Privacy Policy
Effective Date: May 17, 2026 · Last Updated: October 19, 2026
🇺🇸 For residents of the United States
If you are a California resident, the California Consumer Privacy Act (CCPA/CPRA) gives you additional rights: the right to know what personal information we collect, the right to delete it, and the right to opt out of any sale or sharing of your data. ZuriCards does not sell or share your personal information for advertising purposes. To exercise your California rights or lodge a complaint, contact: California Privacy Protection Agency (CPPA).
1. Introduction
ZuriCards is an event planning system built for African celebrations. We help organizers manage guest lists, budgets, seating, check-in, celebration pages, save-the-date and thank-you cards, digital gifts, tickets, Aso Ebi orders, and guest messaging by SMS, email, and WhatsApp — all in one place.
This Privacy Policy explains what personal data ZuriCards collects, why we collect it, how we use and protect it, who we share it with, and what rights you have over your information. We have written this policy to be specific to how our platform actually works, not as a generic template.
By creating a ZuriCards account or using our platform in any capacity, you acknowledge that you have read and understood this policy. If you do not agree with any part of this policy, please do not use our platform.
2. Who We Are
ZuriCards is operated by TKH TECH Inc., a technology company headquartered in Toronto, Canada, serving users where they are, including Africa and the diaspora.
Data Controller: TKH TECH Inc. (trading as ZuriCards)
Headquarters: Toronto, Canada
Publisher details: see our Legal notice
Privacy Contact: privacy@zuricards.com
ZuriCards acts as the data controller for account holders (event organizers). For guest data entered by organizers, ZuriCards acts as a data processor on behalf of the organizer, who bears primary responsibility for the lawfulness of collecting their guests' information.
We process personal data in line with applicable rules where we operate, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, the EU General Data Protection Regulation (GDPR).
3. Data We Collect
We collect different categories of data depending on how you interact with ZuriCards.
3.1 Account Registration Data
When you create a ZuriCards account, we collect your full name (to identify your account), email address (for login, notifications, and communication), phone number (optional at registration; required if you use SMS features), and your password (stored as a cryptographic hash — never in plain text).
Legal basis: Contractual necessity. This data is required to provide you with a ZuriCards account.
3.2 Celebration and Event Data
When you create a celebration page, we store your event details (name, type, date, time, venue), custom content (messages, descriptions, design choices), and photos and media you upload for your celebration page, save-the-date cards, or thank-you cards.
Legal basis: Contractual necessity and your explicit consent through use of the platform.
3.3 Guest Data (Entered by Organizers)
When you use our guest management features, you may enter your guests' personal data, including names, email addresses, phone numbers, and mailing addresses collected through the contact form. That can include children who are guests or the reason for the celebration. This data is used to deliver communications you start and to manage RSVPs. See Section 7 (Guest Data) and Section 11 (Children).
Legal basis: Legitimate interest of the organizer in communicating with their guests, combined with our contractual obligation to the organizer.
3.4 RSVP and Response Data
We collect RSVP responses submitted by guests, including attendance status, guest-submitted notes or dietary preferences (if enabled), and timestamp of response.
Legal basis: Contractual necessity to deliver the platform's core RSVP functionality.
3.5 Aso Ebi Order Data
When you use the Aso Ebi ordering feature, we collect fabric style and quantity selections, delivery or pickup preferences, and contact information for delivery coordination.
Legal basis: Contractual necessity.
3.6 Payment Metadata
ZuriCards uses licensed payment processors to handle checkout. When a payment is processed, we receive a transaction reference, amount, currency, timestamp, and payment status. We do not receive, store, or transmit raw card numbers, CVV codes, bank account numbers, or mobile money PINs. That sensitive financial data is handled exclusively by the payment processors under their own security frameworks.
Legal basis: Contractual necessity and legal obligation (financial record-keeping requirements under applicable law).
3.7 Usage and Technical Data
When you use the ZuriCards platform, we automatically collect your IP address (for security and fraud prevention), browser type and device information (to ensure the platform works correctly), page navigation data (to help us improve the product), and error logs (to identify and fix technical issues).
Legal basis: Legitimate interest in maintaining a secure and functional platform.
3.8 Communications Data
If you contact us through support channels, we retain the content of that communication and your contact details for as long as needed to resolve your query, and for up to two years thereafter for quality assurance purposes.
3.9 Sensitive Content in Events
ZuriCards does not require users to disclose their religion, ethnicity, or cultural background. However, because our platform is built for African celebrations, event names and descriptions may incidentally reflect religious or cultural affiliations (for example, a church wedding or an Islamic naming ceremony). We do not use this type of incidental content for profiling or behavioral targeting, and we do not share it with third parties for those purposes.
Legal basis: Not applicable — this data is user-generated content incidental to the service.
4. How We Use Your Data
We use the data described above for the following purposes:
| Purpose | Data Used |
|---|---|
| Creating and managing your account | Name, email, hashed password |
| Delivering invitation cards (email and digital) | Guest email addresses, event details |
| Sending SMS and WhatsApp messages to guests | Guest phone numbers and the message you send |
| Optional writing, seating, and guest-list assist | The text you submit, which can include guest names, phone numbers, email addresses, dietary notes, and seating notes |
| Processing payments for tickets, gifts, and orders | Payment metadata from our payment processors |
| Managing RSVPs and guest lists | Guest names, RSVP responses |
| Coordinating Aso Ebi orders | Order data, delivery contact details |
| Sending emails you need for the product (confirmations, receipts, password resets) | Email address |
| Detecting and preventing fraud and abuse | IP address, usage data |
| Improving the platform and fixing bugs | Usage data, error logs |
| Complying with legal obligations | Payment records, account data |
| Responding to support requests | Communications data |
· We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.
· We do not use your data for targeted advertising or sell it to advertisers.
5. Data Sharing and Third Parties
ZuriCards does not sell your personal data. We share data only where necessary to operate the platform, under contractual obligations that protect your information.
5.1 Payment processors
Role: Licensed processors for mobile money, card, and related checkout methods
Data shared: Transaction reference, amount, currency, and payer/payee identifiers needed to complete a transaction
Why: You initiate a payment on ZuriCards; the processor completes it on our behalf. We may use more than one processor and can change them over time.
5.2 Email providers
Role: Email delivery providers under contract with us
Data shared: Recipient email address, sender address, and email content (invitation text, confirmations, password reset links)
Why: To send confirmations, receipts, and security emails on our behalf. Messages are encrypted while they travel to you.
5.3 SMS providers
Role: SMS providers operating where text messaging is supported
Data shared: Guest phone numbers and the SMS text you compose
Why: To deliver SMS invitations and reminders the organizer starts. ZuriCards does not keep its own STOP list. Some providers block further texts on their side after a recipient replies STOP. That block does not remove the number from the guest list.
5.4 Cloud hosting and storage
Role: Infrastructure providers under contract with us
Data shared: Platform data needed to operate ZuriCards (accounts, celebration content, media you upload, guest lists, RSVPs, and payment metadata)
Why: A celebration is stored once: in Canada for a Canadian account, in the United States for a US account, and in the European Union (France) for Europe and everyone else. Accounts and sign-in stay in France. Celebrations created before this split stay in France. The application that reads a celebration runs in France, so a request loads that celebration from its home region into France for the duration of the request. The stored copy stays in the home region. These providers do not use the data for their own marketing.
5.5 Error monitoring
Role: Error monitoring provider (Sentry) under contract with us
Data shared: Stack traces, browser and page details, and request fields. Before a report is sent, we replace these request-body keys when present: password, token, secret, authorization, jwt, API key, credit card, CVV, SSN, and phone number. Names, email addresses, and other text in a report can still be included.
Why: To identify and fix technical issues affecting the Platform
5.6 WhatsApp
Role: Meta, which delivers WhatsApp messages
Data shared: Guest phone numbers and the WhatsApp message the organizer sends
Why: To deliver WhatsApp invitations and reminders the organizer starts
5.7 AI assist
Role: Our AI model provider, for optional writing, seating, and guest-list assist
Data shared: The text submitted for that assist, which can include guest names, phone numbers, email addresses, dietary notes, and seating notes
Why: To draft or parse content the account holder asks for. The provider can change. Guest data is not sent for ZuriCards marketing.
5.8 Google
Role: Sign-in, and analytics where described in Section 6
Data shared: Name, email, and profile photo when you sign in with Google. Analytics cookies where Section 6 says they load.
Why: To let you sign in, and to measure site use where analytics is on
5.9 Website hosting
Role: Vercel, which hosts the website
Data shared: IP address, request logs, and pages requested
Why: To serve the site. The site is delivered over a global content network, so a request can be handled outside your country.
5.10 Legal Disclosure
We may disclose personal data to law enforcement authorities, courts, or regulators in Canada or other relevant jurisdictions where we are legally compelled to do so, or where disclosure is necessary to protect the rights, property, or safety of ZuriCards, our users, or the public. We will notify affected users of such requests where we are legally permitted to do so.
6. Cookies
ZuriCards uses a limited and purposeful set of cookies. We do not use advertising cookies or allow third-party ad networks to set cookies through our platform.
6.1 Session Cookies (Essential)
We use session cookies to maintain your authenticated state while you are logged in. These cookies are set when you log in, deleted automatically when you close your browser or log out, and contain only a session token — not your password or personal details. You cannot opt out of session cookies while using authenticated features, because they are essential to the service.
6.2 Functional Cookies
We may set functional cookies to remember your preferences (such as language selection) between sessions. These are first-party cookies and are not shared with third parties.
6.3 No Third-Party Advertising Cookies
We do not permit advertising networks, social media platforms, or data brokers to set cookies on ZuriCards pages. We do not use Facebook Pixel, Google Ads tags, or similar advertising trackers.
6.4 Analytics Cookies (Consent-Gated)
We use Google Analytics 4 (GA4) via Google Tag Manager (GTM) to see which pages are visited. In Canada, the United Kingdom, and the European Economic Area, those tags load only after you accept analytics cookies. If you decline there, they do not load. In other countries, the tags load with the page. Declining on the banner sends a consent denial to the tag manager. You can clear cookies and choose again; see the Cookie settings page.
7. Guest Data
This section addresses the specific situation where an event organizer adds a guest's personal information to ZuriCards on that guest's behalf.
7.1 The Organizer's Responsibility
By entering guest data into ZuriCards, you represent that you have a legitimate basis for doing so — for example, that your guests have consented to receive your event communications, or that you have a genuine personal relationship with them that justifies sending them an invitation. The legal responsibility for ensuring that the use of each guest's data is lawful rests with the organizer.
7.2 What We Do with Guest Data
Guest data is used to deliver email, SMS, and WhatsApp messages the organizer sends, to record RSVPs, and to generate save-the-date or thank-you communications addressed to the guest. We do not use guest contact information to market ZuriCards.
7.3 Guest Rights and Opt-Out
Guests may contact us at privacy@zuricards.com to opt out of communications, request deletion of their data from our platform, or ask what data we hold about them. When a guest exercises these rights, we will respond within 30 days and coordinate with the relevant organizer where necessary.
ZuriCards does not keep its own list of numbers that replied STOP. Some carriers and SMS providers block further texts on their side after a recipient replies STOP, END, CANCEL, UNSUBSCRIBE, or QUIT. That block does not remove the number from the organizer's guest list, and a later message from ZuriCards can still be attempted. To stop messages stored on ZuriCards, email privacy@zuricards.com. We do not share mobile numbers with third parties for our own marketing. Phone numbers are still sent to the SMS provider, and to Meta when the organizer sends WhatsApp, so those providers can deliver the message.
8. Data Retention
We retain personal data for the minimum period necessary for the purposes described in this policy, and in accordance with our legal obligations.
| Category | Retention Period |
|---|---|
| Account data (name, email, settings) | While the account is active, then removed 30 days after a deletion request |
| Celebration content (pages, event details) | While the account is active, then removed 30 days after a deletion request |
| Event gallery photos | While the account is active. Removed with the celebration 30 days after a deletion request. No separate expiry while the account is open. |
| Guest names, emails, phone numbers | While the account is active, then removed 30 days after a deletion request |
| RSVP data | While the account is active, then removed 30 days after a deletion request |
| Payment metadata (transaction records) | 7 years from the transaction, including after account deletion |
| Support communications | 2 years from the communication |
| Application logs (IP addresses, errors) | 30 days in production |
Account deletion: When you delete your ZuriCards account, we remove the account and its celebrations, guests, and gallery photos from active systems 30 days later. You can cancel during those 30 days. Payment records are anonymized and kept for 7 years. Copies can remain in encrypted backups until those backups are overwritten.
9. Your Privacy Rights
Depending on where you live, you may have rights under PIPEDA, GDPR, or other applicable privacy laws. In general, you have the following rights with respect to your personal data:
Right of Access
You have the right to request a copy of the personal data ZuriCards holds about you, including information about how it is used, where it is stored, and with whom it has been shared.
Right of Rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. Many corrections can be made directly in your account settings.
Right of Deletion (Right to be Forgotten)
You have the right to request the deletion of your personal data where the data is no longer necessary for the purposes it was collected, you withdraw your consent, or you object to processing. We may be unable to delete data where we have a legal obligation to retain it (for example, payment records subject to the 7-year retention rule).
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, machine-readable format, and to have that data transmitted to another data controller where technically feasible.
Right to Object
You have the right to object to processing of your personal data where that processing is based on legitimate interest.
Right to Appeal
If ZuriCards declines your data rights request, you have the right to appeal that decision. Reply to our response email or write to privacy@zuricards.com with the subject line "Privacy Rights Appeal." We will review your appeal and respond within 30 days.
How to exercise your rights
Contact us at privacy@zuricards.com with your full name, the email address associated with your account, and a description of your request. We will respond within 30 days and may ask you to verify your identity before processing your request.
Appeals: If we decline your request, you may appeal by replying to our response email or writing to privacy@zuricards.com with the subject "Privacy Rights Appeal." We will review and respond within 30 days.
If you believe we have violated your data protection rights, you may lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) if you are in Canada, with your local EU/EEA supervisory authority if you are in the EU/EEA, or with another competent authority where you live.
10. Data Security
We implement technical and organizational measures appropriate to the risks involved in processing your data.
If we suffer a security breach that is likely to result in a risk to your rights and freedoms, we will inform affected users without undue delay where required by law. Where EU/EEA users are affected, we will notify the relevant EU supervisory authority within 72 hours where required under GDPR. Where Canadian users are affected and a real risk of significant harm exists, we will report to the Office of the Privacy Commissioner of Canada (OPC) as soon as feasible.
11. Children's Privacy
ZuriCards accounts are for adults. We do not offer accounts to children, and the service is not designed for a child to use on their own. Organizers do enter information about children who are guests or the subject of a celebration, including names and photos for birthdays, baptisms, communions, and baby showers. The organizer is responsible for having a basis to provide that information.
A parent or guardian who wants a child's data or photo removed can write to privacy@zuricards.com. We will coordinate with the organizer and respond within 30 days.
12. International Transfers
A celebration is stored once: in Canada for a Canadian account, in the United States for a US account, and in the European Union (France) for Europe and everyone else. Accounts and sign-in stay in France. Celebrations created before this split stay in France. The application that reads a celebration runs in France, so a request loads that celebration from its home region into France for the duration of the request. The stored copy stays in the home region. The website is served on a global content network, so a page request can be handled outside your country. Google receives sign-in details. Meta receives WhatsApp deliveries. SMS providers receive phone numbers and message text. Our AI model provider receives the assist text described in Section 5.7. We rely on contracts with those providers when data leaves your country.
13. Changes to This Policy
We may update this Privacy Policy from time to time as our platform evolves or as legal requirements change. When we make material changes, we will update the "Last Updated" date at the top of this document, post the revised policy on this page, and notify registered account holders by email where the changes are significant. Your continued use of ZuriCards after changes are posted constitutes your acceptance of the revised policy.
14. Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or the way ZuriCards handles your personal data, please contact us:
TKH TECH Inc. (trading as ZuriCards)
Headquarters: Toronto, Canada
Publisher details: Legal notice
Privacy Officer: TKH TECH Data Protection Lead — privacy@zuricards.com
Privacy inquiries: privacy@zuricards.com
General support: support@zuricards.com
For matters that cannot be resolved directly with us, Canadian residents may contact the Office of the Privacy Commissioner of Canada. EU/EEA residents may contact their local data protection authority. Users in other jurisdictions may contact the privacy regulator that applies where they live.