Privacy

The short version

We use your birth details to build your card, and for nothing else. We don't sell or share your data. Your typed-in details and your card PDF are deleted 180 days after delivery.

What we collect

• To make your card: the name you want printed, your birth date, and, if you give them, your birth time and birthplace.
• To deliver it: your email address. For gifts: your name, the recipient's name, your message, and, if you choose, the recipient's email and a send date.
• To run the shop: an order number, the order type, its status and timestamps, and where the visit came from (for example a link's tracking tag or the referring page).
• Payments: handled by Stripe. We receive confirmation that you paid, not your card number.
• Order records: when you place an order we record the time, your IP address and browser type with the order, to protect against fraud and payment disputes.

How long we keep it

• Your birth details, your email address, any gift message and the other details you typed in are deleted 180 days after delivery. That covers the 120 days a card payment can be disputed, plus time to answer. After that, the order record keeps only your sign, your numbers and the order status.
• Card PDFs are deleted from our storage 180 days after delivery. Keep your copy.
• A record of each payment and delivery (dates, amounts, message IDs; no birth details) is kept for 545 days, to answer payment disputes.
• Payment records are kept by Stripe as the law requires.

Who processes it

• Cloudflare hosts the site, runs the order system and stores card PDFs. Data may be processed in the United States.
• Stripe takes payments.
• YouTube plays the booth video on the partners page, only after you press play.
• Google Analytics counts visits and which pages and buttons are used, so we can see what works. It gets the page path and campaign tags only: never your name, birthday, birthplace, email or order details. Google sets its own cookies for this; you can block them with your browser or a tracker blocker and the site still works.
• Our mail server sends your card. Cards are sent from our own mail server ([email protected]).
• Birthplace lookup happens on our own server. As you type a birthplace, the letters go to our order system (on Cloudflare), which searches a list of towns and cities we keep ourselves. No outside place-name or time-zone service is asked, and the letters you type are not stored. The list comes from GeoNames (CC BY 4.0).

What we don't do

No selling or sharing of your data. No marketing emails unless you separately sign up for them. Your birth details, name and email are never sent to analytics. Buying a card gives us no permission to market to you.

The Midway Mailbag (email updates)

If you sign up for The Midway Mailbag, here is what happens to your details:

• What we store: your email address; your first name, region and the kinds of updates you picked, if you gave them; and a record of your consent: when you agreed, the wording you agreed to, and the page you signed up on.
• Double opt-in: we send one email with a confirm link. You're not on the list, and we send nothing else, until you click it. Unconfirmed signups are deleted after 7 days.
• What we send: fair, festival, midway and attraction updates, about twice a month in fair season and less in winter. Nothing about your card, and nothing from anyone else.
• Unsubscribe: every email has a one-click unsubscribe link, and we stop straight away.
• Deletion: ask us and we'll delete your Mailbag record entirely, not just mark it unsubscribed. Write to [email protected].
• Who sends it: Scott Astle, o/a The Midway Machine, 3817 Trail Pl, Powell River, BC, Canada, V8A 5L3, from our own mail server.

Signing up for the Mailbag is separate from buying a card. Buying a card never adds you to the list.

Your choices

You can ask us to see or delete your details at any time: reply to your order email, or write to [email protected].