Privacy policy

Two kinds of people

bcards handles data about two distinct groups, under different rules.

• Account holders: people who create a card. They have an account, a password and direct access to their own data.
• Visitors who leave their details: people who never signed up and cannot log in to find their record. The "Your rights" section is written for them.

Account holder data

Name, email address, password (stored as a hash, never in clear text), interface language, and whatever you publish on your cards: headline, bio, links, images, sections.

Legal basis: performance of our contract with you. Without this the service cannot work.

Retention: until you delete your account, which you can do yourself from Settings.

Details captured through a card's form

When someone fills in the "Share your details" form on a card, we record what they entered — name, email, phone, company, message — along with the moment they consented and the exact version of the notice they were shown.

Those details go to the holder of that one card. On a card that belongs to an organization, the holder may share them with that organization, and the form says so before you tick the box. They are never sold, never pooled across other cards, and never used for advertising.

Legal basis: consent, given explicitly through a tick box that is never pre-ticked.

Retention: the window is set by the card's holder and copied onto the record at the moment of capture. Changing that setting later therefore cannot extend a window already communicated. When the window expires the record is permanently deleted — no copy, no tombstone.

Where no window has been set, the record is kept until deleted by hand or on request.

Business cards scanned by a card holder, and shared lists

A card holder can photograph a paper business card someone handed them. The photo is sent to our AI provider, Anthropic (listed under Processors), which reads it to extract the details; the details are then saved in our database. Nothing is saved until the holder checks it and presses Save. A photo that is not a business card is deleted at once, and identity documents are refused.

The holder keeps the details, and the photo unless they choose not to, as a contact on their card, under the card's retention window. Legal basis: the holder's legitimate interest in keeping the details of a person who handed them their card. The person on the card has the same rights, through the same deletion request page, as anyone who filled in a form.

When the card holds an email address, the holder can ask us to send their own card to it, once, with a short message of their own that may not contain links. That email names the holder, says that we hold the details from the card, links to the deletion request page, and offers a link to refuse every later card sent this way. A refusal is kept as a one-way hash of the address, never the address itself, and no holder can send to that address again. Legal basis: the holder's legitimate interest in answering the person who handed them their card.

The contacts a member of an organization receives on their card are theirs: the organization does not see them. A member can choose to share a contact with the organization's shared list, with a note on why it matters; the organization then keeps that copy, every active member of the organization sees it, and it stays when the member leaves. A contact collected before the form said it could be shared with an organization cannot be shared. A member's other lists are visible to them alone.

A contact its holder deletes waits one day, in case of a mistake, and is then erased with its photo. A deletion requested by the person themselves is not delayed.

Demo requests

A company that asks for a demo on the Enterprise page gives us a work email, a name, the company, its size and, if it wishes, a message. We use them to send the booking link and to arrange the demo, nothing else.

Legal basis: steps taken at your request before a contract.

Retention: two years from the request, then permanently deleted. Ask us and we delete it sooner.

Early access requests

Somebody who asks for early access gives us a name, an email, for an organization its name, why they want bcards, how they heard of us, whether they would like to be an ambassador and, if they chose one, the link they want. We use them to decide on the request, to send the sign-up link and, for an organization, the demo booking link.

Legal basis: steps taken at your request before a contract, and our legitimate interest in knowing who wants bcards.

Retention: we keep requests, declined ones included, as a record of who asked, until you ask us to delete yours. A sign-up link stops working after its expiry and is then cleared.

Visit statistics

We count views, QR scans, contact-file downloads and captured details, per card and per day.

No IP address is stored anywhere. To avoid counting the same person twice in a day, the address is put through a one-way function combining a salt that is regenerated daily and a secret key. The result is scoped to the card, so the same person produces a different fingerprint on two different cards and browsing cannot be reconstructed across them.

The day's salt is deleted after two days. From that point the fingerprint can no longer be recomputed from an address, by us or by anyone else: the link is permanently broken.

What remains is aggregate counters, which relate to no identifiable person.

Cookies

bcards sets a session cookie when you sign in. It is strictly necessary to operate the service and therefore requires no consent.

We use no advertising cookies, no third-party trackers and no external analytics. Public card pages set no cookie at all unless you are signed in.

Embedded content

A card may embed a video or other content hosted by a third party. When it does, your browser connects directly to that third party, which may set its own cookies and will see your IP address. That connection is outside our control and is governed by the third party's own privacy policy.

Only providers on a closed list can be embedded, and the URL actually loaded is rebuilt by us from a resource identifier: an address typed by a user never reaches a display frame.

AI apps you connect

You can connect an AI app such as Claude or ChatGPT to your account, from that app, after signing in to bcards and allowing it on a screen that names the app. It can then read the cards you can edit and their visit statistics. Only if you also switch it on, on that screen, can it read your contacts: the people you met, with what they gave you, and your lists. For contacts captured on a company's cards, the company must allow it too. It cannot change or publish anything itself. If you also switch it on, it can suggest changes to your cards and lists: each waits in bcards until you apply or dismiss it, and lapses after seven days. We keep suggestions with your account, and your data export includes them. You can switch each of these permissions on or off later in Settings, under Security.

What it reads is sent to that app and its provider, whom you chose; they are not our processors, and their own terms and privacy policy apply to it. We keep a record of the connection (which app, what it may read, when) and of each request it makes, without the content.

You can disconnect an app at any time in Settings, under Security. Signing out your other devices, resetting your password or changing your sign-in email also disconnects every app.

Images

Uploaded images are reprocessed on the server. EXIF metadata is stripped, which includes the GPS coordinates phones write into photographs. Orientation is applied before stripping, so the image still displays the right way up.

Where the data is and who reaches it

The application and its database are hosted by Railway Corporation / Cloudflare R2, in Amsterdam, Netherlands (EU). Uploaded files are stored in a bucket created with European Union jurisdiction.

We use a transactional email provider, which processes the recipient's address and the message content on our behalf and on our instructions only.

No data is sold, rented or passed on for commercial purposes. Disclosure happens only on a lawful demand from an authority entitled to make one.

Processors

The following providers process data on our behalf, on our instructions only, under a data processing agreement as required by Article 28 of the GDPR:

• Railway Corporation — hosting of the application and its database, Amsterdam region (Netherlands). Its technical access logs hold the IP address of requests for a limited time, for operations and security.
• Cloudflare, Inc. — storage of uploaded images (Cloudflare R2), in a bucket created with European Union jurisdiction.
• Brevo (Sendinblue SAS, France) — delivery of transactional email and, where you have opted in, notifications: the recipient's address and the message content.
• Sentry (Functional Software, Inc.), European Union region (Frankfurt) — technical error reports. Reports carry no account identifier, no IP address and no cookie; tokens present in an address are removed before sending.
• Anthropic, PBC: the AI assistant (beta), only for accounts whose plan includes it and only when you use it: the messages you send, the card, contact and statistics details the assistant reads to answer them, and the photos of paper business cards it reads to extract their details. We do not store the conversations. Under its commercial terms, Anthropic does not use this data to train its models.

None of these providers is permitted to use the data for its own purposes.

Your rights

You have the right of access, rectification, erasure, portability and objection.

If you have an account: Settings lets you export everything we hold about you as a readable file, and delete your account. Deletion is immediate and permanent.

If you only left your details on someone's card: the "Deletion request" page gets your record erased without creating an account. You enter the email or phone number you gave; if we hold a matching record, a single-use confirmation link is sent to the email address on that record — never to an address typed into the form, which would otherwise let anyone have someone else's data deleted by guessing.

If the record we hold carries no email address, we have no safe way to reach you: contact the card's holder directly, or write to us.

For any question, or to exercise a right in writing: PLACEHOLDER.

You may also complain to the Instance Nationale de Protection des Données Personnelles (INPDP) in Tunisia, or to the supervisory authority where you live.

Security

Traffic is encrypted in transit. Passwords are stored as hashes. Access is partitioned by workspace and by role, and every privileged action is written to an audit log.

Uploaded files are checked on their actual bytes rather than their name or declared type; formats that can carry script are refused.

Changes

The date this wording last changed is shown at the top of this page. The notice displayed in the capture form is versioned separately, and every record keeps the version actually shown to the person: a later revision of our text cannot retroactively count as consent.