Card GenieCard Genie
Create a Card
Sign in
← Privacy Policy

Service providers

Last updated: October 29, 2026

Card Genie (Blue Wave Development, LLC) uses the outside services below to run the site, make cards, take payment and ship orders. Each one receives only what it needs for that job. We do not sell your data. Where a detail below says “to confirm,” we are still collecting the provider’s written answer and will update this page.

Services that handle family and order data

  • Supabase

    Our database, sign-in and private file storage.

    What it receives
    Everything the service stores: accounts, orders, shipping addresses, uploaded photos and generated cards (in private storage).
    Children’s photos
    Yes — the uploaded photo
    Trains AI on our data
    Not an AI service
    Where
    to confirm

  • Vercel

    Hosts the website and runs its server code.

    What it receives
    Every request to the site passes through it, including uploads in transit; request logs (IP address, page address, browser).
    Children’s photos
    Yes — the uploaded photo
    Trains AI on our data
    Not an AI service
    Where
    to confirm

  • OpenAI

    Draws the card from the uploaded photo, and checks finished cards for mistakes (automated image review).

    What it receives
    The uploaded photo, the player details printed on the card (name, number, team), and the finished card images.
    Children’s photos
    Yes — the uploaded photo
    Trains AI on our data
    to confirm
    Where
    to confirm

  • fal.ai

    Image tools for printing: cutting the AI-drawn player out of its background, filling the print margin, foil masks and upscaling.

    What it receives
    AI-drawn card art, never the uploaded photo. For the print margin it receives only the card’s outer edges, with the middle of the card blanked out.
    Children’s photos
    AI-drawn card art only, never the uploaded photo
    Trains AI on our data
    to confirm
    Where
    to confirm

  • Stripe

    Takes payments and calculates sales tax; pays leagues and partners.

    What it receives
    Name, email, billing and shipping address, order amounts. Card numbers go to Stripe directly — we never see them.
    Children’s photos
    No
    Trains AI on our data
    Not an AI service
    Where
    to confirm

  • QPMN (QP Market Network) — print partner

    Prints and ships the physical cards.

    What it receives
    The card images to print, the recipient’s name and shipping address, and our order number.
    Children’s photos
    AI-drawn card art only, never the uploaded photo
    Trains AI on our data
    Not an AI service
    Where
    to confirm

  • EasyPost

    Shipping labels and tracking for orders we ship ourselves.

    What it receives
    Recipient name, shipping address, and package details.
    Children’s photos
    No
    Trains AI on our data
    Not an AI service
    Where
    to confirm

  • Resend

    Sends order confirmations, card previews, reminders and (from a separate account) league marketing email.

    What it receives
    Email address, name, and the email’s content, which can include a watermarked card preview.
    Children’s photos
    AI-drawn card art only, never the uploaded photo
    Trains AI on our data
    Not an AI service
    Where
    to confirm

  • Sentry

    Error reports so we can fix bugs.

    What it receives
    Technical details of errors (page address, browser, the code that failed). Set to send no personal information by default.
    Children’s photos
    No
    Trains AI on our data
    Not an AI service
    Where
    to confirm

  • Google (Analytics, Tag Manager, reCAPTCHA, Ads)

    Site analytics, spam and bot protection, and — with advertising consent — measuring whether our ads led to a purchase.

    What it receives
    Page visits and in-app events with private link codes removed; reCAPTCHA browser signals; for ad measurement, order value and the buyer’s email in one-way hashed form (see Advertising measurement).
    Children’s photos
    No
    Trains AI on our data
    to confirm
    Where
    to confirm

  • Meta (Facebook / Instagram ads)

    With advertising consent, measuring whether our ads led to a purchase.

    What it receives
    A page visit and purchase details from the browser tag; from our server, the order value, the ad-click identifier and the buyer’s email in one-way hashed form.
    Children’s photos
    No
    Trains AI on our data
    to confirm
    Where
    to confirm

Services used only for leagues and our own staff

These never receive a family’s photos, cards or order details.

  • Mailgun

    Sales email to leagues, and receiving our print partner’s order-status emails.

    What it receives
    League contacts’ names and emails; the print partner’s order emails, which include order numbers and shipping addresses.
    Children’s photos
    No
    Trains AI on our data
    Not an AI service
    Where
    to confirm

  • HubSpot

    Our sales records for leagues and other organizations.

    What it receives
    Organization names and their contacts’ names and emails. No family or child data.
    Children’s photos
    No
    Trains AI on our data
    to confirm
    Where
    to confirm

  • EmailListVerify

    Checks that a league contact’s email address exists before we write to it.

    What it receives
    One league contact’s email address per check. No family or child data.
    Children’s photos
    No
    Trains AI on our data
    Not an AI service
    Where
    to confirm

Questions

See the Privacy Policy for how we use your data and your choices, or email orders@cardgenie.shop.