Privacy Policy

1. About this policy

This Privacy Policy explains how Cardel (“we”, “our”, or “us”) collects, uses, and protects personal information when you visit cardel.io, create a Cardel account, or use Cardel to build, run, or visit a creator site on Cardel.

2. Information we collect

• Account information: email address, verification status, display name, profile image, authentication method (for example Google or password), and account timestamps.
• Site & membership data: which sites you own or join, your role on those sites, and settings you configure as a site owner or admin.
• Billing information (Cardel SaaS subscriptions for workspaces): plan selection, billing interval (monthly or yearly), and payment status processed by our payment provider (Stripe Checkout and Customer Portal). You enter card details only on Stripe. Cardel never receives or stores your payment card number, CVV, or other full card details; Stripe handles that on Stripe's systems.
• Shop and order information: when a site owner connects Stripe for Shop sales, Cardel processes order records and related buyer contact details (including name, email, and messages from on-site request forms) so admin users can fulfill sales. Card payments for Shop items are processed by Stripe on the owner's connected account; Cardel may receive limited payment metadata (for example Checkout session identifiers and an application fee amount). Buyers enter card details only on Stripe. Cardel never receives or stores payment card numbers, CVVs, or other full card details.
• Scheduling and calendar information: when a site owner or Admin connects Google Calendar or Outlook Calendar, Cardel uses that connection so the site's public booking page can show open times. For a connected Google Calendar or Outlook Calendar, Cardel accesses the calendars the Admin selects: it reads them for busy times, and it may write booking events when a guest books. Access tokens stay encrypted and stored with that workspace. Cardel does not use this Google or Outlook calendar data for advertising, and does not share calendar event details with other sites, advertisers, or the public. An Admin can disconnect Google Calendar or Outlook Calendar at any time. Guests see only open slots, not the Admin's event titles or other calendar details. Site owners sign in on Google or Microsoft to connect a calendar. Readers who book may share a name, email, and the details of that request.
• Usage & technical data: IP address, browser type, device signals, pages viewed, approximate location derived from IP, cookies or similar technologies needed for sessions and security, and diagnostic logs.
• Communications: messages you send to Cardel support, and transactional emails we send (verification, password reset, billing notices).
• Content you submit on sites: posts, comments, chat messages, and similar content stored so creator sites can function. Site owners may also process audience lists they manage in their admin tools.
• Cardel Community: when you post, comment, like, or show a display name and avatar on the Cardel Community, Cardel stores that so the discussion space can function.

3. How we use information

• Provide, secure, and improve the Cardel platform and creator sites.
• Authenticate users and enforce roles (platform and site).
• Send essential account and security messages.
• Process Cardel SaaS subscriptions and entitlements, and facilitate Shop checkout and order records when a site owner uses Stripe Connect (including a platform application fee on eligible sales).
• Provide public scheduling when a site owner enables it, including reading busy times from the calendars an Admin selects and writing booking events when a guest books. Cardel does not use connected Google Calendar or Outlook Calendar data for advertising.
• Operate the Community on Cardel, including showing your posts, comments, and likes to other readers.
• Prevent abuse, spam, and unauthorized access.
• Comply with law and respond to lawful requests where required. We may disclose personal data to law enforcement or legal entities in response to valid, lawful requests (e.g., subpoenas or court orders).

We do not sell your personal information. We do not use your content to train third-party foundation models.

4. Service providers

We use infrastructure and product vendors that process data on our behalf, including hosting (Vercel), databases (Neon), caching and jobs (Upstash), email delivery (Amazon SES and/or Resend), authentication with Google when you choose Google sign-in, and payments (Stripe) for Cardel SaaS billing and for Shop payments through Stripe Connect when a site owner connects an account, and Google Calendar or Microsoft Outlook Calendar when a site owner connects a calendar. These providers process data under their own terms and solely as needed to run Cardel.

5. Cookies and sessions

We use cookies or similar storage for signed-in sessions, security, theme preference, and essential platform behavior. You can control cookies in your browser; disabling required cookies may prevent login or core features from working.

6. How we protect information

We use technical and organizational measures to protect personal information and Google Calendar and Outlook Calendar data against unauthorized access, disclosure, alteration, or destruction.

Traffic between your browser and Cardel uses HTTPS. Google Calendar and Outlook Calendar access and refresh tokens are encrypted at rest and stored with the workspace that connected them. Those tokens are used only on Cardel's servers to talk to Google or Microsoft for Scheduling. They are not placed in the browser or used for advertising.

Access to a connected calendar is limited to Admins on that workspace and to Cardel systems that run Scheduling. Calendar data stays on that workspace. Guests see only open slots.

If an Admin disconnects a calendar, Cardel deletes the stored tokens and cached busy times for that connection, and requests that Google or Microsoft revoke those tokens. We keep this data only while the connection is needed to provide Scheduling, plus a limited time in backups.

We use Google Calendar and Outlook Calendar data only to provide Scheduling. We do not sell it, use it for ads, or use it to train AI models.

7. Site owners and readers

If you operate a site, you may collect information from your readers (for example comments or audience emails, Shop orders, and purchase or booking request forms) through tools Cardel provides. You may also connect Google Calendar or Outlook Calendar so public scheduling can respect busy times. Cardel reads the calendars you select for busy times and may write booking events. Tokens stay encrypted with your workspace. Guests see only open slots. You can disconnect the calendar in Scheduling. You are responsible for that connection and for the appointments you accept. You are responsible for that processing under applicable law and for any notices you owe your audience. Cardel hosts that data as your processor/service provider for those features. For Shop card payments, Stripe also processes payment data for your connected account under Stripe's terms.

If you are a reader on a creator's Cardel-hosted site, the site owner may also set expectations for that community. Cardel still processes platform account and infrastructure data as described here.

Cardel Community on cardel.io is different. Cardel runs that forum as the platform, not as a processor for a creator site. Posts and comments there are public to other readers. Authors can delete their own posts. Cardel may also remove content that violates the Terms of Service.

8. Retention

We retain account and site data while your account or site is active and for a reasonable period afterward for backups, security, dispute resolution, and legal obligations. You may request deletion of your Cardel account as described below; some records may remain in backups for a limited time.

9. Your choices

• Update profile details from your account settings when signed in.
• Manage your own Community posts, comments, and replies on Cardel when you are signed in as the author.
• Disconnect a Google or Outlook calendar from Scheduling at any time.
• Request access, correction, or deletion by contacting us.
• Opt out of non-essential marketing email from Cardel (transactional mail may still be required).

10. Children

Cardel is not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided information, contact us and we will take appropriate steps.

11. International users

Cardel is operated from the United States. If you access Cardel from elsewhere, you understand your information may be processed in the U.S. and other countries where our providers operate.

12. Changes

We may update this Privacy Policy as Cardel evolves. We will post the revised policy here with an updated date. Continued use after changes take effect constitutes acceptance where permitted by law.

13. Contact

Privacy questions about Cardel may be sent to support@cardel.io.