Privacy Policy

Last updated July 16, 2026

This is a draft template for a student project and is not legal advice.

This Privacy Policy explains how CardPals (“we”, “us”, or “our”) collects, uses, and protects your personal information when you use our website and services (the “Service”).

1. Information We Collect

Account information you provide, such as your username, email address, and password (stored in hashed form).
Order information, including items purchased, order history, and delivery details.
Technical information, such as your IP address, which we record for security and audit purposes.
Usage information about how you interact with the Service.

2. How We Use Your Information

to create and manage your account and authenticate you;
to process and fulfil your orders;
to maintain security, prevent fraud, and keep audit logs of sensitive actions;
to communicate with you about your account, orders, and service updates;
to comply with our legal obligations.

3. Cookies and Sessions

We use cookies that are strictly necessary to keep you signed in and to secure your session (for example, session and CSRF cookies). These are required for the Service to function. We do not use them to track you across other websites.

4. How We Share Information

We do not sell your personal information. We may share it with service providers who help us operate the Service (such as hosting and payment processing) under appropriate confidentiality obligations, or where required by law.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements.

6. Security

We take reasonable technical and organisational measures to protect your information, including encrypted connections, hashed passwords, and access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, or delete your personal information, or to object to certain processing. You can manage some of this from your account settings, or contact us at [privacy@cardpals.example].

8. Children’s Privacy

The Service is not directed to children under [16], and we do not knowingly collect personal information from them.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date above.

10. Contact

If you have questions about this Privacy Policy, contact us at [privacy@cardpals.example].