Privacy Policy

Card2Tap provides digital business profiles, NFC cards and other NFC products, QR sharing, Apple Wallet and Google Wallet passes, subscription plans, business tools and Team accounts. In this policy, “Card2Tap”, “we”, “us” and “our” mean Card2Tap INC. (“Card2Tap”), which operates card2tap.com and the Card2Tap services.

This policy explains what personal information we collect, why we use it, when we share it, how long we keep it and the choices you have. It applies when you:

• visit card2tap.com or a Card2Tap profile;
• create or use a Card2Tap account, plan or Team;
• create, edit or publish a digital profile;
• order NFC cards or other physical products;
• tap an NFC product or scan a Card2Tap QR code;
• add a Card2Tap pass to Apple Wallet or Google Wallet;
• share your details through a profile’s contact form or request an appointment;
• use Link Finder or Card2Tap’s AI features;
• contact Card2Tap support.

It does not cover other websites or services you open from a Card2Tap profile, such as a social network, a booking site or a map. Their own privacy policies apply.

Account information

Your name, email address, sign-in details, the plans you hold and their dates, your account settings and, for Team accounts, your team, role and department. Your password is stored by WordPress in protected (hashed) form — Card2Tap staff cannot see it.

Profile information

What you choose to add to your profile: your name, job title, company, profile photo, logo and banner, description, phone numbers, email addresses, website and social links, address or location, products and services, gallery items, custom sections, appointment settings and design choices. Photos you upload are re-processed and their embedded metadata (such as camera or location data) is removed.

Order information

When you buy a product or a plan: your name, billing and shipping addresses, email address, phone number, what you ordered, the text printed on your product, your design choices, uploaded logo and approved proof, Team card assignments, tax and shipping details, and the payment status. If you ask to buy tax-exempt, we record the exemption reference you give us (such as a certificate or status card number).

Information from other people

Visitors to a profile can send the profile owner their details through the contact form or an appointment request. Team owners and administrators can invite members and enter or edit some of their profile details.

Support messages

When you contact us: your name, email address, topic, message and, if you provide them, an order number or team name. The support form does not accept attachments, and it refuses messages that contain a payment card number.

Technical information

Like most websites, our server receives your IP address, browser and device type and the pages you request. Our security software records sign-ins and other account events — including the username, IP address and approximate country — to protect accounts and detect attacks. Card2Tap’s own profile statistics do not store IP addresses. Where we need to recognise repeat requests or keep evidence (for example for contact sharing, marketing consents and appointment requests), we store a scrambled version of the IP address and browser details rather than the readable address. Cookies are described in Cookies and analytics.

New profiles start as drafts. A draft is visible only to you while you are signed in; anyone else who opens its link sees a “Profile not found” or “not published yet” page. When you publish, the information you chose to show becomes available through:

• your profile address (card2tap.com/p/…) and any link you share;
• your QR code;
• NFC cards and other NFC products linked to your profile;
• Apple Wallet and Google Wallet passes, if you offer them;
• the “Save contact” file (vCard) visitors can download;
• link previews in messaging apps and social networks (name, description and image).

Card2Tap asks search engines not to index profile pages, and profiles are not listed in our sitemap. A profile owner on a plan that includes it can choose “Show in search engines” for their own profile; search engines may then index that page and the business details the owner put on it. Someone who receives your link can still share it with others. While you have an active plan, you can unpublish your profile at any time in your dashboard (without one, ask us and we will do it); it stops being available right away, although copies others have already saved (such as a downloaded contact or a Wallet pass on their phone) stay on their devices.

What an NFC tap or QR scan does

An NFC product contains a link, not your personal details. Tapping it or scanning your QR code opens your profile in the visitor’s browser. For your statistics we record that the profile was viewed or the card was tapped, with the date and time. We do not record the visitor’s identity, IP address, device or location for these statistics.

We use personal information to:

• create and manage accounts, plans and Team accounts;
• host, display and share digital profiles;
• process orders and payments, produce personalized products and ship them;
• run NFC, QR, Apple Wallet and Google Wallet features;
• deliver contact-form messages and appointment requests to profile owners;
• run Link Finder and the AI features you choose to use;
• show profile owners and Team administrators their statistics;
• answer support requests and send service emails (for example order, account, plan and appointment emails);
• keep Card2Tap secure and prevent fraud, spam and abuse;
• troubleshoot and improve our services;
• keep business, tax and accounting records and meet legal obligations.

Marketing

Card2Tap does not currently send marketing newsletters to its customers. If we start, we will ask for your consent where the law requires it, identify ourselves in every message and include a way to unsubscribe. Service emails needed to provide what you signed up for are still sent.

Legal bases for processing — where applicable

Where the law requires a legal basis (for example in the European Economic Area or the United Kingdom), we rely on: performing our contract with you (accounts, plans, profiles, orders); our legitimate interests in running, securing and improving Card2Tap (security, fraud prevention, statistics); your consent where we ask for it (for example marketing opt-ins); and legal obligations (such as tax records). The basis depends on the activity — there is not one basis for everything.

Sharing your details with a profile owner

A profile can offer a form for visitors to share their details. It asks for your name, email and/or phone number and, optionally, your company, job title and a message, and you must confirm that you agree to share them with that person. Your details go to the profile owner, who sees them in their Card2Tap dashboard and receives an email saying that you shared them. Sharing your details does not sign you up for marketing. We keep a record of your agreement — the wording, the time and a scrambled version of your IP address and browser details — to show the details were shared with permission.

Appointment requests

If a profile accepts appointment requests, you can send your name, email address, a phone number (if the profile asks for one), a note, the service, your preferred time and your time zone. The profile owner receives the request in their dashboard and by email, and can confirm, decline or suggest another time. Some services may be set to confirm automatically. We email you about your request and send reminders before a confirmed appointment.

Request forms

Some profiles offer a request form — for example a quote request, a home valuation request or a question. It asks for your name, an email address or phone number, and what the form needs (such as what you need, a property address and type, or your question), and you must confirm that you agree to send these details to the profile owner. The profile owner sees your request in their Card2Tap dashboard and receives an email saying a request arrived. We keep a record of your agreement — the wording, the time and a scrambled version of your IP address — to show the details were sent with permission. Sending a request does not sign you up for marketing.

Link Finder

Link Finder helps profile owners add their business and social links. It uses the information you enter — such as your business name, city, address, website or a social handle — to suggest and check public links. To check a link, Card2Tap’s server visits that address (for example your website or a public social profile) and sends only the link itself. Link Finder never asks for your social media passwords.

Profile statistics

Profile owners see totals and daily counts of profile views (including QR scans), card taps, contacts saved, details shared with them, Wallet passes added, AI chat conversations, appointment requests and requests sent through request forms. They also see how often the buttons and links on their profile were used (for example the action bar, booking or ordering links, contact details and listing links): Card2Tap counts these clicks without cookies and without storing IP addresses or device details, and the same visitor is counted at most once per 30 minutes per button. These statistics do not identify individual visitors.

We share personal information only as described here:

• With the people you choose. Your published profile, and details you send to a profile owner.
• Within your Team. Team owners and administrators see and manage Team information as described in Teams.
• With service providers that run parts of Card2Tap for us and may use the information only for that purpose. The providers in use today are listed below.
• With shipping carriers that deliver physical orders: the recipient’s name, address, phone number and package details, and customs information for international shipments.
• For payment disputes. If a payment is disputed or charged back, the records needed to respond — such as order details, proof approvals, delivery and tracking information and our messages with you — with our payment provider and the card network or financial institution involved.
• With professional advisers, such as accountants and lawyers, where needed.
• Card2Tap staff can access account, profile, order and support information when needed to provide support, produce and ship orders and run the service. Access is limited to authorized staff.
• For legal reasons, when reasonably necessary to comply with the law or a valid legal request, enforce our terms, prevent fraud or abuse, or protect people’s rights and safety.
• In a business transfer, such as a merger, financing or sale of all or part of our business, subject to appropriate safeguards.

Service providers we use today

We do not sell personal information

Card2Tap does not sell personal information, and we do not use advertising or retargeting tags on card2tap.com.

Cookies are small files a website stores in your browser. Card2Tap uses cookies and similar browser storage for these purposes:

We do not use advertising cookies. You can delete or block cookies in your browser settings; if you block essential cookies, signing in, the cart and checkout will not work.

Analytics

We measure visits to card2tap.com with Burst Statistics, which runs on our own server: visit data is not sent to an analytics company, and the shop records how visitors arrived when they place an order. Profile owners’ statistics are counted by Card2Tap itself, as described above, without storing visitors’ IP addresses.

Some plans include AI tools: profile setup suggestions, help writing your bio, title and services, marketing drafts and, if a profile owner turns it on, an AI chat that answers visitors’ questions about the owner’s business. Team administrators on eligible plans can request bio suggestions for members.

An AI feature runs only when someone uses it. The information relevant to that request — for example the profile details, business notes or services it should write about, and the text you type — is sent to our AI provider (Google (Gemini API)) to generate the result. Card2Tap does not keep transcripts of visitors’ AI chat conversations: a conversation stays in the visitor’s browser tab and is gone when the tab is closed. If a visitor sends an appointment, quote or callback request from the chat, the details they review and confirm — and any files they attach to a quote request — are sent to that business (its appointment requests or contacts) only after the visitor agrees. Questions the chat could not answer are kept for the business for 90 days, with email addresses and phone numbers removed, and files attached to quote requests are deleted after 180 days. We keep a technical record of each AI request (which feature, when, whether it worked and which kind of information supported the answer) for up to 180 days; it does not contain the text you sent or received.

The Card2Tap AI Assistant on card2tap.com (“Ask Card2Tap”) is different: so that our team can join a conversation, follow up and improve the answers, its conversations are kept on our servers for 30 days, or 180 days when the conversation led to a request or a handoff to a person. You can delete your conversation at any time with “Clear chat”. When you are signed in and ask about your account, the assistant uses your own recent orders, plan, profiles, Design Studio projects, Teams and cart to answer — never anyone else’s. If you use the microphone, your recording is sent to our AI provider to be turned into text and is not kept; spoken answers are created only when you tap “Listen”. Device details (such as phone, browser and the page you were on) are shared with our support team only if you choose to share them.

AI suggestions for a profile are drafts: nothing is added to the profile until the owner or their Team administrator reviews and accepts it. A profile’s AI chat answers visitors directly, using the information the owner provided. Card2Tap’s AI features help with content and setup; they are not used to make decisions about people that have legal or similarly significant effects.

A Team account holds the organization’s name and branding, its members (names, email addresses, roles, departments and locations), invitations (email address and, if entered, name, job title and phone), member profiles, seats, Team cards and their assignments, shared links and templates, Team billing and orders, Team statistics and an activity log.

Depending on their role, Team owners and administrators can: invite and remove members; edit members’ name, job title and description and publish or unpublish their profiles; apply shared branding and lock some profile fields; manage Team cards, links and templates; see Team statistics per member; and manage the Team plan and billing. Managers can do some of this for their own departments.

Team administrators cannot see the contacts that visitors share with a member, or the contact details of people who request appointments with a member.

If you are removed from a Team, you keep your Card2Tap account and profile, but your profile is unpublished and loses the Team’s branding, and Team cards are unassigned from you. If your Team membership is deactivated, your profile is normally unpublished and your Team seat freed. The Team keeps its own records, such as membership history, card assignments, billing and orders.

If a profile offers Wallet passes, anyone who has the profile can add it to Apple Wallet or Google Wallet. A pass contains the published profile details: name, company, job title, phone, email, website, a short description, the profile link and QR code, and the profile image.

Apple Wallet: Card2Tap creates the pass on our server and the person downloads it to their device. Card2Tap does not send the pass to Apple and does not track the pass after it is added.

Google Wallet: Card2Tap sends the pass details to Google so Google can create the pass, and updates it when the profile owner changes their profile. If the profile is unpublished or deleted, the pass is withdrawn and its details removed.

Apple and Google operate their Wallet services under their own privacy terms.

We use order information to process, produce, ship and support your order, to provide the plan that comes with it, and to keep accounting and tax records. Your uploaded logo, design and approved proof are kept with the order so we can produce it.

Payments. Payments are processed by Stripe. Card2Tap receives the payment status and transaction references, and may receive limited card details such as the card type and last four digits. We never receive or store the full card number or security code.

Shipping. For physical orders we use the recipient’s name, address, phone number and the package details to ship the order, and share them with the carrier that delivers it. International shipments also need customs information, such as the contents and their value. If you choose Local Pickup, we use your name and order to hand over the order.

How you arrived. When you place an order, the shop records how you reached card2tap.com (for example a search engine, a link or direct visit), to understand which channels bring orders.

We keep personal information only as long as reasonably necessary for the purposes in this policy — to provide the service, keep business and transaction records, resolve disputes, prevent fraud and meet legal obligations. Different information is kept for different periods. Some periods are set today:

• Designs you start but never approve: deleted after 3 days; approved designs that are never ordered: deleted after 30 days.
• Temporary uploads: deleted after 2 days.
• Technical records of AI requests: 180 days.
• Conversations with the Card2Tap AI Assistant on card2tap.com: 30 days, or 180 days when they led to a request or a handoff (or until you choose “Clear chat”). Voice recordings are not kept.
• Dashboard notifications: 90 days.
• Email delivery records (the address an email went to, its subject, when it was sent and whether it was delivered): 180 days. An email’s content is deleted once it has been sent; if it couldn’t be delivered, it is kept with that record so we can send it again. Emails containing a one-time link, such as a password reset, are never stored.
• Support messages, Help searches and article feedback: 2 years.
• Unfinished Team card orders: 14 days.
• The address of a deleted profile is reserved for one year so it cannot be taken over by someone else.
• Opt-out and unsubscribe records are kept so we can keep honouring them.

Other information — such as your account, profiles, shared contacts, appointment requests and statistics — is kept while your account is active or until it is deleted. Orders and invoices are kept as long as accounting and tax rules require.

Deleting your account

While you have an active plan, you can unpublish your profile in your dashboard; without one, ask us and we will do it. To close your account, send us a privacy request. When an account is deleted, its profiles and their content, uploaded images, shared contacts, appointment information and statistics are deleted, Card2Tap cards linked to it are switched off and Google Wallet passes are withdrawn. We keep what we must or may lawfully keep — such as orders, invoices and the designs produced for them, payment and tax records, a record of plans and access changes, and information needed to resolve disputes or prevent fraud.

Team accounts

A member leaving a Team does not delete the Team’s own records. When a Team plan ends, Team features stop after a grace period; Team information is not deleted automatically. Ask us if you want a Team account closed.

We use administrative, technical and organizational safeguards designed to protect personal information appropriately for its sensitivity. They include encrypted connections (HTTPS), passwords stored in protected form, limits on sign-in attempts, security monitoring of sign-ins, access to information limited by role, encrypted storage of the credentials for connected services, private storage for logos and proofs, and regular backups. Card payment details are entered directly into our payment provider’s secure form.

No method of transmitting or storing information is completely secure, so we cannot guarantee absolute security. If a privacy breach creates a real risk of significant harm, we will notify the people affected and the authorities as required by applicable law.

Card2Tap is based in Canada. Our website, its database and uploaded files are hosted on a server in Germany. Some of our service providers, such as Stripe and Google, may process information in the United States and other countries. Privacy laws there may differ from those where you live, and information may be accessible to authorities there under their laws.

Where the law of your country requires safeguards for international transfers (for example in the European Economic Area or the United Kingdom), we rely on the safeguards that law provides for. Ask us if you would like more information.

Depending on where you live and the laws that apply, you may have rights over your personal information.

Canada

Subject to applicable law, you can ask what personal information we hold about you and how we use it, access it, ask us to correct it, withdraw consent where the law allows, and raise a concern with us. If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada. Residents of a province with its own private-sector privacy law, such as Québec, may also have rights under that law where it applies.

European Economic Area and United Kingdom — where applicable

Where the GDPR or the UK GDPR applies to our processing of your information, you may have rights to access, correct and erase it, to restrict or object to its processing, to receive it in a portable format and to withdraw consent, and to complain to your data protection supervisory authority (in the United Kingdom, the Information Commissioner’s Office).

United States — where applicable

Depending on where you live and whether a state’s legal thresholds are met, you may have rights under state privacy laws, such as to know, access, correct or delete your information and to get a copy of it.

United Arab Emirates — where applicable

Where the UAE Personal Data Protection Law applies to our processing of your information, you may have rights under it, such as to request information about and access to your personal data, and to ask for its correction or erasure.

How to make a request

Use our privacy request form or email info@card2tap.com with the subject “Privacy Request”. Tell us what you would like: access your information, correct it, delete it, withdraw consent, or ask a privacy question. To protect your information, we may need to confirm your identity — usually by replying from the email address on your account — and we will not ask for more than we need. We respond within the time required by applicable law. If you are a Team member, some information may be controlled by your Team; we may refer you to your Team administrator.

Card2Tap is intended for adults and for business and professional use. It is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, please contact us and we will delete it where appropriate.

Other websites. Profiles can link to websites, social networks, review pages, maps, calendars and booking pages. When you open one, its owner’s privacy practices apply, not ours. Videos in a profile gallery load from YouTube’s privacy-enhanced service only after you press play.

Sensitive information. Card2Tap is designed for professional and business information. Please do not add sensitive personal information — such as health information, government identification numbers or financial account details — to your profile, messages, AI requests or support messages.

We may update this policy to reflect changes to Card2Tap or to the law. The date at the top shows when it was last updated. If we make significant changes, we will tell you through the website, your account or by email where appropriate, and ask for your consent where the law requires it.

Questions or concerns about your privacy, or about this policy? Contact our Privacy Officer, Card2Tap. We will review your concern and respond.