Privacy policy

Overrask is a service for digital greeting cards that can be played, shared and ordered as printed cards. Here we describe which personal data we process, why, who receives it, how long we keep it and what rights you have under the General Data Protection Regulation (GDPR).

We only collect what the service needs to work. We never sell personal data.

1. Data controller

Company: [Company name]
Company registration number: [Registration number]
Address: [Postal address]
Email: [email protected]
Customer service: Contact us

2. What data we process

2.1 Your account

• Name and email address.
• Password, which is only stored as a salted hash and can never be read.
• Profile picture, if you upload one.
• If you sign in with Google, we receive your name and email address from Google.
• One-time codes sent to your email when you register, sign in with a code or reset your password.
• If you have Premium: the subscription status, start date and currency, and the reason you give if you cancel.
• If you have chosen to receive our newsletter: that you said yes and when.

2.2 The cards you create

• What you put in a card: texts, messages, images, video, music and sound, choices in games and quizzes, and the card's settings.
• How many times the card has been opened and when it was last opened.
• While you work, a draft is saved in your own browser, so nothing is lost if you close the tab.

2.3 When someone opens your card

• Guest book and RSVP: if you turn them on, guests can leave a name, a message, whether they are coming, the number of people and optionally their email address. You, as the creator, see the replies.
• Play together: those who join enter a name and can vote. The room and the votes are only used while the card is being played.

2.4 Orders of printed cards

• Your name, email address and phone number.
• Delivery address, or the recipients' addresses if you send the cards to one or more people.
• Chosen pickup point, if you collect from one.
• The message printed in the card and which digital card the QR code leads to.
• What you bought, price, discount, payment status, shipping and tracking number.

We never receive card details. Payment is made with Stripe.

2.5 Customer service and the chat

• When you contact us we save your name, email address, the case and the messages, with a case number.
• The chat on the site answers by itself based on our help texts. Questions it cannot answer are saved without name or account, so we can improve the answers.

2.6 Statistics, cookies and technology

• Necessary: login, security, language, your cookie choice, the cart and drafts.
• Statistics, if you accept: we measure ourselves how the site is used. Nothing is sent to Google or anyone else.
• Country: we use your IP address to see which country you are in, so prices are shown in the right currency. We do not store the IP address.
• Ads: without Premium, a short video ad from Google may be shown before you get the link to your card.

Read more in our cookie policy.

3. Why we process the data

You can withdraw consent at any time via Cookie settings at the bottom of the page or in your account.

4. Who we share data with

We use a few carefully chosen providers. They only receive the data they need and process it on our behalf or under their own policy.

When data is transferred to the USA it is protected by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

We also disclose data to authorities when the law requires it.

5. Who can see your cards

Every card has its own long, random link that cannot be guessed. Anyone with the link or QR code can open the card. Only share it with the people you want to see the card. We cannot stop a recipient from passing the link on.

If you add names, photos, video or voices of other people, you are responsible for having permission. Take extra care with material about children.

6. How long we keep the data

• Account: as long as you keep the account.
• Cards: as long as you keep them. Cards that have been neither edited nor opened for 24 months are deleted automatically.
• Guest book and RSVP: as long as the card exists.
• Play together: only while the card is being played.
• One-time codes: deleted after 15 minutes.
• Orders: what Swedish bookkeeping law requires is kept for 7 years. If you delete your account, names, addresses, phone numbers and messages are removed from the orders.
• Customer service cases: as long as needed to help you.
• Statistics: at most 13 months.
• Backups: at most 14 days.

7. Your rights

You have the right to know what data we have about you, to have it corrected, deleted or moved, to restrict or object to the processing and to withdraw consent.

• Under Account settings you can download your data and delete your account.
• Under My cards you can delete individual cards.
• For anything else, email [email protected]. We reply within one month.

You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or the data protection authority in your country.

8. Security

All traffic is encrypted (HTTPS). Passwords are stored as salted hashes, login is protected with secure cookies and all changes are protected against forged requests. Only authorised people have access to personal data.

9. Age

You must be at least 18 years old to create an account and order.

10. Changes

We update this policy when the service changes. The date is shown at the top. For larger changes we will notify you.