Privacy notice
Last updated 3 October 2026.
This notice explains what personal information SendBday collects, why, who we share it with, how long we keep it and what your rights are. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
SendBday (sendbday.com) is run by Chouaib Tahlouli, who is the data controller for the personal information described here. For anything about your data, email hello@sendbday.com.
The short version
- We store birthdays as a day and a month. We never ask for the year.
- We only use your information to run SendBday: your circle, your reminders and, if you use them, printed cards.
- We do not sell your information, we do not show adverts, and we use no advertising or tracking cookies.
- You can delete your account and everything in it from your dashboard at any time.
Whose information this covers
- Collectors: people who sign in and share a link so friends can add their birthdays.
- Friends: people who open a collector's link and add their own birthday, with or without an account.
- People added by someone else: a collector, or a friend using "add them", can type in someone's name and birthday. If that is you, see "If someone added your birthday" below.
- Card senders and recipients, if printed cards are used.
What we collect, and why
If you sign in (a collector)
- Your email address, used to sign you in with a one-time code or link and to send your reminders and service emails.
- Your name and the short web address of your circle (for example sendbday.com/c/sam).
- Your own birthday (day and month), if you give it.
- Your reminder settings, and who invited you, if you joined through someone's link.
- A private key for your calendar feed, so your calendar app can show your circle's birthdays.
Birthdays in a circle
- The person's name (and, if given, a last initial), and the day and month of their birthday.
- Optionally, how they know the collector, and a short wishlist of gift ideas.
- Whether the entry belongs to someone with a SendBday account, if they confirmed it is them.
- If someone suggests a different date for an entry, the suggested date, kept until the collector accepts or ignores it.
- A record of which reminders have been sent, so nobody is reminded twice.
Only the collector who owns a circle can see the birthdays in it. A friend who adds their birthday is told this on the form.
Printed cards
- Postal address: if you choose to receive cards, or someone gives an address for an entry, the address is encrypted before it is stored, with a key kept separately from the database. Senders never see it: at most they see a shortened version, with most of each word and half the postcode hidden.
- Your card choices: whether you want to receive cards at all, and anyone you have blocked from sending you one.
- Orders: the sender's first name and email, the recipient's name, the design, the message, the birthday date, the price, and references from our payment and printing providers.
- Payment: you pay on Stripe's own checkout page. We never see or store your card number; we keep only Stripe's reference for the payment.
- The print file: an image of the finished card, kept in private storage only until the card is dispatched or cancelled, and handed to the printer through a link that expires.
Keeping SendBday safe
- Our forms use Cloudflare Turnstile to tell people from bots. Cloudflare receives technical information about your browser and your IP address to do this.
- To stop sign-in emails being abused, we count recent requests per email address and per connection. Both are stored only as one-way hashes, never as the address or IP itself.
- Our hosting provider keeps short-lived server logs, which include IP addresses, to run and protect the service.
How SendBday is used
We record simple events, such as "a circle link was opened" (with the circle's name and, if the link had one, a tag saying where it was shared), "someone signed up" or "a reminder was sent". These records do not contain your email address or IP address. We use them to see whether SendBday works and to fix it when it does not.
Our lawful bases
| What | Lawful basis |
|---|---|
| Your account, circle, reminders, calendar feed and service emails | Contract: it is the service you asked for. |
| Card orders, payment, printing, posting, confirmation and dispatch emails | Contract. |
| Birthdays a collector or friend types in for someone else | Legitimate interests: remembering the birthdays of people you know is the purpose of the service, we hold the minimum (a name, a day and a month), and only the collector sees it. |
| Bot checks, sign-in limits, security logs and backups | Legitimate interests: keeping the service and your data safe. |
| Usage events | Legitimate interests: understanding and improving the service, using records without contact details. |
| Order and payment records kept for tax | Legal obligation. |
Where we rely on legitimate interests, you can object at any time (see "Your rights").
Who we share it with
We use these providers to run SendBday. Each acts on our instructions under a contract with data protection terms, and none may use your information for its own purposes.
| Provider | What they do | What they receive |
|---|---|---|
| Supabase | Database, sign-in and file storage | Everything SendBday stores, as described above |
| Vercel | Hosting the website and running scheduled jobs | Requests to the site, including IP addresses, in short-lived logs |
| Resend | Sending emails | Your email address and the content of the email |
| Stripe | Taking card payments | Your payment details, email address and the order amount |
| Prodigi | Printing and posting cards | The card image (with the message), and the recipient's name and postal address |
| Cloudflare | Bot protection (Turnstile) on our forms | Technical browser information and IP address |
| Google Fonts | Serving the site's typefaces | Your IP address and browser details when the page loads fonts |
| GitHub | Storing our encrypted daily database backups | An encrypted copy of the database, which it cannot read |
Prodigi passes cards to a postal service (such as Royal Mail) for delivery, which sees the name and address on the envelope. If a wishlist links to a shop, such as Amazon, that shop receives your visit only if you click the link. Some links carry our affiliate tag, so we may earn a small commission; this tells the shop nothing about you that the click itself does not. We may also share information if the law requires it, or to protect people from harm.
International transfers
Some of these providers are based in, or use servers in, the United States or the European Economic Area. Where information leaves the UK, it is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified) or by the UK International Data Transfer Addendum to standard contractual clauses.
How long we keep it
- Your account and circle: until you delete your account. Deleting it removes your profile, your circle, your address, your card choices and your reminder history straight away, and signs you out everywhere.
- Your birthday in someone else's circle: until that collector removes it, or you ask us to (see below). If you delete your account, your entry stays in circles you joined as a plain birthday that is no longer linked to you, so your friends still get their reminder.
- Card messages and recipient names: blanked 90 days after a card is dispatched or refunded.
- Print files: deleted when the card is dispatched or cancelled, and in any case within three days.
- Order and payment records (amounts, dates, references): six years, as UK tax law requires.
- Backups: encrypted, and kept for 14 days.
Cookies
We use only cookies that SendBday needs to work. There are no advertising, analytics or third-party tracking cookies, so we do not ask for cookie consent.
- Sign-in: keeps you signed in (set by Supabase).
- Sign-in in progress: remembers which address a sign-in code went to and where to send you afterwards, for up to an hour.
- Your details before sign-up: the name and birthday you just gave, and who invited you, so you do not have to type them twice.
- "Is this you?": a short-lived token, for up to two hours, that lets you confirm a birthday you added is yours.
- Time zone: so "3 days to go" counts from your own day.
- Visit marker: so a page you reload is not counted twice in our usage events.
Cloudflare Turnstile may set its own strictly necessary cookie while it checks a form.
If someone added your birthday
A friend may have typed your name and birthday into their circle so they remember it. We did not collect this from you, and we only hold your name (sometimes a last initial), the day and month, and anything the friend wrote about how you met. Only that friend sees it, and we do not contact you because of it. If you would like it removed, email hello@sendbday.com with the circle's link and we will remove it, or you can simply ask your friend to.
Your rights
Under UK GDPR you have the right to:
- ask for a copy of the information we hold about you;
- have anything inaccurate corrected;
- have your information deleted (you can delete your account yourself from your dashboard);
- object to, or ask us to restrict, how we use it;
- receive the information you gave us in a portable format.
Email hello@sendbday.com to use any of these. We will reply within one month, and it is free. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.
Children
SendBday is for people aged 13 and over. A parent may add a child's birthday to their own circle.
Security
Data is encrypted in transit and at rest. Postal addresses are encrypted again with a separate key. Access to the database is limited by row-level security, so each signed-in person can reach only their own information.
Changes to this notice
If we change how we use your information, we will update this page and its date, and tell you by email first if the change is significant.