Privacy Policy
Last updated: October 30, 2026. Contact: hello@kincard.app.
KinCard ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share personal information when you use KinCard (the "Service"), and the rights available to you. By using the Service, you agree to this Policy.
1. Data Controller
- Controller: Edison Zhang (solo operator of KinCard)
- Address: Shenzhen, Guangdong, China
- Privacy / support email: hello@kincard.app
- Data Protection Officer (DPO): Not applicable
2. Personal Information We Collect
2.1 Information You Provide Directly
- Face photos you upload to make an AI Christmas greeting card (required for the Service).
- Consent confirmations that uploads are yours / authorized, and guardian permission when minors appear.
- Communications: emails and support messages you send to hello@kincard.app.
- Payment status: whether a KinCard HD unlock ($9.9 one-time) succeeded. Full card numbers are not stored by us — card data is processed by our payment processor (see Section 5).
2.2 Information We Collect Automatically
- Job metadata: scene choice, job IDs, timestamps, unlock status, and content-safety scan metadata (request id, action, reason codes — not face images).
- Device & network: IP address (for free-preview rate limits), basic request logs, and error logs.
- Cookies: a strictly necessary HttpOnly owner cookie so only you can reopen your private preview / download link.
We do not require account registration. We do not use marketing pixels on checkout.
3. How We Use Your Information
- Deliver the AI Christmas card preview and HD unlock (contract performance).
- Process payments via Waffo Pancake (contract performance).
- Enforce rate limits, fraud prevention, and content-safety rules (legitimate interests).
- Respond to support and safety reports (contract / legitimate interests).
- Comply with law (legal obligation).
We do not train AI models on your photos. We do not sell personal information (including as defined under CCPA-style laws).
4. Cookies & Tracking
- Strictly necessary: owner-token cookie for private job access; cannot be disabled if you use Create.
- We do not use analytics or marketing cookies on the Service today.
5. Sharing & Disclosure
We share information only as needed to run the Service:
- Waffo Pancake — PCI-DSS payment processor for the $9.9 HD unlock. Card data is processed exclusively by Waffo Pancake and is not stored on our servers.
- YIR — image generation vendor. Face references and the generation prompt are sent so the model can produce your greeting card. Images are generated with Google Nano Banana 2 (via YIR). Outputs are AI-generated, not real photographs. KinCard is not an official Google Gemini / Nano Banana app.
- Vercel Blob — private object storage for job metadata and image assets during the retention window.
- Legal requirements — where required by law, court order, or lawful regulatory request.
6. Data Security
- Encryption in transit (TLS / HTTPS).
- Private Blob storage for uploaded faces and generated assets (not a public gallery).
- Least-privilege access for operators.
If a security incident affects your rights, we will notify you and relevant authorities within 72 hours of discovery where required by law.
7. Data Retention
- Uploads, previews, HD files, and job records: deleted within 48 hours of job creation (same window whether or not you pay).
- Payment / order identifiers needed for refunds or disputes: retained as needed for accounting and chargeback handling (typically up to several years as required).
- Support emails: retained while useful to resolve your request, then deleted or minimized.
- Content-safety logs (requestId / action / reasonCode / categories only): retained briefly for abuse investigation.
8. Your Data Rights
Contact hello@kincard.app to exercise access, rectification, erasure, restriction, portability, or objection rights. We aim to respond within 30 calendar days. You may also lodge a complaint with your local data protection authority.
9. Marketing
We do not send marketing emails by default. Essential service messages (e.g., reply to a support thread you started) are not marketing.
10. International Data Transfers
Our hosting and vendors may process data in regions including the United States and other locations where Vercel, YIR, or Waffo operate. We rely on contractual safeguards (including standard contractual clauses where applicable) with processors.
11. Children's Privacy
You must be 18 or older to place an order (checkout). If uploaded photos include a minor, a parent or legal guardian must confirm permission at create time. We do not knowingly collect personal information from children placing orders. Contact us to request deletion if you believe a child provided information improperly.
12. Third-Party Links
Checkout may redirect to Waffo Pancake. Their privacy practices apply to payment data they process. This Policy covers data we collect directly.
13. Policy Changes
For material changes we will update the "Last updated" date on this page and, when practical, provide advance notice. Continued use after the effective date constitutes acceptance.
14. Contact
- Email: hello@kincard.app
- Controller: Edison Zhang
- Address: Shenzhen, Guangdong, China
- Website: https://kincard.app
Also see our Terms of Use and Acceptable Use Policy.