Privacy Policy
What we collect when you make bingo cards, why, who helps us, how long we keep it, and what you can ask us.
Last updated: October 13, 2026
In short
- You can make cards without an account. We only ask for an email when you pay or ask us to email your PDF.
- We don't sell your data. We don't use your information for targeted ads. There are no advertising tags or third-party advertising trackers in your browser, and no cookie banner.
- Your description goes to an AI provider to write your list, and the item names go to another to draw the pictures.
- Sets you don't unlock are deleted 30 days after your last change.
Who is responsible
GETTIN, 229 rue Saint-Honoré, 75001 Paris, France, is the data controller for the processing described here (see the legal notice). Contact for any privacy question or request: hello@bingocardlab.com.
What we collect and why
Your visitor session
On your first visit, we create an anonymous visitor record and a session, so your sets stay on this device without an account. The session records your IP address and your browser's user agent. Why: to provide the service you ask for (contract). How long: the session lasts 30 days and is renewed while you use the site. Once it has expired and you have no sets left, we delete the visitor record and its sessions within a day.
What you type and what we make
Your description of the occasion, the item list, card titles and print settings, and the pictures drawn for your items. Why: to make your cards (contract). How long: sets you haven't unlocked are deleted 30 days after your last change, with their pictures unless another set still uses them. Sets in an account are kept while the account exists.
Please don't put sensitive information in your description. For a classroom or a party, first names are enough.
Free set and abuse prevention
Everyone gets one free illustrated set. To stop people from taking more, we record that your visitor session used it, with your IP address, and we check that you are a person with Cloudflare Turnstile before drawing pictures. Turnstile receives your IP address and technical signals from your browser. Why: to keep the free offer sustainable and prevent fraud (legitimate interest). How long: we keep the IP address for 30 days.
Your account and purchases
When you pay, we receive from Stripe your email address, the name you gave at checkout if any, a customer reference, and what you bought: amount, currency, date, refund, and for Pro the plan and its renewal date. We never see your card details. Why: to deliver what you bought and let you sign in (contract), and to keep accounting records (legal obligation). How long: your account is kept until you ask us to delete it. Purchase records are kept for 10 years, as French accounting law requires.
Emails
We send you emails through Brevo: the sign-in link (it works for 24 hours, and we only store a hashed copy of it), your PDF when you choose “Email it to me” (with a download link that works for 7 days), and for Pro, a reminder before your yearly plan renews. For “Email it to me”, we log the address, your IP address and the time, to limit how many emails one person can send. Why: to provide the service (contract) and prevent abuse (legitimate interest). How long: we keep this log for 30 days.
Newsletter
Only if you tick “Also send me occasional bingo ideas” (the box is unticked by default), we add your email to our Brevo mailing list. Why: your consent, which you can withdraw at any time with the unsubscribe link in each email or by writing to us. How long: until you unsubscribe.
Audience measurement
We measure visits with Plausible Analytics, which we host ourselves on our own server. It uses no cookies, doesn't follow you across sites, and doesn't store your IP address: it counts visitors with a code computed from your IP address and user agent that changes every day. Our server also records a few steps of the card-making process this way, such as a payment and its amount.
To know which of our pins or ads bring customers, the bcl_attribution cookie (see below) remembers where your first visit came from. When you open the checkout, we keep that source, your IP address and your user agent on our server, never at Stripe. They are used only to count the payment in our audience measurement, and we delete them as soon as the payment is counted, or after 7 days if you don't pay.
We also keep your visit's source, campaign, landing page and referring site with your account, sets, Theme downloads and purchases, without advertising click identifiers. This attribution is deleted with the account or set.
Measuring ads and your choice
When you arrive through an ad, our first-party bcl_attribution cookie keeps the ad network's click identifier (Google: gclid, gbraid or wbraid; Pinterest: epik; Meta: fbclid) and the time of arrival for 30 days. We keep the first visit's attribution. At a purchase or Activation (seeing a preview of cards you created or customized), we save those identifiers on our server until 90 days after the purchase or Activation is recorded. Our daily cleanup deletes expired records. For purchases, the record also includes the payment reference, amount and currency.
We may send the click identifier and the fact that a purchase or Activation took place to the ad network that supplied it, only to measure the ad you clicked. We record these events on our server; no advertising tag or third-party advertising tracker runs in your browser, and there is no cookie banner.
You can refuse with . This sets bcl_no_ad_share for one year on this browser and blocks recording ad click identifiers for purchases and Activation. We also treat Global Privacy Control (Sec-GPC: 1) as a refusal. Your cards and purchases work the same when you refuse. This choice applies to this browser; use it again on other devices or after deleting your cookies.
Who helps us run the service
These providers process data for us, only for the purposes below:
| Provider | What for | What they get |
|---|---|---|
| Hostinger International Ltd. (Cyprus, EU) | Hosting the site, database, pictures and analytics on a server in the EU | Everything stored by the service |
| Anthropic (USA) | Writing the item list | Your description and the item names |
| OpenAI (USA) | Drawing the pictures (GPT Image) | The item names and the chosen style |
| Stripe and Link (USA, Ireland) | Payment, taxes, receipts, payment support | What you enter at checkout, the set you buy and a visitor reference |
| Brevo (France) | Sending emails, newsletter list | Your email address and the email content |
| Cloudflare (USA) | Bot protection (Turnstile) | Your IP address and browser signals |
Under their API terms, Anthropic and OpenAI don't use what we send them to train their models by default. Our fonts are served from our own server, not from Google. For payments, Stripe and Link are the merchant of record and also process your data for their own purposes, under their privacy policies (stripe.com/privacy, link.com/privacy). Turnstile is covered by Cloudflare's Turnstile privacy addendum.
Some providers are in the United States. For these transfers, we rely on the EU-U.S. Data Privacy Framework where the provider is certified, and on the European Commission's standard contractual clauses otherwise.
Cookies
BingoCard Lab sets these cookies, all first-party (set by bingocardlab.com):
| Cookie | What it does | Lasts |
|---|---|---|
__Secure-better-auth.session_token | Strictly necessary. A random, signed token that links your browser to your visitor session or your account. It keeps your sets, and it's how we know you already used your free set. | 30 days, renewed while you use the site |
bcl_no_ad_share | Remembers your refusal to share ad click identifiers and blocks their recording. | 1 year |
bcl_attribution | Remembers where your first visit came from: the campaign tags in the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the domain of the site that sent you, and the page you landed on. It also stores ad click identifiers and the time of arrival, unless you refuse ad sharing. Read only by us, never sent to Stripe; ad measurement is described above. | 30 days |
There is no separate cookie for the free set: it is tied to your session cookie. Plausible sets no cookies. When you pay, the checkout page is on Stripe's site, which sets its own cookies under Stripe's policy.
The session cookie is strictly necessary. bcl_attribution remembers the source of your visit and, unless you refuse, ad click identifiers. We use no advertising tags or third-party advertising trackers in the browser. There is no cookie banner. You can delete or block our cookies in your browser settings. Without the session cookie, the site can't keep your sets. Without bcl_attribution, everything works the same.
Your rights
Wherever you live, you can ask us for a copy of your data, to correct it or to delete it, by writing to hello@bingocardlab.com. If you don't have an account, send us the link to one of your sets so we can find your data. We answer within one month.
In the European Union and the United Kingdom
Under the GDPR, you can also ask to limit or object to how we use your data, to get it in a portable format, and to withdraw your consent at any time. You can complain to your data protection authority; in France, the CNIL (cnil.fr).
In the United States
If you live in a state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia or Texas), you have the right to know what personal information we collect, to access, correct and delete it, and to get a copy. We collect identifiers (email address, IP address, session token), purchase records and how you use our site, from you and your browser, for the purposes described above. We don't sell personal information. Ad measurement may share click identifiers and purchase or Activation events with the relevant ad network as described above; you can refuse this sharing. We don't use profiling with legal effects, and don't collect sensitive personal information. You can make a request yourself or through an authorized agent, and we won't treat you differently for using your rights. If we refuse a request, you can appeal by replying to our answer.
Children
BingoCard Lab is not directed to children under 13, and we don't knowingly collect their data. Teachers can use it for their class: the teacher makes and prints the cards, children don't need an account. If you think a child has given us personal data, write to hello@bingocardlab.com and we will delete it.
Security
The site is served over HTTPS only, sign-in links are stored hashed, and only GETTIN can access the server.
Changes
We will update this policy when what we collect or the providers we use change. The date at the top shows the latest version.