Privacy Policy

ESA Card (esacard.com) sells instant registration kits for emotional support animals. Registration at /register takes about 3 minutes and asks no health questions — so the most sensitive category of personal data never enters our systems at all. This policy explains what we do collect, how we use it, who sees it, and the choices you have. We wrote it in plain English on purpose — a privacy policy you can't read protects no one.

What we collect

• Contact and account details. Your name, email address, and city and state. Your name and city appear on your card and in your verification listing.
• Pet details. Species, name, breed, and a photo for up to 2 pets, so your Certificate of Registration and wallet ID card describe — and picture — the right animal.
• Shipping address. Only if you order the Complete Kit, so we can mail your printed wallet card and certificate.
• Payment information. Payments are processed by Stripe. Your card number goes directly to Stripe and we never see or store it. We keep only the order record: what you bought, when, and for how much.
• Usage data. Standard website logs — pages visited, device and browser type, and cookies that keep you signed in and help us understand how the site is used.

What we don't collect: health information

We ask no health questions and collect no health data of any kind. No diagnosis, no medical history, no evaluations, no appointments. That's by design: registration is a convenience product, and we're honest that a card or certificate carries no legal weight. The only document with legal force under the Fair Housing Act is an ESA letter from a licensed mental health professional — which we don't sell. Because we never collect health data, there is no health data here to breach, sell, or subpoena.

How we use your information

• To deliver what you paid for — generating your digital Certificate of Registration and wallet ID card instantly, publishing your lifetime verification listing at /verify, and shipping any printed Complete Kit within 3-5 days by USPS.
• To run the verification page: anyone with your registration number can confirm it's active. The page shows only what is printed on the card — pet name and species, owner first name and city, and registration status. Nothing more.
• To send transactional messages — order confirmation, kit shipment tracking, and free replacements for damaged or lost kits. There are no renewal reminders, because there are no renewals — registration is a one-time payment.
• To send occasional marketing email, which you can unsubscribe from with one click at any time.
• To process refunds under our 30-day money-back guarantee, prevent fraud, and meet legal obligations.

What we never do

• We never sell your personal data. Not to advertisers, not to data brokers, not to anyone.
• We never collect health data, so there is none to share, lose, or use for marketing. Ever.
• We never publish more than the card shows. Your verification listing displays only the details printed on the card itself — never your email, full address, or payment history.

Service providers we work with

A small number of companies help us run ESA Card. Each receives only what it needs to do its job, is bound by contract to use your data solely to provide services to us, and is prohibited from selling it.

• Payment processor (Stripe): handles your card details end to end. We never store card numbers.
• Printing partner: receives your name, city, pet details, and pet photo to print the wallet ID card and Certificate of Registration for Complete Kit orders.
• Shipping partners (USPS): receive your name and mailing address to deliver printed kits.
• Email provider: receives your email address and order status to send the messages described above.

How long we keep it

We keep your account and order records while your account is active and for as long as tax, accounting, and legal requirements demand afterward. Your verification listing stays live for the life of your registration — that's the point of a lifetime listing — unless you ask us to take it down. If you ask us to delete your data, we delete everything we aren't legally required to keep and tell you what, if anything, must be retained and why.

How we protect it

Your data is encrypted in transit (TLS) and at rest. Access inside our team is limited to people who need it to serve you. We don't store card numbers, and we don't hold health data, which removes the two most attractive targets entirely. No system is perfectly secure, and we won't pretend ours is — but if a breach ever affects your information, we will notify you as the law requires and tell you plainly what happened.

Your rights: access and deletion

Wherever you live, you can email support@esacard.com to request a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. We verify that the request really comes from you, then respond within 45 days. There is no charge and no effect on your service or pricing for exercising these rights.

California residents (CCPA)

Under the California Consumer Privacy Act, as amended by the CPRA, California residents have the right to know what personal information we collect and why, to access it, to correct it, to delete it, and to opt out of its sale or sharing. We do not sell personal information and have not in the preceding 12 months, and we do not share personal information for cross-context behavioral advertising. We will never discriminate against you — in price or service — for exercising any CCPA right. You may use an authorized agent to submit requests; we will ask for proof of authorization to protect your account.

A note on consumer health data laws

Some states — including Washington under its My Health My Data Act — give consumers specific rights over health-related data. Those laws barely apply to us, for a simple reason: we do not collect consumer health data. Registration asks no health questions, and we do not use geofencing around healthcare facilities. If you believe we have somehow received health information from you, email support@esacard.com and we will delete it.

Children under 18

ESA Card is for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted information to us, email support@esacard.com and we will delete it promptly.

Changes to this policy

When we update this policy, we change the date at the top. If a change materially affects how we handle your data, we will email you before it takes effect, not after.

Contact us

Questions about this policy or your data go to support@esacard.com or (888) 555-0134. A person reads every privacy request. You can also find answers to common questions on our FAQ page.