Privacy Policy

Effective date: 13 October 2026 · Previous version: 1 November 2024

1. Who we are

iThank.uk is a trading name of Affirmable Limited, a company registered in England and Wales (company number 14461956). Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. In this policy, "we", "us" and "our" mean Affirmable Limited, which is the controller of the personal data described here.

This policy covers ithank.uk, the iThank.uk web app, our Android and iOS apps, and the emails and support we provide. It applies to visitors, people who use iThank.uk to make cards, and the guests those cards are for, including guests who reply to an invitation through its RSVP code.

2. Information we collect

a. Account and profile

• Your name, email address and password. We store passwords only as a one-way hash, so we can never see them.
• Your address, if you add it for checkout.
• Your AI credit balance and your email choices.

b. Signing in with Facebook

If you sign in with Facebook, we receive your name and email address. We don't receive your Facebook password, and we don't get access to your friends, photos or posts.

c. Orders and billing

Payments are handled by Stripe. We keep what you ordered, when, the amount and the Stripe references that link your order to your payment. Stripe holds your card details; they never pass through or get stored on our servers.

d. Events, guests and cards

• Your events: names, dates, times and descriptions.
• Your guests: names, addresses, the gifts they gave, tags, personal notes and whether they're coming.
• Your cards: designs, wording, and any photos or signatures you upload.

If you start without an account, your event is linked to your device by a cookie until you save it to an account.

e. RSVP replies

When a guest replies through the RSVP code on their invitation, we record whether they're coming, any note they add, and when they replied.

f. Communications

We keep messages you send through our contact form, along with our replies.

g. Technical and usage data

• Server and security logs: IP address, browser and device type, the pages and actions requested, timestamps and errors. We use these to keep the service running, to stop abuse such as repeated failed logins, and to fix problems.
• Website statistics: Umami counts visits without cookies and without identifying you. Section 11 explains more.

3. How we use it and why

UK data protection law requires a lawful basis for each use of personal data. The table below sets ours out.

We don't sell personal data, use it for advertising, or make decisions about you that have legal or similarly significant effects using automated processing alone.

4. AI pictures

When you ask us to create a picture with AI, we send the description you type to OpenAI, which creates the image. Nothing else is sent: not your name, your guests or your cards.

• No training on your input: we use OpenAI through its paid business service. Under those terms, it may not use your descriptions or pictures to train its models. It may keep inputs for a short period to detect abuse, under its own retention rules.
• Keep descriptions general: please don't include anyone's personal details in a description.
• Inspire me suggestions for your wording are put together in your browser from built-in phrases. They don't use AI, and nothing is sent anywhere.

5. Your guests' information

To make personalised cards, you give us details of other people: your guests. When you do, you confirm that you're entitled to share them with us for this purpose. We use guests' details only to make, print, post and deliver your cards and to collect RSVP replies for you. We never market to your guests, and we never sell their details.

If you're a guest and replied to an invitation through its RSVP code, your reply and note are shared only with the person who invited you. You can change your reply at any time using the same code. To ask about your details, or to have them removed, contact the person who invited you or contact us.

6. Who we share it with

Our service providers (sub-processors)

We use the following providers to run iThank.uk. Each one may only use personal data to provide its service to us.

Other sharing

• Legal reasons: we may disclose data if the law requires it, or to protect the rights, property or safety of our users, the public or us.
• Business changes: if Affirmable Limited is involved in a merger, acquisition or sale of assets, data may transfer to the new owner under this policy. We will tell you before that happens.

7. International transfers

We store your data in the UK. Some providers listed above process data outside the UK, mainly in the US and the EU. When they do, we rely on UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum to protect it. You can ask us for details.

8. Storage and security

Data is hosted on Amazon Web Services in the UK, encrypted in transit with HTTPS (TLS) and encrypted at rest. Other protections include:

• one-way hashed passwords and hardened session cookies;
• limits on repeated sign-in and other sensitive requests;
• RSVP codes that each work only for one guest's reply;
• checks on uploaded files;
• access keys and secrets kept out of our code;
• regular backups.

No system is completely secure. If a breach affects your personal data and is likely to put you at risk, we will tell you and the Information Commissioner's Office (ICO) as the law requires.

9. How long we keep it

Deleting your account

You can delete your account from My account. This removes your profile and all of your events, guests and cards. Records of past orders are kept for as long as tax law requires.

10. Your rights

Under UK data protection law, you have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is wrong or incomplete. You can update most of it yourself in your account;
• delete your data, including by deleting your account;
• restrict or object to how we use your data, including for direct marketing at any time;
• port your data, which means receiving it in a common machine-readable format;
• withdraw consent at any time, where we rely on consent.

To use any of these rights, contact us. We'll reply within one month. We may ask you to confirm your identity first.

11. Cookies and similar technologies

When you first visit, a banner lets you allow all cookies or only essential ones. Essential cookies are needed for the service to work and are always set. Analytics and marketing cookies, such as Google Analytics or advertising tags, are only ever set if you choose Allow All. We don't use any at the moment. If we add them, we'll list them here first, and nothing will be loaded from those providers until you agree.

To change your choice, clear the CookiePrefs cookie in your browser and the banner will appear again. You can also block or delete cookies in your browser settings. Blocking essential cookies will stop you signing in, and will lose an event you started without an account.

12. Emails we send

• Service emails are needed to run your account and orders. Examples include account activation, password resets, email-change notices and order confirmations.
• News and offers can be switched off with the unsubscribe link in any of these emails.

We never email your guests. Emails are sent through Amazon SES in the UK.

13. Children

iThank.uk accounts are for adults (18 and over). Children's names and gifts often appear on cards, for example thank-you cards after a birthday party, but they're entered by a parent or another adult and used only to make the cards. If you think a child has given us personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the service changes. We will post the new version here and update the effective date. If a change materially affects how we use your data, we will email account holders before it takes effect.

15. Contact and complaints

Controller

Affirmable Limited (trading as iThank.uk)

Company number

14461956 (England and Wales)

Address

71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

Contact

Our contact form

ICO registration

ZB636465

If you're unhappy with how we've handled your data, please talk to us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.