Privacy policy

1. Who is responsible

The controller is TODO legal entity name, TODO street, postal code, city, tax ID (PIB) TODO PIB.

Contact for privacy questions and requests: TODO privacy contact email.

2. What data we process

Account holders: name, email address, password (stored only as a hash) and sign-in sessions.

Card content you enter: names, job titles, biographies, phone numbers, email addresses, social links, photos and logos. You decide what to publish. Published content is visible to anyone who has the card link.

Visitors who send a message or book a call through a card: name, contact details, message or note, and the chosen time. These details are delivered to the card owner (for example as a Telegram message) and are not used for anything else.

Technical data: IP address and request details, used for security, abuse prevention (rate limits, bot checks) and error logs. We never log the content of forms.

3. Why we process it and on what basis

Account and card data are processed to provide the service you asked for (performance of a contract). Emails about your account, such as verification, password reset, activation or suspension, are part of the service.

Technical data is processed to keep the service secure and reliable (legitimate interest).

Messages and bookings from visitors are processed to pass them to the card owner, at the visitor's request.

4. Cookies

We use only essential cookies: a sign-in session cookie and a cookie that remembers your interface language. We use no advertising or analytics cookies.

The bot check on registration and sign-in (Cloudflare Turnstile) may process technical data about your browser to tell people from bots.

5. Visitors of a card

A digital card shows only what its owner published. Saving a contact (vCard) creates a file from the published details at that moment. The card does not track its visitors. It only counts, per card and per day, how many times it was opened (and from a QR code), how many contacts were saved, links clicked and messages or bookings sent. These are plain totals: no cookie is set and no IP address, device or other information about the visitor is stored with them.

6. How long we keep data

Account and card data are kept while the account exists. When you delete your account, or an administrator deletes the company, the account, cards, uploads and bookings are deleted.

Bookings are deleted 90 days after the appointment.

Encrypted backups keep deleted data for up to 30 days before they age out.

Security counters and logs are kept only as long as their purpose requires.

7. Who receives data

We use these providers to run the service: Contabo (hosting and database), Cloudflare (DNS, network protection, bot check and message relay), Resend (sending account emails) and Telegram (notifications to the card owner and to the service operator).

They process data on our behalf and under their own data protection terms.

8. Transfers outside Serbia and the EU

Some providers may process data outside Serbia and the EU. Where this happens, we rely on the safeguards the law requires for such transfers.

9. Your rights

You can ask for access to your data, correction, deletion, restriction of processing and a portable copy, and you can object to processing.

You can delete your account yourself on the Account page. For anything else write to TODO privacy contact email. We answer within 30 days.

You may also complain to the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia.

10. Security

Connections use HTTPS, passwords are stored hashed, access is limited by role and backups are encrypted. No system is perfectly secure. If a breach affects your data, we will notify you and the authority as the law requires.

11. Changes

We may update this policy. The date of the latest version is shown below.