Privacy Policy

This Privacy Policy explains how IdCardMaker (“IdCardMaker,” “the Company,” “we,” “us,” or “our”) collects, uses, discloses, and protects information in connection with the website idcardmaker.app and related services (the “Service”).

Until a registered legal entity name and address are published in an updated version of this Policy, the Service is operated by IdCardMaker (“the Company”) at https://idcardmaker.app. Contact: privacy@idcardmaker.app.

This Policy should be read together with our Terms of Service. It is not legal advice; practices may need adjustment as features change.

This Policy applies to information processed when you visit or use IdCardMaker, including browsing templates, using the in-browser editor, exporting designs, and contacting us.

It does not apply to third-party websites, apps, or platforms you may use after exporting content (for example Instagram or LinkedIn), which have their own privacy practices.

Information you provide. If you email us or otherwise contact us, we receive the content of your message and any contact details you include (such as your email address and name).

Editor and design content. Text, images, and layout edits you make in the editor generally remain on your device (for example in browser memory) unless you choose to send them to us (for example by email or a future save/cloud feature). We do not currently require an account, and we do not operate a user account database for the Service as of the date of this Policy.

Technical and usage data. When you use the Service, our servers and infrastructure may automatically collect: IP address, date and time of requests, requested URLs or API paths (including template identifiers), browser type and version, device/OS information, referrer URL, and approximate location derived from IP. Apache and application logs on our hosting environment may record similar data.

Cookies and similar technologies. We may use cookies, local storage, or similar technologies that are strictly necessary for the Service to function (for example session continuity of the web app or security). We do not currently use third-party advertising cookies. If we introduce analytics or non-essential cookies, we will update this Policy and, where required, obtain consent.

We do not intentionally collect special-category or sensitive personal data (for example health data, precise geolocation, or government IDs) as part of the core ID card maker. Please do not submit such data to us.

We use information to: (a) provide, operate, and maintain the Service (including serving templates and assets); (b) secure the Service (fraud prevention, abuse detection, rate limiting); (c) diagnose errors and improve performance; (d) understand aggregate usage of templates and features; (e) respond to your requests and communications; (f) comply with law and enforce our Terms; and (g) send service-related notices if you contact us or if accounts/notifications are later introduced.

We do not sell your personal information.

If you are in a jurisdiction that requires a legal basis for processing (for example the EEA/UK), we process personal data where: (a) processing is necessary to provide the Service you request; (b) processing is necessary for our legitimate interests in running a secure, reliable product and understanding feature usage in a privacy-respecting way, balanced against your rights; (c) you have consented (for example to optional communications or non-essential cookies, if offered); or (d) we must comply with a legal obligation.

The Service is self-hosted on infrastructure we control or rent (typically an Ubuntu virtual private server), with Apache as a reverse proxy and Node.js applications for the frontend and API. Our hosting provider and any DNS registrar act as infrastructure processors and may process technical data (including IP addresses in logs) under their terms.

Depending on configuration, subprocessors may include: cloud/VPS provider, DNS and domain registrar, email delivery provider (if used to receive or send mail), and certificate providers for HTTPS. We require processors to process data only for providing their services to us, subject to appropriate contractual or statutory safeguards where required.

Exports you download remain under your control once stored on your device or uploaded to third-party platforms.

We may share information with: (a) service providers who help us host or operate the Service; (b) professional advisors (legal, accounting) under confidentiality; (c) authorities when required by law, legal process, or to protect rights, safety, and security; and (d) a successor in connection with a merger, acquisition, or asset sale, subject to this Policy or equivalent notice.

We do not share personal information with third parties for their own independent marketing.

Server and access logs are generally retained for a limited period needed for security, debugging, and operations (for example days to months), unless a longer period is required for legal, security, or abuse-investigation reasons.

Email correspondence is retained as reasonably needed to respond and keep business records.

Because editor content is primarily client-side today, we typically do not retain your designs on our servers unless you send them to us or a future cloud-save feature stores them (in which case retention will follow that feature’s settings and this Policy as updated).

We implement reasonable technical and organizational measures appropriate to the nature of the Service, such as HTTPS, access controls on servers, and restrictive firewall/port exposure for application processes. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

You are responsible for securing devices you use to access the Service and for carefully handling exported files that may contain business or personal content.

Our servers and providers may be located in countries other than your own. Where we transfer personal data internationally, we take steps required by applicable law (such as appropriate contractual safeguards) when those laws apply to us.

Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal data, to withdraw consent where processing is consent-based, and to data portability. You may also have the right to lodge a complaint with a supervisory authority.

To exercise privacy rights, contact privacy@idcardmaker.app. We may need to verify your request. Browser controls can often clear cookies and local storage. Essential cookies may be required for the Service to function.

Because we may not hold design files for anonymous editing sessions, some requests will be limited to data we actually store (for example logs or emails).

The Service is not intended for children under 13 (or under 16 where stricter rules apply). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact privacy@idcardmaker.app and we will take appropriate steps to delete it.

As of the date of this Policy, we do not run a third-party product analytics or advertising pixel suite on IdCardMaker. If that changes, we will update this Policy and describe those tools. We may not respond to every browser “Do Not Track” signal in a uniform way while we rely mainly on essential operational logging.

We may update this Privacy Policy from time to time. We will post the revised Policy on this page and update the “Last updated” date. Significant changes may be highlighted on the Service or communicated by other reasonable means when appropriate.

Privacy questions or requests: privacy@idcardmaker.app

Legal notices: legal@idcardmaker.app

Website: https://idcardmaker.app