Privacy Policy

This Privacy Policy explains what personal information Grin & Print collects when you visit grinandprint.com, buy a printable, sign up for our newsletter or send us a message, and what we do with it. We are a small humor and printables site, and we try to collect as little as possible, keep it safe and use it only for the reasons described below. This policy applies to visitors worldwide and includes specific sections for people in the European Economic Area (EEA), the United Kingdom and California, as well as information about children’s privacy.

Last updated: October 30, 2026

1. Who we are and how to contact us

Grin & Print (“Grin & Print”, “we”, “us” or “our”) operates the website grinandprint.com (the “Site”), including our blog, free tools such as the Joke Generator and Meme Maker, our free printables and our online shop. For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, Grin & Print is the controller of the personal data described in this policy.

For any privacy question, request or complaint, please email [email protected]. We read every message and aim to reply within the time limits set by the law that applies to you (see section 9).

2. Information we collect

We collect personal information in three ways: information you give us directly, information collected automatically when you use the Site, and information we receive from service providers that help us run the Site.

2.1 Contact form

When you use our contact form, we collect your name, email address, the subject and content of your message, and any joke or idea you choose to submit. We also record the date and time of the submission and, for spam prevention, the IP address it was sent from. We use this information only to read and reply to your message, to consider any joke submission under our Editorial Guidelines, and to keep a record of the conversation.

2.2 Newsletter and free printables sign-up

When you subscribe to our newsletter (including to receive the free printable offered on our Free Printables page), we collect your email address and, if you provide it, your first name. We also keep a record of when and how you subscribed and whether you confirmed your subscription, so that we can demonstrate your consent. Our email service may record whether a newsletter was delivered, opened or clicked; we use this only in aggregate to understand which content readers enjoy. Every newsletter includes an unsubscribe link, and you can unsubscribe at any time.

2.3 Orders through our shop (WooCommerce)

Our shop runs on WooCommerce. When you place an order, we collect the information needed to complete it, which typically includes:

• your name and email address (so we can deliver your download links and order confirmation);
• your billing details, such as billing address and country, which are needed to process payment and calculate any applicable sales tax or VAT;
• the products you ordered, the price paid, the order date and order number;
• for our Custom Meme Design service, the brief, text and any images you send us so we can create your design;
• if you create a customer account, your username, a securely hashed password and your order history.

Payment card details are processed by our payment providers, not by us. When you pay, your card number, expiry date and security code are entered into, or transmitted directly to, the payment provider shown at checkout. We never see or store your full card number. The payment provider acts as an independent controller (or as our processor, depending on the provider and the activity) for payment data and handles it under its own privacy policy. We receive confirmation that a payment succeeded and limited details such as the payment method type and, in some cases, the last four digits of a card.

2.4 Server logs

Like virtually every website, our web server and hosting provider automatically record technical information each time a page or file is requested. Server logs typically contain your IP address, the date and time of the request, the page or file requested, the referring page, the HTTP status code and your browser’s user-agent string (which indicates browser type and operating system). We use server logs to keep the Site running, diagnose errors, measure load and detect abuse.

2.5 Security data (Wordfence)

We use the Wordfence security plugin to protect the Site from hacking attempts, spam and malicious traffic. Wordfence processes IP addresses, the pages requested, user-agent strings, and records of login attempts (including the username tried, whether the attempt succeeded and the IP address it came from). It may temporarily block IP addresses that behave in a way that looks like an attack. Wordfence is developed by Defiant, Inc. in the United States, and some security information, such as IP addresses associated with attacks, may be shared with Defiant to provide threat-intelligence and blocklist features. We use this data solely to keep the Site, our customers and our readers safe.

2.6 Cookie consent (CookieYes)

We use CookieYes to show our cookie banner and record your choices. CookieYes stores your consent preferences in a cookie called cookieyes-consent on your device and may keep a consent log (an anonymized or pseudonymized record of the choice made, with a timestamp) so that we can demonstrate that consent was obtained. Full details of the cookies we use are in our Cookie Policy.

2.7 SEO tools (Yoast SEO)

We use the Yoast SEO plugin to manage page titles, descriptions, sitemaps and structured data that help search engines understand our content. Yoast SEO works on our side of the Site and does not track visitors or collect personal data about you.

2.8 Data stored only on your device

Some features remember your preferences using your browser’s local storage rather than cookies. These values stay on your device and are not sent to our servers:

• gp_theme remembers whether you prefer light or dark mode;
• gp_likes remembers which posts or memes you have liked on this device;
• gp_joke_favs remembers the jokes you have saved as favorites in the Joke Generator.

You can clear these at any time by clearing your browser’s site data for grinandprint.com.

2.9 The Meme Maker: your images stay with you

Our Meme Maker runs entirely in your browser. When you upload a picture or choose a template and add text, the image is processed locally on your device using your browser. Your images and captions are not uploaded to our servers, and we cannot see them. When you download your finished meme, the file is created on your device. If you later choose to email us a meme (for example, as a submission), we will receive only what you send.

2.10 Analytics and marketing

If we use analytics or marketing tools, we load them only after you have given consent through the cookie banner where the law requires consent, and we describe them in our Cookie Policy and in the CookieYes banner’s cookie list. You can withdraw that consent at any time.

3. How and why we use your information (legal bases)

Under the GDPR and UK GDPR we must have a legal basis for each way we use personal data. The table below summarizes our purposes and the legal basis we rely on.

Where we rely on legitimate interests, we have balanced our interests against your rights and concluded that the processing is expected, limited and does not override your interests. You can ask us for more information about this balancing, and you have the right to object (see section 8).

We do not use your personal information for automated decision-making that produces legal or similarly significant effects, and we do not build advertising profiles about you.

4. How we share information

We do not sell your personal information, and we do not share it with third parties for their own marketing. We share it only with:

• Hosting and infrastructure providers that store the Site and its database and keep server logs.
• Payment providers that process payments at checkout and help prevent fraud.
• Our email service provider, which stores the newsletter list and sends emails on our behalf.
• Security providers, including Wordfence (Defiant, Inc.), as described in section 2.5.
• Consent management through CookieYes, as described in section 2.6.
• Professional advisers such as accountants or lawyers, where needed and under a duty of confidentiality.
• Authorities, where we are legally required to disclose information, or where disclosure is necessary to protect our rights, our users or the public.
• A successor business, if Grin & Print is ever sold, merged or transferred, in which case your information would remain protected by this policy or one at least as protective, and we would tell you about the change.

Service providers that process personal data on our behalf act as our processors under written agreements that require them to protect the data and use it only on our instructions.

5. How long we keep information

We keep personal data only for as long as we need it for the purposes described above, and then delete or anonymize it.

6. International data transfers

Our service providers may store or process personal data in countries other than the one where you live, including the United States. These countries may not have the same data protection laws as your own. When we transfer personal data out of the EEA or the UK, we rely on an appropriate safeguard, such as:

• an adequacy decision by the European Commission or the UK government, including the EU-U.S. Data Privacy Framework and the UK Extension to it where the recipient is certified;
• the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where UK data is involved; or
• another mechanism permitted by applicable law.

You can contact us for more information about the safeguards used for a particular transfer.

7. How we protect your information

We take reasonable technical and organizational measures to protect personal data against loss, misuse and unauthorized access, including:

• encrypting all traffic to and from the Site with HTTPS;
• using Wordfence to provide a web application firewall, malware scanning and login protection;
• limiting administrative access to the people who need it and protecting those accounts with strong passwords and two-factor authentication;
• keeping WordPress, WooCommerce, our theme and plugins up to date;
• leaving payment card processing to specialized payment providers;
• keeping regular backups so that data can be restored after an incident.

No website can be guaranteed to be completely secure. If we become aware of a personal data breach that is likely to put your rights at risk, we will notify you and the relevant authorities as required by law.

8. Your privacy rights

Depending on where you live, you have some or all of the following rights. We honor reasonable requests from anyone, wherever they are located.

8.1 Rights under the GDPR and UK GDPR

If you are in the EEA or the UK, you have the right to:

• Access the personal data we hold about you and receive a copy of it;
• Rectification of inaccurate or incomplete data;
• Erasure (“right to be forgotten”), where there is no overriding reason for us to keep the data;
• Restriction of processing in certain circumstances, for example while we check whether data is accurate;
• Data portability, meaning a copy of data you gave us in a structured, commonly used, machine-readable format, where processing is based on consent or contract;
• Object to processing based on our legitimate interests, and to object at any time to direct marketing;
• Withdraw consent at any time where we rely on consent, without affecting processing that took place before withdrawal;
• Lodge a complaint with a supervisory authority. In the EEA, this is the data protection authority in the country where you live or work or where an alleged infringement took place. In the UK, it is the Information Commissioner’s Office (ICO). We would appreciate the chance to address your concern first, so please contact us before going to a regulator if you are comfortable doing so.

8.2 Rights under the CCPA/CPRA (California residents)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the “CCPA”) gives you specific rights. In the preceding 12 months we have collected the following categories of personal information, for the business purposes described in section 3:

Sources of this information are you, your device and browser, and our service providers. Retention periods are listed in section 5. Under the CCPA you have the right to:

• Know what personal information we have collected about you, the categories of sources, the purposes and the categories of third parties we disclose it to, and to receive the specific pieces of information;
• Delete personal information we have collected from you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information. We do not sell personal information and do not share it for cross-context behavioral advertising. If we ever introduce marketing cookies that would count as “sharing”, you will be able to opt out through the cookie banner, and we will treat a Global Privacy Control (GPC) signal from your browser as a valid opt-out request;
• Limit the use of sensitive personal information. We do not use sensitive personal information for purposes that would trigger this right;
• Non-discrimination. We will not deny you goods or services, charge you a different price or provide a different quality of service because you exercised your rights.

We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. You may use an authorized agent to make a request on your behalf; we may ask the agent for proof of authorization and may ask you to verify your identity directly.

8.3 How to exercise your rights

1. Email [email protected] with the subject line “Privacy request” and tell us which right you want to exercise.
2. Send the request from the email address you used with us (for example, the address on your order or newsletter subscription). If that is not possible, we may ask for information such as an order number so that we can verify your identity. We ask only for what we need to confirm it is really you, and we use it only for that purpose.
3. We will confirm receipt and respond within one month under the GDPR and UK GDPR (extendable by two further months for complex requests, in which case we will tell you why), or within 45 days under the CCPA (extendable by a further 45 days where reasonably necessary, with notice).
4. Requests are free of charge. We may refuse, or charge a reasonable fee for, requests that are manifestly unfounded or excessive, and we will explain why.

To unsubscribe from the newsletter, you can simply click the unsubscribe link in any email. To change cookie choices, use the cookie settings link shown on the Site or follow the steps in our Cookie Policy.

9. Children’s privacy (including COPPA)

Grin & Print publishes family-friendly humor, and many of our jokes and printables are made for kids to enjoy with a parent, teacher or caregiver. However, the Site’s forms, newsletter and shop are intended for adults, and the Site is not directed to children under 13 within the meaning of the U.S. Children’s Online Privacy Protection Act (COPPA).

• We do not knowingly collect personal information from children under 13. Children should not use our contact form, subscribe to the newsletter, create an account or place orders. A parent or guardian should do these things on their behalf.
• Our Joke Generator and Meme Maker can be used without providing any personal information, and Meme Maker images never leave the device.
• In the EEA and the UK, where we rely on consent, we do not knowingly accept consent from children below the age of digital consent in their country (13 in the UK and between 13 and 16 in EEA countries).
• If you are a parent or guardian and believe your child has given us personal information, please email [email protected]. We will delete the information promptly and, where relevant, unsubscribe the address from our list.

10. Links to other websites

Our articles sometimes link to other websites, such as authoritative sources or, where clearly labeled, affiliate partners (see our Disclaimer). We are not responsible for the privacy practices of those sites. Please read their privacy policies before giving them your information.

11. Changes to this policy

We may update this Privacy Policy from time to time, for example when we add a new feature or service provider or when the law changes. We will change the “Last updated” date at the top of this page whenever we do. If we make a material change, such as using your information for a new purpose, we will give you notice on the Site and, where we have your email address and the change affects you, by email. Where the law requires your consent to a change, we will ask for it.

12. Contact us

If you have any questions about this Privacy Policy or how we handle personal information, or if you want to exercise any of your rights, email [email protected]. For general questions, you can also reach us at [email protected] or through our contact page. Related policies: Cookie Policy, Terms and Conditions and Refund Policy.