Privacy Policy: What We Collect and Why

ESA Card (esacard.com) sells instant registration kits for emotional support animals. Registration at /register takes about 3 minutes and asks no health questions. Booking an evaluation is different, and our Consumer Health Data Policy covers it. This policy explains what we do collect, how we use it, who sees it, and the choices you have. We wrote it in plain English on purpose. A privacy policy you can't read protects no one.

What we collect

• Contact and account details. Your name, email address, and where you live: your city plus your state if you are in the US, or your country if you are not. Your name and location appear on your card; the verification listing shows the location but not your name. A phone number, with its country code. The country code starts on the country your connection appears to come from, which we read from the request rather than store, and you can change it; the country the number is finally saved under, and whether it came from your connection or your own choice, goes to the product analytics described below along with the form steps. The number leaves your browser only when you press the pay button, and once you have paid it is saved on your customer record with Stripe, our payment processor, beside your email address, so a person can reach you if something about your order needs sorting out, such as a kit email that bounced. If you leave checkout before paying, or your payment does not go through, we may text the number you entered about that unfinished order; every other text goes only to people who sign up on our text sign-up page. See Text messages below.
• Pet details. Species, name, breed, and a photo of the one animal on the registration, so your Certificate of Registration and wallet ESA Card describe and picture the right animal.
• Payment information. Payments are processed by Stripe. Your card number goes directly to Stripe and we never see or store it. Stripe keeps the card on file for the yearly listing renewal, and so you can add to your order without typing it again, and removes it if you ask us to. We keep only the order record: what you bought, when, and for how much.
• Usage data. Standard website logs: pages visited, referring link, IP address, device and browser type, and cookies that keep your session together and help us understand how the site is used. For your own order we also keep a record of the requests that placed it and used it (pressing pay, opening your kit page, downloading your files, ordering from that page): the IP address, the browser and the language it is set to, and the approximate location our hosting provider reads from the IP address. That record is stored privately, is never sent to an ad platform, and is used only to prevent fraud and to answer a payment dispute.
• Advertising identifiers. If you arrive from an ad, the click identifier in the link and the cookies the ad platform sets in your browser. These, and what we send back to those platforms, are described under Advertising, analytics and cookies below.
• If you scan a pet tag. Opening a tag's page is a visit to this site like any other, and it may also email the pet's owner the time, the town and map point your internet connection appears to come from, and your IP address, so they know roughly where their pet was found. A message you send the owner from the page reaches them with the same details and any contact you add. Beyond those emails we store only a scrambled code, which cannot be turned back into your IP address, so that the owner is not emailed twice about one visit.

What we don't collect: health information

Registration asks no health questions. If you book an evaluation with an independent therapist through us, we collect the answers you give when you book, only to run that evaluation, as our Consumer Health Data Policy explains. We're honest that a card or certificate carries no legal weight: what a housing provider will ask for is an ESA letter from a licensed healthcare provider.

How we use your information

• To deliver what you paid for: generating your Certificate of Registration and wallet ESA Card as print-ready PDF files, emailing them to you instantly, and publishing your verification listing at /verify.
• To run the verification page: anyone with your registration number can confirm it's active. The lookup shows less than the card does. It returns the registration number, your pet's name and breed, the city and state (or country) on the registration, the date it was issued, whether the registration is active, lapsed or not active, and, where the listing has a term, the date it is listed through and whether a yearly renewal is live. Your name is never returned by the lookup, and neither is your email address or anything about your order.
• To send transactional messages: your order confirmation, the PDF files you bought, a receipt when a listing renewal switches on and each time one is paid, and, if no plan is in place, a reminder 30 days before your included year runs out. The kit is one payment; the yearly listing renewal that switches on when you buy is billed to the card saved with Stripe, first when your included 12 months end, and you can turn it off or cancel it any time from your kit page.
• To send occasional marketing email, which you can unsubscribe from with one click at any time.
• To send text messages: about an order you left unfinished at checkout, or, if you signed up for them, the texts described under Text messages below.
• To process refunds under our 30-day money-back guarantee, prevent fraud, and meet legal obligations. If a payment is disputed with your bank, we send the bank, through Stripe, the records of that order and of its use: the receipt, the emails we sent you, your conversations with our support team (the chat and email messages our support inbox, Crisp, holds for your email address), the kit files, the pages of our site your browser visited as our product analytics recorded them, and the order record described under Usage data.

What we never do

• We never sell your personal data for money. Nobody pays us for your details: not data brokers, not list buyers, not anyone. What we do send to advertising platforms, we send to run and measure our own ads, and we describe it in full below rather than hiding it behind the word "sell".
• We never collect health data, so there is none to share, lose, or use for marketing. Ever.
• We never publish more than the card shows. Your verification listing displays less than the card itself does, and never your name, your email address, or your payment history.

Service providers we work with

A small number of companies help us run ESA Card. Each receives only what it needs to do its job, is bound by contract to use your data solely to provide services to us, and is prohibited from selling it.

• Payment processor (Stripe): handles your card details end to end. We never store card numbers.
• Email provider: receives your email address and order status to send the messages described above.
• Live chat (Crisp): the chat widget loads on our marketing pages whether or not you use it, so from your first page view Crisp receives the page address, your browser and device details, an approximate location derived from your IP, and a cookie it sets to recognize you on later visits. If you write to us, it also receives your message and your email address, so a person can reply.
• Product analytics (Mixpanel): receives the pages you view and how you interact with them (clicks, scrolling, form steps, and the stages you complete in the registration funnel) along with a random visitor id. It does not record the text of what you click or type; we turned that setting off. When you start checkout, it also receives your email address, name, city, state and country, and your phone number, so one profile shows one customer instead of three anonymous devices. It never receives your pet photo, and there is no health data anywhere to send it.
• Error and performance monitoring (Sentry): receives crash reports and, for a sample of ordinary sessions, performance traces: page addresses, browser and device details, and the technical stack behind an error. We configure it not to send personal data, and it strips session ids, gift codes and email addresses before anything leaves your browser.
• Text message delivery (Commio): only for the numbers we text, as described under Text messages below, receives your mobile number and the texts we send you, to deliver them through your mobile carrier. It uses them for nothing else.
• Internal alerts (Slack): our own order and support notifications go to a private Slack channel and include your email address and a link to your Stripe record, so the person on support can find your order. Nothing about you is posted anywhere public.

Advertising, analytics and cookies

We buy ads, and ads only work if the platform can tell which clicks turned into orders. That means information about your visit (and, if you buy, about your order) goes to the advertising platforms we use. Calling that anything other than sharing would be dishonest, so here is exactly what happens.

Google Analytics runs on every page of this site. The Meta, TikTok, Reddit, AppLovin, OpenAI and Snap tags run only where we have an active account configured with that platform, so the list below describes the maximum rather than a guarantee that every one of them is live on the day you read this.

• Google (Google Analytics and Google Ads): receives the address of each page you view, the product views and checkout steps you complete, and the value and currency of a purchase along with your registration number as the transaction id, together with your IP address, browser and the cookies its tag sets. We do not send Google your email address or your name.
• Meta (Facebook and Instagram): its browser pixel receives your page views, the product and checkout steps you complete, and, on the confirmation page, the purchase itself with its value and your registration number as the order id, along with the two Meta cookies it sets in your browser. When you buy, our server also sends Meta a purchase event containing your email address, phone number, first and last name, city, state and country, each individually SHA-256 hashed before it leaves us, plus a hashed customer id derived from your registration number. The same event carries, in the clear, your registration number as the event and order id, the address of the page you bought from, those two cookie values, and your browser's user-agent string. Meta matches the hashes against its own users to credit the sale to an ad.
• TikTok: its browser pixel receives your page views and a hashed visitor id on every visit. As soon as you enter your email address in the registration form, whether or not you go on to buy, the pixel also receives your hashed email address and hashed first and last name. Your phone number's hash is added when you press the pay button, and not before. Our server sends the checkout and purchase events with those hashed fields plus your city, state and country in plain text (TikTok's API requires those unhashed), TikTok's own click id and cookie values, your user-agent, your language, the address of the page the event is filed against, the site that referred you, and, for the checkout event only, your IP address, read from that one request. TikTok gets it once, with that event; the private order record described under Usage data is never sent to it.
• Reddit: receives your page views and conversion events with the cookies its pixel sets. No email address and no name.
• AppLovin (Axon): its browser pixel receives the address, title and referring site of each page you view, each click you make on the page (the kind of element and a link's address, not what it says), and the product, basket and checkout steps you complete with their prices, along with your browser, language and screen size and the cookies it sets in your browser. When you buy, it receives the purchase with its value before tax and shipping, what you bought, your registration number as the order id and a random visitor id our site keeps in your browser; for a kit, our server also hashes your email address with SHA-256 and the pixel sends that with the purchase. That kit purchase is the only time your email address reaches AppLovin, and it arrives only as that hash. Its script also reads technical details of your device (its graphics hardware, its time zone and how it draws a test image) and sends them to AppLovin, and it has your browser contact Google so that Google's advertising cookie can be matched with AppLovin's. No name and no phone number, and nothing is sent to AppLovin from our server.
• OpenAI (ads in ChatGPT): its browser pixel reports each page you load to OpenAI, with the page's address and the site that referred you, a random id it keeps in a cookie and, if you arrived from an ad in ChatGPT, the click id from that link, which it keeps in a second cookie. When you buy, it receives the purchase with its value and your registration number as the order id. Our server also sends OpenAI each purchase with its value, what you bought, your registration number as the order id, the address of the page it is filed against, and your email address, SHA-256 hashed. No name and no phone number go from our server.
• Snap (Snapchat): its browser pixel receives your page views and the product, basket and checkout steps you complete with their prices, each with the page's address, your browser, operating system and screen size, and the cookies it sets in your browser. When you buy, it receives the purchase with its value, what you bought and your registration number as the order id; for a kit, also your email address, SHA-256 hashed on our server before it reaches the pixel. No name and no phone number, and nothing is sent to Snap from our server.

Two limits are worth stating plainly. First, we never send any of these platforms health information, because we never have any. Second, hashing is not anonymity: a hashed email is still your email to a company that already has it, which is the whole point of sending it. We are not going to pretend otherwise.

You can stop most of this from your side. Browser tracking protection, an ad blocker, or blocking third-party cookies will keep the pixels from loading at all. Ad platforms also run their own controls: Google Ads settings, Meta's Ads Preferences, TikTok's ad personalization settings, Reddit's, Snapchat's ad preferences, and the ad controls in ChatGPT's settings. And you can ask us directly, by the route described under Your rights and California residents below.

Text messages

We text you in two cases. An order you left unfinished. If you enter a US mobile number at checkout and leave before paying, or your payment does not go through, we may text that number about that order: that it is saved, or that the payment did not go through, with a link to finish it. That is at most 4 texts, and they stop as soon as you pay. Texts you sign up for. Every other text, such as updates after you buy and occasional offers on our products, goes only to people who sign up on our text sign-up page, by entering their mobile number and ticking the box there. The box is never ticked for you, and buying never depends on it. Once you sign up, we send order updates, replies when you text us, and occasional offers, up to 6 messages a month. Message and data rates may apply. Reply STOP to any text to stop them, or HELP for help. The full program terms are under Text messages in our Terms of Service.

• No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Every category of sharing described in this policy excludes text messaging originator opt-in data and consent; this information will not be shared with any third parties.
• What that means in practice. The text sign-up page loads none of the advertising or analytics tools described above, so the number you give there, and the fact that you signed up, reach none of them. A number you enter at checkout reaches the tools described above as those sections say, and texting it about an unfinished order sends it nowhere new. The only outside companies that handle your number for texting are the ones that deliver the texts: our messaging provider (Commio) and the mobile carriers, which use it only to deliver them.
• Your consent is recorded. We keep the number you gave, the date and time you signed up, and the exact wording beside the box you ticked, so we can show it if a carrier asks; if the number is already on your customer record at Stripe, the sign-up is noted there too. The record is kept while you are signed up and for four years after you stop, the time in which a question about a text can be raised.

How long we keep it

We keep your account and order records while your account is active and for as long as tax, accounting, and legal requirements demand afterward. Your verification listing is included for the first 12 months, and how long it runs after that depends on the renewal plan in place, if any; a listing that runs out shows on the verification page as lapsed rather than disappearing, and the order record behind it is kept on the terms above. You can ask us to take your listing down at any time. If you ask us to delete your data, we delete everything we aren't legally required to keep and tell you what, if anything, must be retained and why. If you never finished paying, your phone number is not added to a customer record at Stripe, and the only contact on it is the texts about that unfinished order described under Text messages (at most 4; reply STOP to stop them). The number does remain in that unfinished checkout record at Stripe. It is also on the Mixpanel profile described above, and TikTok has its hash from the moment you pressed the pay button, sent from our server with the checkout event. Deletion and opt-out work as described under Your rights below.

How we protect it

Your data is encrypted in transit (TLS) and at rest. Access inside our team is limited to people who need it to serve you. We don't store card numbers, and we don't hold health data, which removes the two most attractive targets entirely. No system is perfectly secure, and we won't pretend ours is. But if a breach ever affects your information, we will notify you as the law requires and tell you plainly what happened.

Your rights: access, deletion, and opting out

Wherever you live, you can email contact@esacard.com, or write to us from the contact page, to request a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, or tell us to stop sharing it with advertising platforms. We verify that the request really comes from you, then respond within 45 days. There is no charge and no effect on your service or pricing for exercising these rights.

We will be straight with you about how the opt-out works, because the mechanism matters more than the promise. There is no automated toggle on this site today. An opt-out request is handled by a person: we suppress your details from the server-side conversion events described above and stop sending your order to the ad platforms. What your browser has already sent to a pixel before you asked cannot be recalled by us, that part you clear by blocking the tags in your browser or using the platforms' own ad settings. If we ever add a self-service control, it will appear here first.

California residents (CCPA/CPRA) and other state privacy laws

Under the California Consumer Privacy Act, as amended by the CPRA, California residents have the right to know what personal information we collect and why, to access it, to correct it, to delete it, and to opt out of its sale or sharing. We do not sell personal information for money and have not in the preceding 12 months. But the CPRA defines "sharing" far more broadly than most people expect: disclosing personal information to a third party for cross-context behavioral advertising counts, whether or not any money changes hands. By that definition, we do share personal information, the identifiers listed under Advertising, analytics and cookies above, sent to Google, Meta, TikTok, Reddit, AppLovin, OpenAI and Snap so our ads can be targeted and measured. We would rather say so than lean on a technicality.

So: California residents have the right to opt out of that sharing, and so do residents of the other states with comparable laws, including Colorado, Connecticut, Virginia, Texas, Oregon and Montana, which give the same right over targeted advertising. To exercise it, email contact@esacard.com or use the contact page and say you want to opt out of sharing for advertising. That is the mechanism that exists today; the paragraph above explains honestly what it does and does not undo. We never share the personal information of anyone we know to be under 16, and we never knowingly collect it in the first place.

We will never discriminate against you, in price or service, for exercising any of these rights. You may use an authorized agent to submit requests; we will ask for proof of authorization to protect your account. If we deny a request, you can appeal by replying to our response, and California residents may also complain to the California Privacy Protection Agency or the state Attorney General.

Customers outside the United States

You can register from any country, so some of you are covered by the UK GDPR, the EU GDPR, or a similar law at home. Those laws give you rights of access, correction, deletion, portability, and objection, and the request address is the same one above: contact@esacard.com. Two things are worth saying plainly. First, buying a kit means your details are processed and stored in the United States, where our payment and email providers run, and placing an order is your consent to that transfer. Second, the reason we can keep this section short is that we hold so little: your name, your email, your city and country, your phone number, your pet's details, and an order record. No health data and no card numbers. The advertising platforms described above receive their share of that short list, and you can object or withdraw consent to it at the same address.

A note on consumer health data laws

Some states give consumers specific rights over health-related data, including Washington under its My Health My Data Act. When you book an evaluation, the answers you give are consumer health data under those laws. Our Consumer Health Data Policy explains how we use them and how to have them deleted. Registration asks no health questions, and we do not use geofencing around healthcare facilities.

Children under 18

ESA Card is for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted information to us, email contact@esacard.com and we will delete it promptly.

Changes to this policy

When we update this policy, we change the date at the top. If a change materially affects how we handle your data, we will email you before it takes effect, not after.

Contact us

ESA Card (esacard.com) is operated by Momentum Labs LLC. Questions about this policy or your data go to contact@esacard.com. A person reads every privacy request. You can also find answers to common questions on our FAQ page.