Privacy Policy
Last updated: August 10, 2026
Information we collect
We collect the information needed to create and deliver cards, including organiser details, contributor names, optional contributor email addresses, card messages, uploaded media, recipient email addresses, and payment status.
How we use it
We use card and account information to provide the service and fulfil delivery requests; security and diagnostic information to prevent abuse and keep enloro reliable; and payment records to meet contractual and legal obligations. We use an email for marketing only when the person has actively opted in, and that consent can be withdrawn at any time.
Third-party providers
We use Netlify for application hosting, Neon for the database, Cloudflare R2 for private media storage, Google for optional sign-in, Stripe for payments, Resend for transactional email, Giphy for GIF search, Cloudflare Turnstile and Upstash for abuse prevention, Sentry for error diagnostics, and PostHog for limited product analytics. These providers process information under their own privacy terms and our service arrangements. Some may process data outside the UK; where required, we rely on their approved transfer safeguards.
Cookies, local storage, and analytics
enloro uses essential authentication and checkout storage to keep you signed in and protect card access. PostHog is configured without automatic page capture and with in-memory persistence, so invite and sign-in URLs are not recorded and analytics identifiers are not stored in browser cookies or local storage. Sentry removes query strings before sending browser diagnostics. Security providers may use strictly necessary storage to detect abuse.
Contributor choices
Contributors can submit without creating an account. Email is optional unless a contributor wants an edit link or delivery updates.
Retention and deletion
Card content remains available until the organiser deletes the card or account, or we remove it for legal or safety reasons. Abandoned staging uploads are removed after approximately 48 hours, and long-expired edit and capture tokens are periodically purged. Account and card deletion includes private stored media and is reported complete only after storage deletion succeeds. Stripe retains payment records under its own legal obligations; enloro does not store full card details.
Your rights
Depending on where you live, you may ask for access, correction, deletion, restriction, portability, or an objection to processing, and you may withdraw marketing consent. You can delete cards or your account from the dashboard. For another request, email support@enloro.com. You may also complain to your local data-protection authority; in the UK this is the Information Commissioner's Office.
Children
enloro is not directed to children under 13, and children should not create an account or submit personal information without appropriate adult involvement.
Terms
Read the Terms of Service for the rules that apply when using enloro.