of the business. If our business is ever sold, we will tell you before your information becomes subject to a different privacy notice.

8. Cookies and tracking

We use cookies and similar technologies to keep your basket working, remember your preferences, measure how the site is used, and show you our ads on other platforms.

Meta (Facebook and Instagram), Google and TikTok may use cookies, pixels and similar technologies on our site to measure our ads and to show you ads elsewhere, including ours. You can opt out in any of the ways listed below.

Advertising cookies involve sharing device and usage data with advertising platforms. Under several US state privacy laws this counts as “sharing” or “selling” personal information for targeted advertising, even though no money changes hands. You can opt out at any time:

• Use Your Privacy Choices, also linked in our footer. In the US this is the opt-out from sharing for targeted advertising.
• Where we ask for cookie consent, use the Cookie preferences link in our footer to change your answer.
• Turn on Global Privacy Control in your browser. We treat a GPC signal as a valid opt-out request.
• Use the advertising industry’s opt-out pages at optout.aboutads.info and youradchoices.com.
• Change your ad settings on Facebook and Instagram at facebook.com/adpreferences.
• Turn off personalized ads in the TikTok app, under Settings and privacy, then Ads.
• Use your browser settings to block or delete cookies. Some parts of the site may stop working if you block all cookies.

Our site does not respond to browser “Do Not Track” signals, because there is no agreed standard for them. We do honour Global Privacy Control, as described above.

We do not sell to the EEA, the UK or Switzerland, but people there can still reach our site. If you are visiting from one of those regions, we ask for your consent before setting any non-essential cookie, and nothing beyond what is strictly necessary loads until you give it. You can change your mind at any time using the same footer link, and withdrawing consent is as easy as giving it.

9. How long we keep it

We keep personal information until you ask us to delete it, unless we have to keep it for a legal reason. We may delete it sooner. Specifically:

Deleted information may remain in our providers’ backups for a period before those backups are overwritten. We may also keep information for longer where we have to, for example because of a legal claim, an investigation, or a tax or regulatory requirement.

10. Your privacy rights

Depending on where you live, you may have the right to:

• Know what personal information we hold about you and get a copy of it
• Correct information that is wrong
• Delete your personal information
• Opt out of targeted advertising, and of the sale or sharing of your personal information (section 8 says how)
• Not be discriminated against for exercising any of these rights

You can also unsubscribe from marketing email at any time using the link in any marketing message, or ask us to delete a photo at any time as described in section 4.

To make a request, email support@picturepops.com. We will respond within 45 days, and may extend that once if the request is complex. We may need to verify your identity first, usually by asking you to confirm details of a recent order.

You can authorise someone else to make a request for you. We may ask them for proof that you gave them permission.

If we refuse a request, you may appeal by replying to our response. If your appeal is denied, residents of several states may complain to their state Attorney General.

11. Where your information is handled

We are based in the United States and your information is stored there. Some of the people who work for us, and some of our service providers, are located in other countries, so your information may be accessed from outside the United States in the course of running the business. Wherever it is handled, it is protected by this notice and by our contracts with those providers.

12. Children

Our site is meant for adults. We do not knowingly collect personal information from anyone under 13, we do not offer our services directly to children, and we do not sell or share the personal information of anyone under 16 for targeted advertising.

We know that customers often upload photographs of children, because that is what greeting cards are for. When you upload a photo of a child, you are confirming that you are the child’s parent or guardian, or that you have their permission. Those photos are covered by section 4 and the table in section 9 like any other.

If you believe a child has given us personal information, contact us and we will delete it.

13. Security

We use encryption in transit, access controls, and reputable providers who maintain their own security programmes. We limit access to your photos to the people and partners who need them to produce your order. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information and is likely to put you at risk, we will notify you and the relevant authorities as the law requires.

14. Changes to this notice

We will update this notice when our practices change. The date at the top tells you when it last changed. If a change is significant we will tell you by email or by a notice on the site before it takes effect.

15. Contact us