Privacy Policy
This policy describes personal information handling for the current CardFaceDB service. Reading or accessing this page does not constitute blanket consent. Please do not submit full card numbers, security codes, passwords, identity documents or other unnecessary sensitive information.
1. Scope and contact
This policy concerns information handled through the Website and its submission or rights-request mailbox. CardFaceDB receives related enquiries at the address below. Independently operated issuer websites and external services have their own processing responsibilities and privacy notices.
2. Information categories and purposes
Browsing and downloads do not require a public user account. Searches and filters are transmitted in page requests to retrieve results. The application increments per-card view and download totals; these counters do not themselves store a visitor identity or individual browsing history. Language preferences and session identifiers support continuity of the service. If you email the Website, your address, message, attachments and associated email metadata are used to review submissions, respond and address rights claims.
3. Cookies and session continuity
The cardshare_admin cookie identifies a server-side session. Public pages also initialize this session and store language preferences; for authenticated administrators it additionally supports login state, with session data used for security verification. It is normally a session cookie, subject to browser and server session settings. Selecting a language sets cardfacedb_lang to zh or en with a 365-day expiry from that selection. You may clear or block cookies in your browser, which may reset preferences or impair administrator access. The current application does not integrate third-party advertising or analytics scripts.
4. Infrastructure and technical records
Hosting infrastructure may process IP addresses, request paths and query strings, timestamps, browser information and error records for delivery, troubleshooting and security. The records actually retained and their retention periods depend on deployment configuration and provider arrangements. Search terms may therefore appear in access logs; avoid entering sensitive information into searches or URLs. The absence of advertising scripts does not imply the absence of infrastructure logs.
5. Purpose limitation and lawful basis
Processing is limited to providing requested functions, reviewing submissions, communicating, protecting service security and fulfilling applicable legal obligations. The appropriate lawful basis must exist for each purpose; where consent or separate consent is legally required, it must be obtained before the relevant processing. Access alone does not authorize unrelated marketing, profiling or disclosure. Material changes to purposes, methods or categories require renewed notice and, where applicable, consent.
6. Publication, providers and disclosures
Approved card submissions are intended for public display and download. Remove names, card numbers and identifiable image metadata before submission; do not submit material containing another person’s information without a lawful basis. Hosting and email providers may process information as necessary to deliver their services. Other disclosures require an appropriate lawful basis and any required notice or consent, except where a lawful exemption applies. Following an external link transmits a request to that provider under its own practices.
7. Retention and deletion
Apart from the stated language-cookie expiry, session and technical-log lifetimes depend on configuration. Correspondence and supporting materials should be retained only for the shortest period necessary for review, responses, rights claims or legally required preservation. When that purpose ends, information should be deleted or anonymized unless retention remains legally required; retained information should be restricted to permitted purposes. Cookie deletion does not itself remove emails, logs or published materials; requests about those records may be sent below.
8. Individual rights and verification
Subject to applicable law, you may request access, copies, correction, deletion, restriction of processing, an explanation of processing rules or withdrawal of consent for consent-based processing. Identify the relevant message or page and your requested action. Only proportionate information necessary to verify the request should be required; do not initially send identity documents or payment credentials. Requests will be addressed within applicable statutory periods, with reasons provided for any lawful refusal. Withdrawal does not retrospectively invalidate prior lawful processing. Regulatory complaints and other statutory remedies remain available.
9. Security, sensitive information and minors
No internet transmission or storage method is entirely risk-free. Reasonable safeguards and legally required incident response obligations remain applicable notwithstanding this statement. The service does not require financial credentials or identity documents for browsing. If unnecessary sensitive information or a minor’s personal information is submitted, contact the Website to arrange appropriate handling; any necessary processing remains subject to applicable safeguards and guardian consent requirements.
10. Processing locations and policy revisions
Hosting and email processing locations depend on the deployed providers and are not established by the application code alone. Where cross-border processing occurs, required recipient and location disclosures, safeguards and consent procedures must be completed; this policy does not itself authorize a cross-border transfer. Material policy changes will be notified on the Website and any additional consent required by law obtained.
Contact for notices and requests[email protected]