Privacy policy

1.Who is responsible for what

1Namecard is operated by TODO(1namecard): legal entity name (“1Namecard”, “we”, “us”). Our details are in the Operator block above. We play two different roles, and which one applies depends on whose data it is.

We are the controller

For the personal data of people who visit this website or contact us, and for the accounts of the people who sign in to 1Namecard (administrators and sales reps of our customers), we decide why and how the data is used. This policy explains that use.

We are the processor

For the cards, contact details, leads, meeting requests and visit counts that a customer organisation collects with 1Namecard, the customer is the controller and we process the data on its behalf and on its instructions, under our data processing addendum. If you left your details through someone’s card, the organisation whose card it is decides what happens to them and is the one to ask first. We will help you reach it, and we will pass on any request you send us.

2.What data we process

Website visitors and enquiries (we are the controller)

• Technical data in the hosting logs: IP address, browser, the page requested and the time. We do not use it to identify you.
• If you use the contact form: your name, work e-mail address, company and the message you write.

Account holders (we are the controller)

• Name, work e-mail address, role in the organisation and the organisation you belong to.
• Your password, stored only as a one-way hash. If you link Telegram for alerts, your Telegram chat identifier.
• Sign-in, verification and reset records, and an activity log of changes made in the admin (what changed, by whom and when). The log never holds passwords, photos, IP addresses or browser details.
• Short-lived counters that limit repeated requests from one address, deleted after a day.
• Billing contact details and invoices for paid plans.

Cards, leads and visitors (we are the processor)

• Card content a customer publishes: names, job titles, phone numbers, e-mail addresses, social links, photos and short descriptions of its people.
• What a visitor chooses to send through a card: name, e-mail address, phone number, company, role, a message, the consent wording shown and when it was accepted, and the meeting day and time requested. When a visitor sends a lead form or books a meeting, the IP address and the browser user agent of the device that sent it are stored with the lead or meeting as evidence and to prevent abuse. The organisation’s administrators can see them on the lead, and they are included in backups.
• What a visitor did on the card, such as tapping save contact or WhatsApp, and the placement code (for example badge or roll-up) of the QR code that was scanned. Card views and short-link clicks are counted with device type, browser, operating system, language and approximate location (country, region and city from the hosting network’s headers). The visitor is recognised for one day by a hash that is salted daily. Views and clicks store no IP address and set no cookie, and the IP address and browser details used to make the hash are not stored.
• Notes, stage, owner and a score that a customer’s team adds to or derives from a lead.

1Namecard is for business use. Cards say that visitors must be 18 or over, and we do not knowingly collect data from children.

3.Why we use it and on what legal basis

• Providing the service to a customer (accounts, cards, leads, sign-in, support): performance of the contract with the customer, Article 6(1)(b) GDPR. For individual users, our legitimate interest in running the accounts our customer asks us to create, Article 6(1)(f).
• Answering enquiries sent through the contact form or by e-mail: steps before a contract at your request, Article 6(1)(b), and our legitimate interest in replying to business enquiries, Article 6(1)(f).
• Security and abuse prevention (logs, rate limits, activity log): our legitimate interest in keeping the service and our customers’ data safe, Article 6(1)(f).
• Accounting and tax: legal obligation, Article 6(1)(c).
• Processing for a customer (everything under “Cards, leads and visitors”): only on the customer’s instructions. The customer is responsible for its own legal basis, such as the consent of the visitor, which the lead form records.

We do not sell personal data, do not use it for advertising and do not take decisions about people that have legal or similarly significant effects. A lead score is calculated by fixed rules from what a visitor did, shown to the customer’s staff as a sorting aid, and always reviewed by a person.

4.How long we keep it

• Contact form messages: for as long as needed to answer you, and up to 12 months after the last message unless it leads to a customer relationship.
• Account data: while the account is active. After a paid plan ends or an account is closed, the organisation’s data is kept for 30 days so the customer can export it, then deleted.
• Leads, meetings, cards and notes: until the customer deletes them or the organisation is closed (see above). A customer can delete a person’s leads, meetings and notes for one e-mail address in a click. That does not change backups taken before the deletion, and it cannot recall data already sent to a connected CRM, Slack, Telegram, e-mail or webhook receiver, apart from one request to the connected CRM to delete the contact.
• Card views and short-link clicks: 13 months, then deleted. This is the same on every plan: the plan decides how many cards, links and users a customer has, not how long visit history is kept.
• Delivery records for webhooks and e-mails: 30 days after they finish. Request counters: one day.
• Backups: each organisation’s data is backed up daily to a private store in Frankfurt. Backups include the IP addresses and browser user agents stored with leads and meetings.
• Invoices and accounting records: as long as tax and company law require. TODO(1namecard): state the period for the company seat.

5.Who else handles the data

We use the providers below to run the service. Vercel and Neon are always involved. Resend is involved when e-mail is switched on, and Stripe when a plan is paid for online. HubSpot, Slack and Telegram are involved only when a customer, or a user, connects them. We do not give personal data to anyone else except where the law requires it. The same list is part of the data processing addendum.

• Vercel Inc.

  Purpose

  Application servers (serverless functions), edge network and logs, and private file storage for uploads and backups.

  Location

  Application servers and the private Blob store for uploads and backups in Frankfurt, Germany (region fra1). The global edge network terminates connections and caches public pages close to each visitor, so requests can pass through edge locations outside the EU. Company in the United States.

  When

  Always

  Transfers

  EU-US Data Privacy Framework and standard contractual clauses

• Neon, Inc.

  Purpose

  The Postgres database that holds cards, leads, meetings and accounts.

  Location

  Frankfurt, Germany (AWS eu-central-1). Company in the United States.

  When

  Always

  Transfers

  EU-US Data Privacy Framework and standard contractual clauses for any support access from outside the EEA

• Resend, Inc.

  Purpose

  Transactional e-mail: sign-up verification, invitations, password resets and the follow-up e-mails a customer switches on.

  Location

  United States

  When

  Only when e-mail is enabled for the service

  Transfers

  EU-US Data Privacy Framework and standard contractual clauses

• Stripe, Inc.

  Purpose

  Payments for paid plans bought online: the billing contact, the subscription and the payment.

  Location

  Where Stripe operates, including the United States

  When

  Only when an organisation pays for a plan online

  Transfers

  EU-US Data Privacy Framework and standard contractual clauses

• HubSpot, Inc. (HubSpot Ireland Limited in the EU)

  Purpose

  The customer’s own CRM. We send contacts, companies, deals, notes and meetings to it.

  Location

  As set in the customer’s HubSpot account

  When

  Only when a customer connects HubSpot

  Transfers

  Set by the customer’s contract with HubSpot

• Slack (Slack Technologies, a Salesforce company)

  Purpose

  Lead and meeting alerts posted to a channel through an incoming webhook the customer sets up.

  Location

  As set in the customer’s Slack workspace

  When

  Only when a customer connects Slack

  Transfers

  Set by the customer’s contract with Slack

• Telegram (Telegram Messenger)

  Purpose

  Lead and meeting alerts sent to a person who links their own Telegram account to our bot.

  Location

  Outside the EEA

  When

  Only when a user links Telegram

  Transfers

  Chosen by the user who links the account. TODO(1namecard): confirm the transfer basis

6.Transfers outside the EEA

The application servers (Vercel Functions), the database (Neon Postgres) and the private Vercel Blob store for uploaded files and daily backups are all in Frankfurt, Germany (AWS eu-central-1, Vercel region fra1). Customer and lead data is stored and processed in the EU. Vercel's global edge network terminates connections and caches public pages close to each visitor, so a request can pass through an edge location outside the EU on its way to Frankfurt. Services a customer connects, such as HubSpot, Slack and Telegram, and our e-mail and payment providers process data where they operate. Some of our providers are US companies, so personal data can be reached from, or processed in, the United States. We rely on the EU-US Data Privacy Framework where the provider is certified and on the European Commission’s standard contractual clauses where it is not or as a second layer, with additional safeguards where needed. You can ask us for a copy of the clauses.

7.Your rights and how to use them

You have the right to access your personal data, to have it corrected or erased, to restrict or object to its use, to receive it in a portable format and, where we rely on consent, to withdraw that consent at any time. Withdrawing consent does not affect what happened before.

To use a right, write to privacy@1namecard.com. We answer within one month. We may ask you to prove who you are. If your request is about data that a customer collected through its card, tell us which organisation’s card it was. We will pass your request to that organisation without undue delay, because it decides what happens to the data, and we will help it answer.

8.Complaints

You can complain to a data protection supervisory authority, in particular in the EU member state where you live or work or where you think your rights were infringed. Our lead supervisory authority is the Office of the Information and Data Protection Commissioner (IDPC) in Malta, idpc.org.mt. TODO(1namecard): this assumes the company seat is in Malta. Replace the authority if it is not. We would like the chance to put things right first, so please write to us as well.

9.Cookies and similar technologies

This website sets no cookies. Cards set no cookies for visitors and there is no third-party analytics on a card. Card views and short-link clicks are counted without cookies and without storing the visitor’s IP address. People who sign in get the strictly necessary cookies listed on the cookies page, and we use no advertising cookies. Any website statistics we add will be cookieless. The cookies page lists what is used.

10.How we protect it

Each organisation’s data is kept apart from every other’s: the application scopes every query to the organisation. Data is encrypted in transit, integration secrets are stored encrypted, passwords are hashed, public forms are rate limited and changes in the admin are logged. The security page and the data processing addendum describe the measures in more detail.

11.Changes to this policy

We will change this page when our use of personal data changes, and update the date at the top. For a material change we will also tell customers’ account owners by e-mail. This policy is governed by the law described in the terms (Malta unless the company seat is elsewhere), without limiting any rights you have under the law where you live.