Privacy notice

This notice covers three groups: people who create a CardSite account, members of a workspace, and visitors who open or scan a published card.

• Your email address and authentication details, held by our authentication provider.
• Card content you enter: name, job title, company, bio, contact details, links and images.
• Your workspace, role, sandbox plan selection and sandbox plan history.

Anything you mark as hidden in the card editor is removed on the server before the public profile is sent to a visitor. Hidden fields are also left out of the saved contact file.

Card analytics are deliberately minimal. We record the type of event (view, QR scan, link click, contact save, share), the time, and a random identifier generated in the visitor's own browser. We do not store IP addresses, device fingerprints, precise location or advertising identifiers, and we do not use tracking cookies.

To limit automated abuse of public forms we count requests against a short-lived, salted, one-way hash of the network address. The address itself is never written down and the hash cannot be reversed back to a person.

If a card owner has enabled contact exchange and you choose to submit your details, those details are stored and shown to that card owner and their workspace.

Uploaded photos, logos and cover images are held in private storage. Public profiles are served short-lived signed links, so files are not publicly listable.

CardSite runs in sandbox billing mode. No payment provider is connected, no card details are requested or stored, and no money changes hands.

Card content and leads stay until you delete them or close your account. To request access, correction or deletion of your data, contact us through the support page. Retention periods and statutory response times must be confirmed during legal review.

Privacy questions: hello@cardsite.app or the support form.