PRIVACY POLICY
1. Introduction
This Privacy Policy explains what personal information The Quiet Card (HabiLink LLC, “we,” “us,” or “our”) collects when you visit thequietcard.com (the “Site”) and place an order, how we use and share that information, and the choices you have regarding your personal information.
We do not use analytics or advertising trackers on the Site. Your shopping bag is stored in your own browser, not on our servers.
2. Information We Collect
2.1 Information you provide. When you place an order, we collect:
- Your name
- Your shipping address
- The address you entered at checkout
- The address suggested by our verification service (Google’s Address Validation API), if one was shown
- The disclosure text you agreed to and the time you checked the box at checkout
Note on email: Your email address is collected by Stripe at checkout and is retained by Stripe under its privacy policy. It does not enter our database. See §2.3 below.
2.2 Information collected automatically. When you place an order, we also collect:
- Your IP address
- Your browser user agent
- The Google Place ID associated with your validated address
2.3 Information from payment processing. We use Stripe to process payments. Stripe collects and processes your payment card information. We do not store your card number, expiration date, or CVV on our servers. See Stripe’s Privacy Policy for information about how Stripe handles your payment data.
3. How We Use Your Information
We use your personal information to:
- Process and fulfill your order: We transmit your name and shipping address to our fulfillment provider so they can ship your order.
- Verify your shipping address: We send the address you enter (not your name, email, or order details) to Google’s Address Validation API to check whether the address is deliverable and to suggest a standardized version.
- Process payments: We transmit payment information to Stripe. Your email address is collected and retained by Stripe, not by us.
- Charge address-correction fees: If you selected your entered address over a suggested alternative and the address is determined to be incorrect, we may charge your payment method the correction fee you authorized at checkout, using Stripe’s off-session payment capability.
- Respond to disputes: We retain consent evidence (including the disclosure text you agreed to, the time you checked the box, your selected address, and your IP address) to defend against payment disputes and chargebacks.
- Communicate with you: We email you from support@habilink.com only in the following circumstances: (a) to notify you of a shipping delay as required by the FTC’s Mail Order Rule; (b) to notify you of an address-correction charge; or (c) to respond to a message you sent us. We do not send order-confirmation or shipping-tracking emails. Stripe sends you a payment receipt at the time of purchase and a refund receipt when we process a refund; those emails come from Stripe, not from us.
We do not use your personal information for advertising or analytics. We do not sell your personal information.
4. How We Share Your Information
We share your personal information with the following recipients:
| Recipient | What they receive | Purpose |
|---|---|---|
| Google (Address Validation API) | The address as entered (not your name, email, phone, or order details) | To validate your shipping address and suggest a standardized version |
| Stripe | Payment information and email address | To process your payment and enable off-session correction-fee charges |
| Our fulfillment provider | Your name and shipping address | To fulfill your order |
| Neon | All order data (name, shipping address, address-verification records, consent evidence, IP address, browser user agent, Google Place ID) | To host our order database |
| Resend (email delivery service) | Recipient’s name and shipping address (in an internal fulfillment note sent only to us, never to the buyer) | To deliver internal fulfillment notifications to the Company when an order is paid |
| Vercel Inc. (website hosting) | IP addresses, browser user agents, and request data in the ordinary course of hosting; checkout request data (your name and shipping address) processed by our application code running on Vercel’s servers; runtime logs that may temporarily contain order fulfillment data (recipient name, shipping address, and items ordered) | To host the storefront website, run server-side application code (including checkout processing and scheduled maintenance jobs), and maintain runtime logs |
Note on runtime logs. Our server writes each paid order’s fulfillment note to Vercel’s runtime logs before emailing it to us. These logs may contain the recipient’s name, shipping address, and items ordered. We can view these logs for one day on our hosting plan. Vercel processes this data as a service provider under its Data Processing Addendum. We recommend that buyers concerned about data minimization be aware that order information may be temporarily present in our hosting provider’s logs.
Note on Google Maps. This application uses Google Maps features and content. Use of Google Maps features and content is subject to the Google Maps/Google Earth Additional Terms of Service and the Google Privacy Policy.
Service providers. Each of the recipients listed above acts as a service provider or processor on our behalf. They are contractually obligated to use your personal information only for the purposes for which we share it and to protect it in accordance with applicable privacy laws. Stripe certifies that it will not sell or share California personal information, as stated in Stripe’s Data Processing Agreement. Neon certifies its role as a Service Provider under the CCPA in its Data Processing Agreement. Vercel acts as a service provider under the CCPA, as stated in its Data Processing Addendum (Schedule 4, California Terms), which applies to our Pro plan.
5. Data Retention
We retain your personal information for the following periods:
| Item | Retention Period | Basis |
|---|---|---|
| Consent evidence (disclosure text, checkbox timestamp, selected address, IP address, browser user agent) | 18 months | Chargeback dispute defense and legal compliance |
| Terms-acceptance record (version, timestamp) | 5 years | Contract enforcement and legal compliance |
| Google Place ID | Indefinitely | Permitted by Google’s API policies (exempt from caching restriction) |
| Google’s raw validation response (API JSON) | 30 days | Required by Google’s Maps Platform Service Specific Terms; deleted after 30 days |
| Name, shipping address | 18 months after order completion | Customer service and dispute resolution |
| Email address | Not retained by us (retained by Stripe per its privacy policy) | N/A |
| Payment data | Not retained by us (retained by Stripe per its privacy policy) | N/A |
Note: The Company has not yet built the automated deletion job for name and shipping address data. It will be built before the first order reaches 18 months of age. The 18-month consent-evidence period and the 5-year Terms-acceptance period are already recorded per order.
Note on Vercel runtime logs: Vercel may retain runtime log data containing order information for a limited period in accordance with its own retention practices, as governed by its Data Processing Addendum. Our access to these logs is limited to one day on our plan. The Company’s retention periods in this table apply to data in our own database (hosted by Neon), not to Vercel’s log retention.
6. Your Privacy Rights (California Residents)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):
6.1 Right to Know. You may request that we disclose the categories of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it.
6.2 Right to Delete. You may request that we delete the personal information we have collected from you. However, we may retain certain information if necessary to comply with a legal obligation. Specifically, if you submit a deletion request, we will:
- Delete all personal information not subject to a legal-obligation exception, including your name, email address, and shipping address used for marketing or future orders.
- Retain the following for the periods stated in §5, because they are necessary to comply with our legal obligations (including defending against payment disputes and chargebacks):
- The consent-evidence record (disclosure text, checkbox timestamp, selected address, IP address) for 18 months.
- The Terms-acceptance record for 5 years.
- The Google Place ID (retained indefinitely as permitted by Google’s API policies).
- Refrain from using any retained information for any purpose other than the legal obligation for which it is retained.
- Inform you of the basis for the partial denial of your deletion request, including the specific legal obligation that requires retention.
This exception is authorized by California Civil Code § 1798.105(d)(8), which provides that a business is not required to delete personal information if deletion would prevent the business from complying with a “legal obligation.” See CCPA § 1798.105.
6.3 Right to Opt Out. You have the right to opt out of the “sale” or “sharing” of your personal information. We do not sell or share your personal information as defined by the CCPA.
6.4 Right to Non-Discrimination. We will not discriminate against you for exercising your privacy rights.
6.5 How to Exercise Your Rights. To exercise any of these rights, please contact us at privacy@habilink.com. We will verify your identity before processing your request and will respond within 45 days, as required by law.
7. Children’s Privacy
We do not knowingly collect personal information from children under 13. If you believe we have collected personal information from a child under 13, please contact us at privacy@habilink.com.
8. Security
We take reasonable measures to protect your personal information from unauthorized access, use, or disclosure. However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on the Site and updating the “Last revised” date at the top. We will not reduce your rights under this policy without your consent.
10. Contact
If you have questions about this Privacy Policy, please contact us at privacy@habilink.com.