Skip to content

Privacy & cookie policy

Last updated: November 2026

This policy explains how CardStar collects, uses and protects personal data when you visit our website, create a card, place an order or contact us. CardStar is a trading name of Artily Group Limited (“CardStar”, “we”, “us”), which is the controller of your personal data.

1. Who we are

CardStar is a trading name of Artily Group Limited. For anything about your personal data, email dpo@cardstar.me.

2. What we collect

When you use CardStar, we collect:

  • Your name, email address and delivery address (and phone number, if you give one) at Shopify checkout
  • Payment information — processed by Shopify; we never see your card details
  • What you put on your card: the photo you upload, the name, stats and text you enter, and the card image we make from them
  • For Team Orders: the players’ names, positions, ratings and stats a team manager enters, the club name and crest, and photos uploaded by the manager or by parents
  • Messages you send to the help assistant
  • Messages you send us, for example to customer support or sales
  • Only if you accept analytics cookies: which pages you visit, and your device and browser type, IP address, referring page and approximate location

3. How we use it, and why

We use your information to:

  • Print and deliver your order
  • Send order confirmations and shipping updates
  • Respond to customer service and sales enquiries and fix problems with an order
  • Prevent fraud and meet our legal, accounting and tax obligations
  • Improve the site, if you accept analytics cookies

Where UK GDPR or EU GDPR applies, we rely on these legal bases:

  • Performance of a contract with you, or steps you ask us to take before a contract (for example, making and delivering your card)
  • Compliance with our legal obligations (for example, accounting and tax records, fraud prevention, and lawful requests from authorities)
  • Our legitimate interests (for example, securing and improving the service, business administration, and establishing, exercising or defending legal claims), where those interests are not overridden by your rights and freedoms
  • Consent, where we expressly ask for it (for example, analytics cookies)

4. Photo handling

When you add a photo, it is resized in your web browser, and its background can be removed there. It is then uploaded to our cloud storage (Microsoft Azure) as soon as you add it, so we can print your card and so you can come back and edit it from your basket. When you add a card to your basket we also store the print-ready image we make from your photo.

We use these files only to print and deliver your order and to put right any problem with it. The print-ready image is sent to our print partner, which prints and delivers your card. We do not sell your photos or use them for anything else.

5. Team Orders

A team manager can add a squad’s details and photos, and share a link so that parents can upload a photo for their own child. A parent with the squad’s link can see the squad’s names, add a photo for their own child, and see the photo already added for a player they choose. The link works only for people it’s shared with. The squad is stored in our cloud storage and is reached only through the private link the manager holds; the manager can replace that link, and the parents’ link, at any time.

6. Who we share it with

We share personal data with the following categories of recipients:

  • Other companies in our group, for the purposes in this policy
  • Service providers who act on our instructions, including print and fulfilment partners, hosting and storage providers, customer service tools, payment and fraud providers and shipping carriers
  • Independent third parties acting as their own controllers, such as shipping carriers (for delivery), payment providers (for payments), tax authorities and our professional advisers
  • Law enforcement, regulators and other authorities where we are required or permitted to by law, and the buyers and advisers in a sale of part or all of our business

The services we use to run CardStar are:

  • Shopify — checkout, payment and order management
  • Our print partner — printing and delivery. They receive your delivery details and the print-ready image
  • Microsoft Azure — storage for photos, print-ready images and Team Orders squads
  • Vercel — hosting for the website
  • Anthropic — the help assistant sends the messages you type to Anthropic to generate replies
  • Google — Google Analytics, only if you accept analytics cookies

We do not sell personal data.

7. International transfers

We operate from the United Kingdom and use production partners and service providers in a range of countries, so personal data is transferred internationally. Where data moves from the UK or the EEA to a country without an adequacy decision, we put appropriate safeguards in place, such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or another lawful transfer mechanism. You can ask for more information at dpo@cardstar.me.

8. How long we keep it

We keep personal data only for as long as is necessary for the purposes it was collected for, including to meet legal, accounting, tax or reporting requirements and to resolve disputes. As a general guide, order and account records are kept for the period our accounting, tax and audit obligations require; marketing data is kept until you opt out or it is no longer accurate or relevant; and records relating to legal claims may be kept for as long as such claims could be brought. Backups are overwritten in line with our standard backup cycles.

Photos you upload and the print files for cards you make are deleted automatically 90 days after they were made, unless an order, a team’s squad or a design saved to your account still uses them. When you order, we keep that order’s photos and print files for 12 months after it is sent, so that we can reprint a card or sort out a problem with it, and then delete them, unless another order, a squad or a saved design still uses them. A team’s squad, with its players and photos, is deleted 12 months after it was last changed. Designs you save to your account, and the photos they use, are kept until you remove them from your account. If you want yours deleted sooner, email us at dpo@cardstar.me and we will delete them.

9. Security

We use technical and organisational measures to protect personal data, including access controls, encryption in transit, network security, logging and monitoring, staff training, supplier controls and incident response procedures. Our staff who handle personal data are bound by confidentiality. No system can be guaranteed to be entirely secure; if you believe your data has been compromised, contact dpo@cardstar.me.

10. Cookies and storage

Cookies are small text files placed on your device that let a website remember information about your visit. We keep your basket, your cookie choice and, for team managers, the link to their squad and the squad’s cards already prepared for the basket (for up to a week, so a long squad isn’t prepared twice) in your browser’s own storage on your device. Shopify’s checkout sets its own cookies.

We set analytics cookies (Google Analytics) only if you choose Accept on the cookie notice. If you choose Decline, none are set. You can change your mind at any time with “Cookie settings” at the bottom of any page. We do not use advertising cookies. We never send Team Orders private links to analytics. Strictly necessary storage, such as your basket and your cookie choice, cannot be switched off because the site needs it to work. More about controlling cookies is at aboutcookies.org.

11. Your rights

Depending on the law that applies to you, you may have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate or incomplete data
  • Erase your data, subject to certain exceptions
  • Restrict processing in certain circumstances
  • Object to processing based on our legitimate interests, and to direct marketing
  • Portability: receive the data you gave us in a structured, commonly used, machine-readable format
  • Withdraw consent at any time, where we rely on it
  • Complain to a supervisory authority

To use any of these rights, email dpo@cardstar.me. We may need to verify your identity first. Residents of other places, including the United States, may have additional rights under local law; contact the same address to find out how they apply.

Where to complain

If you are in the United Kingdom, you can complain to the Information Commissioner’s Office at ico.org.uk. If you are in the European Economic Area, you may complain to the data protection authority in your country of residence.

12. Children

CardStar is intended for adults. We do not knowingly collect personal data from children, other than photos and names of players that a parent or team manager chooses to add to a card or squad. If you believe we have collected a child’s data without a parent’s knowledge, contact dpo@cardstar.me and we will delete it.

13. Personal data breaches

We have processes for identifying, escalating, investigating and responding to security incidents and personal data breaches. If a breach affects your personal data, we will tell you in line with applicable data protection law.

14. Changes to this policy

We may update this policy from time to time. The current version, with its date, is always on this page.

15. Contact

  • Data protection requests, security incidents and anything about your personal data: dpo@cardstar.me
  • Help with an order or the site, sales and bulk enquiries: sales@cardstar.me