Privacy
Last updated 4 November 2026
Who we are
Tekula Ltd, trading as Katnax, is the controller of your personal data. We are registered in England and Wales, company no. 13533205, registered office 35 Osier Crescent, Muswell Hill, London N10 1QR, United Kingdom. Contact us at support@katnax.com. ICO registration number ZC289509.
Who this is for
People with a Katnax account (who must be 18 or over), people a card is posted to, people in pictures uploaded to make a card, and people who ask us for an invitation.
What we collect, why, and our lawful basis
| What | Why | Lawful basis |
|---|---|---|
| Your email address and name (from how you sign in), and when you last visited | Your account; letting you in | Contract |
| What you tell Kat, your cards, and pictures you upload | Making your card; keeping it in My cards | Contract |
| The name and postal address of the person a card goes to | Printing and posting the card | Contract with you. For the person it is sent to: our legitimate interest, and yours, in delivering a card you sent them |
| Orders, invoices, and what you agreed to when you paid | Selling to you; tax and company records | Contract; legal obligation |
| Support messages and their photos | Helping you | Contract; our legitimate interest in answering you and putting things right |
| A log of each AI request (your email, the time, the cost), the emails we send, and admin actions | Security, stopping misuse and overspending, and showing what happened | Legitimate interests |
| The email address of people we invite | Sending the invitation and letting them sign in | Legitimate interests (letting people join when they've asked to) |
| When you ask for an invitation on our website: your email address; your first name, the date you need a card by and which button you pressed, if you give them | Sending your invitation, and letting in first the people who need a card soonest | Legitimate interests (answering your request) |
| If you tick "send me news": that you ticked it, when, and when you confirmed it from the link in your invitation email | Sending the occasional Katnax news | Consent. We send none until you confirm, and you can stop it at any time |
| A scrambled (hashed) version of your IP address when you ask for an invitation | Limiting repeated requests from one place | Legitimate interests (stopping misuse) |
People in uploaded pictures: whoever uploads a picture must have their permission. A picture may show a child when a parent or carer makes a card with them; we use it only to make that card. We get the name and address of the person a card goes to, and pictures of other people, from the customer making the card.
We need your email address to give you an account, and to send an invitation you ask for (the other invitation fields are optional), and a name and address to post a card. Without them we can't make or send it.
Who we share it with
| Who | For | Where |
|---|---|---|
| OpenAI | Writing words, painting pictures, and the content check | USA |
| xAI (Grok) | Painting front cover pictures, if you choose it | USA |
| Prodigi | Printing and posting cards | UK, with printing partners abroad for cards posted abroad |
| Cardly | Printing and posting 5 x 7 and 7 x 5 cards | Australia, printing in the country the card goes to |
| Stripe | Taking payment | UK, EU, USA |
| Resend | Sending receipts and other emails | EU (Ireland), USA |
| Cloudflare | Hosting the site, signing in, our database and files, and checks against bots (including the Turnstile "I'm human" check on the invitation form) | Worldwide, USA |
| Signing in with Google, if you choose it; the fonts the card maker and our home page use (Google Fonts sees your IP address) | USA | |
| Meta (Facebook) | Signing in with Facebook, if you choose it | USA |
Where these companies handle data outside the UK, the transfer is covered by the UK–US data bridge where the company is certified, or by the UK's international data transfer agreement or addendum in their terms. Under its business terms, OpenAI does not use what we send it to train its models, and keeps it for a limited time for safety checks. xAI keeps it under its business terms, which do not allow training on it.
How long we keep it
| What | Kept for |
|---|---|
| Your card's artwork and print files with an order | 18 months from the order |
| Orders and invoices | 6 years after the end of our financial year (31 July) the order falls in |
| Support messages and their photos | 12 months |
| The AI request log and the email log | 13 months |
| The admin action log | 2 years |
| Your account, saved cards and settings | Until you ask us to delete them, or 2 years after you last signed in |
| An invitation that isn't taken up | 2 years from the invitation |
| A request for an invitation we haven't answered | 90 days from your last request. Once we invite you, we keep it as the record of your invitation and of any news consent |
| Scrambled IP addresses from the invitation form | 2 days |
| Your news consent | Until you stop the news, then 2 years as a record of your consent and that you stopped |
| Backup copies of our database (orders, accounts and the logs), kept on our own computer in the UK | Up to 3 months, then replaced |
| Saved cards you delete | 30 days. Unfinished cards nobody has opened for 12 months are removed too |
| Pictures you upload | Taken off your card once you order |
A daily job deletes what has passed its time.
Cookies and storage
Only what the site needs to work: Cloudflare's sign-in cookie, a check against bots (Cloudflare Turnstile on the invitation form), and your card kept in your browser while you work on it. No advertising or analytics cookies.
Your rights
You can ask for a copy of your data, and ask us to correct it, delete it, restrict or object to how we use it, or move it. Email support@katnax.com; we may ask you to confirm who you are, and we reply within one month. We don't make decisions about you by automated means that have legal or similarly significant effects.
Complaints
Please tell us first, at support@katnax.com: we acknowledge a data protection complaint within 30 days and deal with it without undue delay. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
Changes
If we change this notice we'll update the date at the top, and email account holders if the change matters to them.