Operator
Silly Robot Cards ("SillyRobotCards.com") is operated by Gleeboard Ltd (UK company number 14229825).
Registered office: 71-75 Shelton Street, London WC2H 9JQ, United Kingdom.
Contact email: [email protected].

Your privacy matters to us. It is Gleeboard Ltd's policy to respect your privacy and comply with applicable laws and regulations regarding any personal information we may collect about you, including across https://www.sillyrobotcards.com/ our iOS app and other services we operate.

Personal information means data that can reasonably identify you—such as your name, contact details, device information, payment details, and how you interact with our services.

Our website may contain links to third-party sites and services. Those organisations have their own privacy policies. After following a link, please review their policy to understand how they handle personal information. Our policy does not apply once you leave our site.

This policy is effective as of 24 February 2023 and was last updated on 12 July 2026.

Information we collect falls into two categories: “voluntarily provided” information and “automatically collected” information.

Voluntarily provided information is anything you knowingly share with us, such as details submitted when creating an account, uploading artwork, or contacting support.

Automatically collected information is data sent by your devices when you access our products and services.

Log Data

When you visit our website, our servers may automatically record standard data such as your IP address, browser type and version, pages visited, timestamps, time spent on each page, and other diagnostic details.

If an error occurs, we may collect additional technical information about the device, the action you attempted, and other context that helps us diagnose the problem. You may not always receive a notification when this logging takes place.

While this information is not identifying on its own, it might be combined with other data to personally identify you.

Personal Information

We may request personal information—for example when you register or contact us—including:

• Name
• Email address
• Phone number, where it is already attached to a saved shipping or fulfilment record
• Home or mailing address
• Payment method information handled through Stripe and purchase history handled through Stripe or Apple
• Photos, face crops, generated images, and face-derived likeness information used to make a personalised card
• Card ideas, prompts, cover text, search terms, reminder names and dates, and support or moderation messages
• Account, device, push-notification, security and transaction identifiers

User-Generated Content

“User-generated content” refers to materials (text, image, or video content) voluntarily supplied to us for publication, processing, or usage on our platform. Such content is linked to the account or email address used to submit it.

Please note that any content you submit for public publication may be accessible to others. Once published, it may be difficult to remove due to the nature of the service and third-party archiving.

Before entering the mobile app, we ask you to agree to the essential processing needed to provide the service and let you choose whether to enable optional product analytics, diagnostic reporting, and marketing. Optional choices are off by default and can be changed by opening Account and scrolling to Privacy preferences.

When you choose an AI feature, we send the text and photos you select to contracted AI and image-processing providers, including OpenAI, Google, Replicate, and Cloudinary, so they can analyse, generate, or edit your card under our instructions. Do not upload another person's photo unless you have their permission. We do not use face-derived information from the iOS app for advertising or to authenticate a person.

Optional product analytics events and performance measurements use PostHog only after the app and your account both confirm your opt-in. PostHog may also receive a stable pseudonymous user identifier to return essential app feature settings; that request does not include product analytics events, email details, or profile properties. The current mobile release does not start Bugsnag crash reporting, use Apple's advertising identifier, or send iOS activity to Meta or another advertising network for cross-company tracking. Transactional and opted-in marketing notifications are sent through Apple and Expo using a device push token.

We only collect and use personal information when we have a legitimate reason to do so, and we collect only what is reasonably necessary to provide our services.

When We Collect Data

• Register an account
• Purchase a subscription or product
• Access our content via a browser or mobile device
• Contact us via email, social media, or similar channels
• Mention Silly Robot Cards on social media

How We Use Data

• Provide core platform features and personalised services
• Analyse selected photos and instructions and generate or edit personalised card artwork
• Deliver products or services you have ordered
• Process payments, prevent fraud, provide refunds, and maintain transaction records
• Save reminders and send transactional or opted-in marketing notifications
• Moderate reported public content and protect customers, our service, and our legal rights
• Measure and improve the mobile app only where you enable optional analytics
• Diagnose reliability problems only where you enable optional diagnostic reporting

We may combine voluntarily provided and automatically collected information with research data from trusted sources to offer localised pricing, language, and other helpful context.

Security of Your Personal Information

We protect personal information with commercially acceptable safeguards designed to prevent loss, theft, unauthorised access, disclosure, copying, use, or modification. While we work hard to secure your data, no method of electronic transmission or storage is entirely risk-free.

You are responsible for maintaining strong passwords and safeguarding access to any accounts associated with Silly Robot Cards.

How Long We Keep Information

We retain personal information only for as long as necessary for the purpose described here. Account and saved card data is normally kept while your account remains active. Temporary source-photo uploads are scheduled for automated deletion after 14 days unless they are still needed for an active request, clean-up is being retried, or a shorter provider rule applies. Generated cards, editor documents, public shares, and likeness-model data may be kept until you delete them or your account because they provide the service you asked for.

Order, payment, refund, tax, fraud-prevention, and fulfilment records may be retained for up to seven years where required for accounting, legal claims, or regulatory duties. Resolved content-report and privacy-operation audit records may be kept for up to two years for safety and accountability. Optional analytics, diagnostic logs, processor copies, and backups follow the relevant configured lifecycle and are deleted or anonymised when no longer needed.

An account-deletion request starts deletion of associated personal information and processor copies. We aim to complete that process within 30 days. Some requests need manual review. Active security or legal holds, records we must retain, public content controlled by another person, and encrypted backups that expire on their normal rotation may take longer. We confirm completion using the contact linked to the account, or through privacy support when no contact is linked.

Our products and services are not directed to children under 13, and we do not knowingly collect personal information from children under 13.

We may disclose personal information to:

• Parents, subsidiaries, or affiliates of Gleeboard Ltd
• Cloud hosting, database, object-storage, content-delivery, security, and maintenance providers
• OpenAI, Google, Replicate, Cloudinary, and other contracted AI or image-processing providers used for the feature you request
• PostHog for optional mobile product analytics, and website analytics providers such as Google Analytics and Mixpanel
• Apple, Expo, and their delivery infrastructure for in-app purchases and push notifications
• Stripe for physical-goods payment processing, refunds, and fraud prevention
• Print and fulfilment partners such as Prodigi, Cloudprinter, Printful, and Gooten where needed to manufacture and deliver an order
• Email delivery, customer support, observability, and incident-response providers
• Employees, contractors, and related entities
• Existing or potential agents and business partners
• Credit reporting agencies, courts, tribunals, and regulators if you fail to pay for goods or services
• Courts, tribunals, regulators, and law enforcement as required by law or to protect our legal rights
• Advertising measurement providers for website activity where permitted by your choices; iOS app activity is excluded from Meta conversion tracking in the current release
• Any entity that acquires all or substantially all of our assets or business

We require service providers to process personal information only for the contracted purpose and with appropriate confidentiality and security protections. We do not sell personal information. We do not permit third-party AI providers to use photos, prompts, or likeness information submitted through the app for their own advertising.

Personal information may be stored or processed in the United Kingdom, United States, Netherlands, or any location where we or our partners maintain facilities. These countries may have different data protection laws than your own.

When transferring personal information internationally we comply with applicable law and protect the information in line with this privacy policy.

Your choice: Providing personal information is optional, but declining may impact access to certain features or services.

Information from third parties: If we receive personal information about you from another party, we protect it according to this policy. Third parties providing information about someone else must have that person’s consent.

Mobile privacy choices: In the iOS app, open Account and scroll to Privacy preferences to change product analytics, diagnostic reporting, and marketing choices. Privacy-reducing choices stop optional processing on that device immediately. If account-level server sync is unavailable, the app shows that the change is pending and retries it. You can also review the dedicated Privacy Choices page.

Marketing permission: You can withdraw consent for direct marketing at any time in the app, using an unsubscribe link, or by contacting us.

Access: You may request details of personal information we hold about you.

Correction: Contact us to correct information that is inaccurate, outdated, incomplete, irrelevant, or misleading.

Non-discrimination: We will not discriminate against you for exercising your privacy rights.

Download:Contact us to request a portable copy of your personal information. The iOS app links directly to privacy support from Account → Data & account.

Deletion:Use Account → Data & account in the app to start account deletion. You do not need to email or contact support to initiate the in-app request. We may ask for identity verification and will explain any legal hold or required retention.

Data breaches: We comply with all applicable laws regarding data breach notification.

Complaints: Contact us if you believe we have breached data protection laws. We will investigate and respond in writing. You may also contact a regulator or data protection authority.

Unsubscribe: Opt out of marketing communications using the links provided or by contacting us directly. We may request additional information to verify your identity.

We use cookies to understand how you use our site and to tailor content to your preferences. A cookie is a small piece of data stored on your device that helps us recognise you on future visits. Refer to our Cookies Policy for detailed information.

If Gleeboard Ltd or its assets are acquired—or in the unlikely event we cease trading or enter bankruptcy—personal information may be transferred to the acquiring party as part of the transaction. Any new owner will be bound by this policy or an equivalent successor policy.

Our website may link to external sites not operated by us. We have no control over their content or privacy practices and cannot accept responsibility for their policies.

We may update this privacy policy to reflect changes to our business, accepted practices, or legal obligations. Updates will be posted at the same URL.

When changes are significant or required by law, we will notify you using your preferred communication method. Where required, we will seek consent or provide opt-in/opt-out options for new uses of personal information.

International Transfers of Personal Information

When disclosure of your personal information is governed solely by Australian privacy laws, some third parties may not be regulated by the Privacy Act or the Australian Privacy Principles. If such parties breach the Australian Privacy Principles, they may not be accountable under the Privacy Act and you may not have recourse under that legislation.

Data Controller / Data Processor

The GDPR distinguishes between organisations that determine the purposes and means of processing personal information (“data controllers”) and those that process personal information on behalf of controllers (“data processors”). Gleeboard Ltd is the Data Controller for the personal information you provide via Silly Robot Cards.

Legal Bases for Processing Personal Information

We collect and use personal information lawfully, fairly, and transparently. Where consent is required and you are under 16, we will obtain consent from a parent or legal guardian. Our lawful bases include:

Consent from You

When you give consent for a specific purpose—such as receiving support—you may withdraw it at any time. Withdrawal does not impact previous processing activities.

Performance of a Contract or Transaction

We process personal information to fulfil contracts or take preparatory steps, for example when you purchase products or subscriptions.

Our Legitimate Interests

We rely on legitimate interests to operate, improve, and promote our services, conduct research, understand our audience, and protect our legal rights.

Compliance with Law

We may be required to process or retain personal information to comply with legal obligations such as court orders, investigations, or regulatory requirements.

International Transfers Outside the EEA

Transfers of personal information from the European Economic Area (EEA) to other countries are protected using safeguards such as European Commission standard contractual clauses, binding corporate rules, or other lawful mechanisms.

Your GDPR Rights

Restrict: Request restriction of processing if you contest accuracy, believe processing is unlawful, require data for legal claims, or object based on legitimate interests.

Object: Object to processing based on legitimate or public interests. We will cease processing unless we demonstrate compelling legitimate grounds.

Data portability: Request a machine-readable copy of your personal information or ask us to transfer it to another controller.

Deletion: Request deletion of personal information. If you delete your account, we start the associated erasure process and aim to complete it within 30 days, with manual review where needed. We will explain any active security or legal hold, record we must retain, public content controlled by another person, encrypted-backup rotation, or third-party cache that means some information takes longer or cannot be erased by us. We confirm completion using the account contact or privacy support.

We do not sell personal information. The current iOS app does not share app activity for cross-context behavioural advertising. Website advertising measurement is governed by the choices and notices shown on the website.

Under California Civil Code Section 1798.83, California residents with predominantly household relationships with Silly Robot Cards may request details of personal information shared with other organisations for marketing purposes.

To submit a request, contact us with “Request for California privacy information” in the subject line. Requests may be made once per calendar year. We will provide categories of personal information shared, along with recipient names and addresses.

Do Not Track

We do not currently respond to “Do Not Track” browser signals. We follow the standards set out in this privacy policy.

Cookies and Pixels

You may decline cookies via your browser settings, though functionality is governed by your browser’s capabilities. Refer to the Cookies section of this policy for more information.

CCPA-Permitted Financial Incentives

We may offer financial incentives allowed under the CCPA that relate reasonably to the value of your personal information. Participation requires opt-in consent, which you may revoke at any time.

California Notice of Collection

In the past 12 months we collected identifiers (e.g., name, email, phone number, IP address, account ID) and customer records (billing and shipping address, payment details). These categories are used for the purposes described in the “Collection and Use of Information” section.

Right to Know and Delete

California residents may request deletion of personal information and details about our data practices over the past 12 months, including:

• Categories of personal information collected
• Sources of personal information
• Categories of personal information disclosed or sold
• Categories of third parties receiving personal information
• Business or commercial purposes for collecting or selling data
• Specific pieces of personal information collected

To exercise these rights, contact us using the details provided in this policy.

Shine the Light

California residents may request information about how we share certain personal information with third parties and affiliates for direct marketing. Include “California Privacy Rights Request” along with your name and contact information when submitting a request.

For questions or concerns about this policy or your personal information, contact:

Gleeboard Ltd (trading as Silly Robot Cards)
Email: [email protected]
Postal address: 71-75 Shelton Street, London WC2H 9JQ, United Kingdom.

If you're in the UK/EU, you can also complain to the UK Information Commissioner's Office (ICO) or your local data protection authority.