Privacy Policy
Last Updated: 2025.10.08
1. Introduction
Welcome to Facewish ("we," "our," "us," or "Facewish"). We are Spicy Trading Limited, a company registered in Hong Kong, and we operate the website facewish.com (the "Service"). Our Service allows you to create personalized digital greeting cards and invitations using high-quality templates and our AI-powered design tools.
This Privacy Policy describes how we collect, use, and protect your personal data when you use our Service. It also explains how we process, on your behalf, the personal data of your card recipients ("Recipients").
Specifically, this policy outlines our practices concerning:
- Data Collection
- Data Uses
- Data Location & Transfer
- Data Retention
- Data Sharing & Disclosure
- Cookies and Tracking
- Your Data Rights
- Data Security
- Contact Us
Your privacy is important to us. Please read this policy carefully. By using our Service, you agree to the practices described herein. If you do not agree, please discontinue use of our Service.
2. Information We Collect
We collect information to provide, secure, and improve our Service.
Information You Provide:
- Account Data: When you register, we collect your name and email address.
- User Content and Face Library: This includes the photos you upload, the personal messages you write in your cards, and the AI-generated cutouts of faces (the "Face Library"). When you upload a photo, our AI provider processes it to create a cutout, and this cutout is stored in your personal Face Library to facilitate easy creation of future cards.
- Recipient Data: When you send a card, you provide us with the recipient's email address.
- Billing Information: Our payment processor Stripe collect your payment details. We only receive and store non-financial transaction data (e.g., your name, billing address, and the items purchased).
Information Collected Automatically:
- Technical & Usage Data: When you use our Service, we automatically collect data such as your IP address, browser type, device type, and information about your interactions with our Service (e.g., clicks, page views).
Information from Third-Party AI Service:
- AI Processing Data: To provide our core face-integration feature, we transmit the photos you upload to our third-party AI provider, Picwish. Picwish processes the image solely to detach and integrate faces into our card templates and to generate the cutout for your Face Library. We have contractual agreements with Picwish to ensure they comply with applicable data protection laws, including the GDPR. The original uploaded photo is not retained by Picwish after processing. However, the resulting face cutout is stored by us (Facewish) in your account as part of your Face Library. You can review Picwish's privacy policy here: https://picwish.com/privacy-policy
3. How We Use Your Information
We use your data for the following business purposes:
| Purpose of Processing | Legal Basis (where applicable) |
|---|---|
| To create your personalized cards using our AI technology. | Performance of a Contract |
| To create and maintain your personal Face Library for easy reuse. | Performance of a Contract, Legitimate Interests |
| To operate, provide, and maintain the Service. | Performance of a Contract, Legitimate Interests |
| To send your cards to Recipients and manage RSVPs. | Performance of a Contract |
| To communicate with you (e.g., service updates, customer support). | Performance of a Contract, Legitimate Interests |
| To personalize your experience and improve our Service. | Legitimate Interests |
| For security, fraud prevention, and to comply with legal obligations. | Legitimate Interests, Legal Obligation |
| To send promotional communications (you can opt-out at any time). | Consent |
4. Data Location and International Transfers
Spicy Trading Limited is headquartered in Hong Kong. Your personal data is processed and stored in Hong Kong and may also be processed in other countries where our service providers (including our AI API provider, Picwish) are located.
When we transfer your personal data outside of Hong Kong, especially to jurisdictions with different data protection laws, we implement appropriate safeguards, such as standard contractual clauses, to ensure its protection. By using our Service, you consent to this transfer and storage.
5. Data Retention
We retain your personal data only as long as necessary for the purposes outlined in this policy.
- Account Data and Face Library: We retain this for as long as your account is active. When you delete your account, your Face Library and all associated personal data are permanently deleted from our servers.
- Uploaded Photos: Original uploaded photos are deleted from our systems and our AI provider's systems shortly after the face cutout is created (typically within 24-48 hours).
- Recipient Data: We retain recipient email addresses to deliver the card and, if applicable, track RSVPs.
We may retain certain data for longer periods to comply with legal obligations or resolve disputes.
6. Data Sharing and Disclosure
We do not sell your personal data. We may share it in the following limited circumstances:
- Service Providers: We engage trusted third-party companies ("Processors") to perform services on our behalf. This includes:
- Our AI API Provider, Picwish, for face-integration processing. Picwish's processing is governed by their privacy policy, available at https://picwish.com/app-privacy
- Cloud Hosting and infrastructure providers.
- Payment Processors to handle transactions.
- Analytics and marketing partners to help us understand Service usage.
These partners are contractually bound to use your data only to provide services to us and to protect it.
- Legal Obligations: We may disclose your data if required by law, such as to comply with a subpoena or similar legal process.
- Protecting Rights: We may disclose data if we believe it is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud.
- Business Transfers: In connection with a merger, acquisition, or sale of all or a portion of our assets, your data may be transferred.
7. Cookies and Tracking Technologies
We use cookies and similar technologies to analyze trends, administer the website, and track users' movements around the site. You can control the use of cookies at the individual browser level. Please note that if you choose to disable cookies, it may limit your use of certain features or functions on our website.
8. Your Data Protection Rights
Depending on your location, you may have the following rights regarding your personal data:
- The right to access and receive a copy of your personal data.
- The right to rectify (correct) inaccurate personal data.
- The right to erasure (deletion) of your personal data.
- The right to restrict or object to our processing of your personal data.
- The right to data portability.
To exercise any of these rights, please contact us at support@facewish.com. We will respond to your request in accordance with applicable law. Please note that we may need to verify your identity before processing your request. Note that deleting your Face Library or other personal data may adversely affect your use of our Service.
9. Data Controller/Processor
- For User Data: Spicy Trading Limited ("Facewish") is the "data controller" for the personal data you provide as a User of our Service, including your Face Library.
- For Recipient Data: When you use our Service to send a card, you are the "data controller" for your Recipients' data (like their email address). We process this data on your behalf as a "data processor." It is your responsibility to ensure you have the necessary legal basis (e.g., consent) to provide this data to us.
10. Data Security
We implement industry-standard administrative, technical, and physical security measures designed to protect your personal data, including your Face Library. However, no method of transmission over the Internet or electronic storage is 100% secure. Therefore, while we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.
11. Children's Privacy
Our Service is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you become aware that a child has provided us with personal data, please contact us. We will take steps to delete such information from our files.
12. Updates to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. We encourage you to review this policy periodically.
13. Contact Us
If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us at: