Privacy Policy

1 Information We Collect

We collect only the information necessary to provide our digital business card platform:

• Profile & Contact Information: Full name, professional headline/job title, business or company name, contact phone numbers, contact email address, office location or address, Google Review links, social profile URLs, profile avatar images, and header banners.
• Account Authentication: Email address and temporary one-time password (OTP) verification tokens or magic links. We do not store plaintext passwords on our servers.
• Subscription & Payment Data: Subscription billing ($10 CAD/mo or $99 CAD/yr) is processed through Square (Block, Inc.) via tokenized Square Web Payments SDK. We store only subscription IDs, customer IDs, and billing status metadata. CardTap never receives, processes, or stores your credit card numbers, expiry dates, or CVV codes.
• Lead Capture Data (Pro Tier): If you enable the Lead Capture feature, visitor submissions (name, phone, email, and timestamp) collected through your card's contact download popup are encrypted and stored in your private database partition for your export and management.
• Customer Feedback (Pro Review Shield): Submissions from visitors rating 1–3 stars via the "Make Things Right" feedback form are routed directly into your private dashboard feedback inbox.

2 Core Technologies & Infrastructure Partners

CardTap relies on trusted, security-vetted technologies to safeguard your digital presence:

3 Card-Level Privacy Policy Feature (Free & Pro)

To help card owners comply with local data protection and commercial communication regulations, CardTap provides built-in privacy policy options on both Free and Pro cards:

• Custom Link: You can link directly to your existing website's privacy policy.
• Hosted & Editable Policy: You can generate a standardized contact & lead privacy policy template with one click, customize it in your dashboard, and have it hosted directly on CardTap at /c/[slug]/privacy.
• Visitors to your public card can review your policy anytime via the dedicated footer link or pop-up viewer.

4 Lead Capture & Data Protection Roles

Under applicable privacy laws (such as PIPEDA and GDPR):

• You are the Data Controller: When you enable Lead Capture, you decide how to communicate with contacts who provide their details. You are responsible for ensuring that outreach complies with consent and unsubscribe rules.
• CardTap is the Data Processor: We store and transmit lead data securely on your behalf. We will never sell, contact, market to, or analyze the visitors who submit their contact information to your cards.

5 Data Retention, Portability & Self-Service Account Deletion

You retain complete ownership of your data at all times:

• Download My Data: You can download a complete ZIP archive of your cards, captured leads, customer feedback, and analytics metrics anytime from your dashboard.
• Self-Service Account Deletion: Clicking "Delete Account" (with 2-click confirmation) in your dashboard permanently purges your user profile, digital cards, leads, and uploaded assets from our database.
• Zero Data Selling: We do not sell, rent, monetize, or broker personal information to advertisers or data brokers under any circumstances.