Privacy Policy
This policy explains what personal data Digi Card Pros ("we", "us") collects, why, who can see it, and the choices and rights you have. It applies to users worldwide. Where local law gives you extra rights, such as the EU/UK GDPR, California's CCPA/CPRA or India's Digital Personal Data Protection Act 2023 (DPDP Act), those rights apply too.
Who is responsible: [Operator name], Chennai, India, is the data controller (called the "data fiduciary" under the DPDP Act). Contact: support@digicardpros.com.
1. What we collect
| Data | Where it comes from | Why we use it |
|---|---|---|
| Email address, sign-in method, and name/profile picture from Google if you use Google Sign-In | You, or Google when you sign in with it | To create and secure your account and send essential emails (verification, password reset) |
| Username, Terms acceptance date and version, organisation membership | You | To run your account and keep a record that you accepted the Terms |
| Card content: name, job title, company, bio, photo, phone numbers, email addresses, address, links, theme | You | To display your cards, create your contact file (.vcf), QR codes and link previews |
| Technical data: IP address, browser type, request times | Automatically, from your device | Security, preventing abuse (rate limiting) and fixing faults |
We do not use advertising trackers or analytics cookies, and we do not sell or rent personal data. Sign-in uses the browser storage Firebase needs to keep you logged in. That is strictly necessary for the Service.
People who scan a card
If you view someone's card without an account, we don't ask for or store any details about you, other than short-lived technical logs (IP address, browser, time) kept for security.
2. Legal bases (GDPR / UK GDPR)
- Contract: to provide the Service you signed up for.
- Consent: for the card content you choose to publish. You can withdraw consent by editing, pausing or deleting your cards.
- Legitimate interests: security, preventing abuse and keeping records of Terms acceptance.
- Legal obligation: where we must keep or disclose data by law.
Under India's DPDP Act, we process your data on the basis of the consent you give when you sign up and accept this policy, and for the legitimate uses the Act allows.
3. Who can see your data
- Anyone with your card link or QR code can see what's on that card while it is active. Your cards are hidden from search engines. If a link spreads further than you'd like, you can pause the card or create a new QR code.
- Organisation admins: if you join an organisation, its admin can see your name, email address, username, job titles and whether your cards are active. They cannot edit anything.
- Platform administrator: our single platform administrator can see all account and card data. This is needed to run the Service, handle support and enforce the Terms (for example, disabling or deleting abusive accounts). Access is limited to that one account and enforced on our servers.
- Service providers (processors): Google LLC (Firebase Authentication and Cloud Firestore), which stores account and card data; Hostinger (server hosting), which stores photos, QR codes and share images and runs our servers; Google Fonts, which may receive your IP address when pages load its fonts. They process data only on our instructions.
- Authorities: if the law requires it, or to protect people's safety or our rights.
4. International transfers
We are based in India, and our providers may store and process data in India, the United States, the EU or other countries. Where data leaves the EU/UK, we rely on our providers' approved safeguards, such as the European Commission's Standard Contractual Clauses. Where the DPDP Act restricts transfers to particular countries, we will comply.
5. How long we keep data
- Account and card data: until you delete your account (or we delete it under the Terms). Deletion removes it from our live systems immediately.
- Server logs: up to 30 days.
- Backups, if any: overwritten within 30 days.
- Records we must keep by law: only as long as required.
6. Your rights
Depending on where you live, you have the right to:
- Access and portability: download all your data as JSON from Account → "Download my data".
- Correction: edit your cards at any time.
- Deletion: delete your account from Account → "Delete my account".
- Withdraw consent at any time. This doesn't affect processing already done.
- Object to or restrict certain processing.
- Nominate someone to exercise your rights if you die or become incapacitated (DPDP Act).
- Complain to a data protection authority: for example, your local EU authority, the UK ICO, or the Data Protection Board of India.
California residents: you have the right to know, delete and correct your personal information, and not to be discriminated against for using these rights. We do not sell or "share" personal information for cross-context behavioural advertising.
To exercise any right not available in the app, email us. We will reply within 30 days, or sooner where the law requires.
7. Grievance officer
For complaints about how we handle your data (including under India's DPDP Act and IT Rules), contact our Grievance Officer: [Operator name], support@digicardpros.com. We acknowledge complaints within 48 hours and aim to resolve them within 30 days.
8. Security
We use encrypted connections (HTTPS), verified sign-in through Firebase, server-side access checks, unguessable card links and rate limiting. Photos have location data removed when you upload them. No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authorities as the law requires.
9. Children
The Service is for adults (18+). We do not knowingly collect data from children. If you believe a child has signed up, contact us and we will delete the account.
10. Changes to this policy
If we make significant changes, we will tell you by email or in the app before they take effect. The version date at the top shows when this policy last changed.