Privacy Policy
NEXTUP is operated by My Company ("NEXTUP", "we", "us"), United States. This policy explains what we collect when you use nextup.theaifoundry.net, how we use it, and the choices you have. Questions: privacy@theaifoundry.net.
Who uses NEXTUP
NEXTUP is for parents and guardians buying personalized trading cards for athletes, and for adult athletes buying their own. Only people 18 or older may upload photos, give consent or place orders. Athletes under 18 may help design a card only with a parent or guardian.
What we collect
| Information | Example | Why |
|---|---|---|
| Athlete photo | The picture you upload | To make the card |
| Card details | Name, jersey number, team, position, season, message, optional stats | Printed on the card |
| AI artwork | Images made from the photo | Card artwork you choose |
| Contact and order details | Guardian name, email, phone, shipping and billing address | To process, ship and support the order |
| Consent record | What you agreed to, when, and which policy version | To show we had permission |
| Payment | Handled by Stripe; we see only the card brand and last 4 digits | To take payment |
| Site usage | Pages visited, device and browser type, IP address | Security, fraud prevention and fixing problems |
Before a photo is uploaded, your browser removes its location and other hidden details. We don't collect biometric templates and we don't use facial recognition to identify anyone.
How we use it
Only to make, preview, review, print, ship and support your order, to send order emails, to prevent fraud and abuse, and to meet legal obligations. We do not sell personal information, use it for targeted advertising, or use athlete photos or cards in our marketing without separate written permission.
Who we share it with
We share only what each service needs to do its job for us:
- OpenAI, to create AI card artwork from the athlete's photo (not used for the Classic card). OpenAI processes it for us and does not use it to train its models.
- Stripe, to process payments.
- Printing: we print and ship cards ourselves. If we later use a print partner, they will receive only the print files and shipping address, and we will update this policy first.
- Brevo, to send order and shipping emails.
- Shipping carriers, to deliver the order.
- Hosting and security providers (including Cloudflare) that run the site.
We may also disclose information if the law requires it or to protect someone's safety.
Children's privacy
NEXTUP does not let children under 13 create accounts, upload photos or place orders. When a card is for an athlete under 13, a parent or guardian provides the photo and details, confirms consent by email, and pays with their own payment card before we process the photo. The guardian's consent separately covers sharing the photo with OpenAI to create artwork; a guardian who declines that can choose the Classic card.
A parent or guardian can at any time ask to see what we hold about their child, ask us to delete it, or withdraw consent, by writing to privacy@theaifoundry.net. Withdrawing consent before printing cancels the order and we delete the photo; we will refund it in line with the Terms of Service.
How long we keep it
| Information | Kept until |
|---|---|
| Original photo and AI artwork | 5 days after the order is delivered |
| Photo for an unconfirmed under-13 consent | 48 hours after upload |
| Photos from abandoned designs (no order) | 7 days after upload |
| Print files | 5 days after the order is delivered |
| Digital card and its share page | 365 days after the card is approved, or sooner if you ask us to remove it |
| Order, invoice and consent records | As long as tax and accounting law requires (7 years) |
After these periods we delete the data or keep it only in a form that no longer identifies anyone. After photos are deleted we cannot reprint an order without a new upload.
How we protect it
Photos and print files are stored privately. They can be reached only by NEXTUP staff who handle orders, by the services listed above, and by you through private links we send only to you. Connections use encryption (HTTPS). We keep a written information security program for children's data.
Your choices and rights
You can ask to access, correct or delete your information, or withdraw consent, by writing to privacy@theaifoundry.net. We reply within 30 days. Depending on where you live (for example, California), you may have additional rights; we will honour them as the law requires. We don't respond to browser "Do Not Track" signals, but we don't track you across other sites.
Changes
If we change this policy in a way that affects how we use children's information, we will ask parents for new consent before applying the change to their child's data.