Skip to content
All prices and checkout are in CADWe ship worldwide
0 Build Your Bundle

Privacy Policy

Privacy Policy

Last Updated: April 2, 2026

1. Introduction

Sazzy Cards ("we," "us," or "our") operates the website sazzycards.com (the "Site") and the Sazzy Cards Sync application (the "App"). This Privacy Policy describes how we collect, use, store, and protect your personal information when you visit our Site, use our App, or purchase our products.

This policy applies to all users of our Site and to the data processed through our App's integration with third-party accounting platforms.

2. Information We Collect

Personal Information You Provide Directly:

  • Full name (first and last)
  • Email address
  • Billing address (street, city, state/province, postal code, country)
  • Shipping address (if different from billing)
  • Phone number (optional)
  • Payment method details (processed securely by our PCI-compliant payment provider — we never store full credit card numbers, CVV, or sensitive payment data on our servers)

Order and Transaction Information:

  • Products purchased (card selections, bundle type, quantities)
  • Order total, subtotal, tax, and shipping amounts
  • Payment status and method used
  • Order date and order number
  • Shipping carrier and tracking information
  • Coupon or discount codes applied

Information Collected Automatically:

  • Browser type and version
  • IP address (anonymized for analytics)
  • Pages visited and time spent on each page
  • Referring website or source
  • Device type (desktop, mobile, tablet)
  • Operating system

3. How We Use Your Information

We use your personal information for the following purposes:

  • Order Fulfillment: To process, pack, and ship your orders
  • Communication: To send order confirmations, shipping notifications, and delivery updates
  • Customer Support: To respond to your inquiries, process returns, and resolve issues
  • Accounting & Invoicing: To generate invoices, record payments, manage inventory levels, and maintain accurate financial records through our integrated accounting system
  • Inventory Management: To track product stock levels across our systems so that out-of-stock items are accurately reflected on our Site
  • Site Improvement: To analyze usage patterns and improve our website, product offerings, and user experience
  • Marketing: To send promotional emails, only with your explicit consent — you may opt out at any time via the unsubscribe link in any email
  • Legal Compliance: To comply with applicable laws, tax regulations, and legal obligations
  • Fraud Prevention: To detect and prevent fraudulent transactions

4. Sazzy Cards Sync — Third-Party Accounting Integration

Our Site uses the Sazzy Cards Sync application to integrate with a third-party accounting platform for invoicing, payment recording, and inventory management. This section describes how your data is handled through this integration.

What Data Is Shared:

When you place an order, the following information is transmitted to our accounting platform via a secure, authenticated API connection:

  • Your name and email address (to create or match a customer record)
  • Your billing and shipping addresses
  • Order details: product names, SKUs, quantities, and prices
  • Tax amounts and shipping costs
  • Payment status (paid/unpaid) and payment method description
  • Invoice number (generated with a unique prefix to identify orders from our Site)

How Data Is Transmitted:

  • All data is transmitted over HTTPS/TLS encrypted connections
  • Authentication uses the industry-standard OAuth 2.0 protocol
  • OAuth tokens are encrypted at rest using AES-256-GCM encryption on our server
  • Access tokens are automatically refreshed and old tokens are securely revoked
  • No accounting platform credentials are stored in plaintext

How Data Is Stored:

  • On our Site, we store only reference IDs (invoice ID, customer ID, payment ID) that link orders to their corresponding records in the accounting platform — we do not duplicate the full accounting data
  • Sync logs (which record the success or failure of each sync operation) are stored in our database with personally identifiable information (PII) automatically redacted
  • The accounting platform stores data according to its own privacy policy and data retention rules

Purpose Limitation:

Data shared with the accounting platform is used exclusively for:

  • Creating and managing invoices for customer orders
  • Recording payments against those invoices
  • Tracking inventory quantities for our greeting card products
  • Processing refunds (as credit memos) when applicable

We do not use the accounting integration for marketing, profiling, advertising, or any purpose other than business accounting and inventory management.

Data Access:

  • Only the Site administrator has access to the sync configuration and logs
  • The accounting platform connection can be disconnected at any time, which revokes all API access
  • No third parties other than the accounting platform receive your data through this integration

5. Other Third-Party Services

In addition to our accounting integration, we share your information with the following trusted third parties, solely as necessary to operate our business:

  • Payment Processors: To securely process your credit card or other payment. They are PCI DSS compliant and do not share your payment details with us.
  • Shipping Carriers (Purolator, UPS, FedEx): Your name and shipping address are shared to deliver your orders.
  • Email Service: Your email address is used to send transactional emails (order confirmations, shipping updates). We do not share your email with third-party marketers.
  • Website Hosting: Our hosting provider stores and serves our website. They process data in accordance with their own privacy and security policies.

We do not sell, rent, or trade your personal information to any third party for marketing or any other purpose.

6. Data Security

We implement the following security measures to protect your personal information:

  • All website traffic is encrypted via HTTPS/TLS
  • HSTS (HTTP Strict Transport Security) is enforced with a one-year duration and preload
  • Content Security Policy (CSP) headers restrict the sources of executable content
  • OAuth tokens and API secrets are encrypted at rest using AES-256-GCM with unique encryption keys derived from the server environment
  • Payment information is handled exclusively by PCI DSS Level 1 compliant payment processors
  • Administrative access requires authenticated login with rate-limited login attempts
  • File editing is disabled within the WordPress admin to prevent unauthorized code changes
  • XML-RPC endpoints are blocked to prevent brute-force attacks
  • Sync operations use atomic locking to prevent duplicate data processing

While we employ industry-standard measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your data to the best of our ability.

7. Cookies

Our website uses cookies for the following purposes:

  • Essential Cookies: To maintain your shopping cart session and process checkout
  • Preference Cookies: To remember your settings and preferences
  • Analytics Cookies: To understand how visitors use our Site (data is anonymized)

You can control cookies through your browser settings. Disabling essential cookies may prevent you from completing purchases.

8. Your Rights

Depending on your jurisdiction (including under PIPEDA, GDPR, CCPA, and similar laws), you may have the right to:

  • Access: Request a copy of the personal data we hold about you
  • Correction: Request that we correct any inaccurate or incomplete data
  • Deletion: Request that we delete your personal data, subject to legal retention requirements
  • Portability: Request your data in a structured, machine-readable format
  • Opt Out: Unsubscribe from marketing communications at any time
  • Withdraw Consent: Where processing is based on consent, you may withdraw it at any time
  • Restrict Processing: Request that we limit how we use your data

To exercise any of these rights, contact us at hello@sazzycards.com. We will respond within 30 days.

9. Data Retention

  • Order Data: Retained for 7 years for tax and accounting compliance
  • Sync Logs: Automatically purged after 90 days
  • Customer Accounts: Retained until you request deletion
  • Analytics Data: Anonymized and retained for up to 26 months
  • OAuth Tokens: Automatically refreshed; revoked upon disconnection

10. International Data Transfers

Our servers are located in North America. If you access our Site from outside Canada, your data may be transferred to and processed in Canada or the United States. By using our Site and placing orders, you consent to this transfer. We ensure that appropriate safeguards are in place for any international data transfers.

11. Children's Privacy

Our Site and products are intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected data from a minor, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be posted on this page with an updated "Last Updated" date. We encourage you to review this page regularly. Your continued use of our Site after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

Sazzy Cards
Email: hello@sazzycards.com
Website: https://sazzycards.com

Build Your Bundle

Build Your Bundle