Security and privacy

What we collect, what we don’t, and what you can take back.

A digital card is only worth having if you trust what sits behind it. This page is the detail, including the parts that are not flattering.

Your data

Take it back yourself, today.

No email, no support ticket, no waiting on us to get round to it.

Download everything

Settings has a button that gives you a JSON file containing everything we hold about you — your card, your contacts, your analytics.

Delete your account

Also a button in Settings. Personal information is removed. Invoices are kept for as long as tax law requires and nothing else.

When someone opens your card

Totals, never individuals.

You find out that 612 people scanned your code. You do not find out which of your colleagues looked and decided not to call.

What is recorded

When it was opened
A timestamp, nothing more precise than that.
How it was found
Whether the visit came from a QR scan or a link.
Roughly where
Country only. Never a street, never a precise location.
What they were using
Browser, operating system and device type.

What is not

  • The names of people who looked at your card
  • Anything about a visitor who did not choose to leave their details
  • Location beyond a country
  • Your password in readable form — only an irreversible hash is stored
The detail that matters

We shorten every visitor’s IP address to its network block before it is used to look up a country — so the precise address never leaves our server, and the company that resolves the country never receives it.

Signing in

Your password is hashed, never stored.

Sign-in is an email address and a password. We never keep the password itself — only a scrypt hash, which cannot be reversed back into it. Reset links are single-use and expire within the hour, and repeated failed attempts lock the account for fifteen minutes.

Lead capture is opt-in on the visitor’s side too: somebody has to choose to fill in the form. Nobody’s details are captured just because they looked at your card.

Who else is involved

The companies that touch your data.

MongoDB Atlas
Hosts the database.
ImageKit
Stores profile photos and uploaded brochures.
An SMS provider
Delivers your one-time sign-in code.
Resend
Delivers team invitation emails.
ipapi.co
Turns a shortened network block into a country.
Razorpay
Takes payment. Card details never reach our servers.

We do not sell personal information, and we do not share it for advertising.

Being straight with you

What we have not done.

Anyone running a procurement process will ask. It is better that you hear it from us first.

  • No SOC 2 report
  • No ISO 27001 certification
  • No third-party penetration test
  • No bug bounty programme
  • No standard DPA template yet

If your security review needs any of these, we are not the right fit yet, and we would rather tell you now than halfway through.

The full detail is in the privacy policy and the terms. If something here is unclear, ask us.