Privacy

TapCardLink is operated by [ENTITY — NOT YET SET], of [ADDRESS — NOT YET SET], which is the data controller for everything described here. Questions, requests and complaints go to [CONTACTEMAIL — NOT YET SET], and are answered by a person.

The service is governed by the law of [JURISDICTION — NOT YET SET]. Where you live may give you additional rights — section 7 covers the ones we apply to everybody regardless of where they are.

Almost all of it is information you are deliberately publishing. A digital business card is a document whose entire purpose is to be handed to strangers, so the honest summary is: what you put on your card is public, and you decide field by field what goes on it.

Account

Your email address and your name. Your password is handled by Supabase Auth and is stored as a hash — we never see it and cannot recover it. We record when the account was created and when it was last used.

Card content

Name, job title, company, a short bio, phone number, email, website, postal address, social handles, custom links, and the photographs you upload. Each contact field has its own public/private switch. A field switched off is never returned to a visitor — that is enforced in the database, not in the interface.

Your address

The slug in tapcardlink.com/your-name. It is public by definition and is the one thing on the card that is meant never to change.

Photographs

Stored in Supabase Storage, in a folder named for your account id, in a bucket that is publicly readable. That is what lets a card photo load on a stranger’s phone with no session. Do not upload anything you would not put on a business card.

We do not buy information about you, we do not enrich your account from other sources, and we do not sell or rent anything in the table above to anyone.

Nothing that identifies them, and this is the part of the product we have been strictest about. When someone opens a card, we record that the card was opened. We do not record who opened it.

Each analytics row holds exactly five things, and no more:

• What happened — a view, a QR scan, a contact saved, a tap on the phone number, the email, the website, a custom link, a social link, or the share button.
• Which element it was, where there is more than one of a kind — which custom link, which social platform.
• Whether the visitor arrived from a scanned code, a link, or a share.
• A device class: mobile, tablet or desktop.
• The host a visitor came from, if any — linkedin.com, never the full address of the page they were on.

One consequence worth stating plainly: because visitors are not identified, the view count is a count of openings, not of people. The same person opening a card twice is two views. We would rather give you a number with a known limitation than a precise one built on tracking somebody who never agreed to it.

Two mechanisms need to know who is calling, briefly, and neither of them writes it down.

Rate limiting

To stop one caller flooding the analytics or the sign-up form, we count requests per caller. The caller’s IP address is hashed with a per-server secret the moment it arrives, only the hash is used as a counter key, and the counter is held in memory and expires within the hour. The address itself is never written to disk or to the database.

Infrastructure logs

Our hosting provider and Supabase keep their own short-lived request logs, which do contain IP addresses, in the ordinary way that any web server does. We do not query them for analytics and do not copy anything out of them. Their retention is set by them, not by us.

There is no cookie banner on this site because there is nothing on this site that would require one. We use no analytics cookies, no advertising cookies and no third-party trackers of any kind.

• A session cookie, set only after you log in, which keeps you logged in. Removing it logs you out; there is no way to offer accounts without it.
• A single browser storage entry remembering whether you chose the dark or light theme. It is set only if you use the toggle, it never leaves your browser, and clearing it just returns the site to following your system setting.

A public card sets nothing at all. Someone can scan a QR code, read a card, save the contact and leave without anything being stored in their browser.

Three processors, each doing one job, and no one else. We do not use advertising networks, data brokers, or third-party analytics.

Supabase

The database, authentication, and file storage. Everything in section 2 lives there. They process it on our instructions under their data processing agreement.

Our hosting provider

Serves the pages. Sees requests as any web host does; stores no application data.

Our email provider

Sends the four transactional emails the product sends: confirm your address, reset your password, confirm an email change, and nothing else. No newsletter, no product marketing, unless you separately ask for it.

We will disclose information if a law that binds us requires it. If that happens and we are permitted to tell you, we will.

These apply to everyone who uses the service, wherever they live. Where the GDPR, the UK GDPR, Mexico’s LFPDPPP or a comparable law gives you more, that law wins and we will follow it.

See it

Everything we hold about you is on your dashboard already — your account, your card, and your analytics. Ask at the address below if you want it as a file.

Correct it

Edit your card, at any time, without the link or the QR code changing. That is the product.

Delete it

Settings → Delete account. It removes your profile, your card, your links, your uploaded images and your analytics. Your published address stops resolving, which means any printed QR code pointing at it stops working. That is irreversible and the interface says so before you confirm.

Take it with you

Your card is downloadable as a vCard from its own page, which is the portable format contact information actually has. Ask at the address below for anything else.

Object, or complain

Write to [CONTACTEMAIL — NOT YET SET]. If you are in the EEA or the UK you may also complain to your national supervisory authority; in Mexico, to the competent authority under the LFPDPPP. We would rather you told us first.

• Account and card data: until you delete the account, or until it is deleted under the terms.
• Analytics events: rolled into daily totals, which is what your dashboard reads. Both are removed when the card is deleted.
• Abuse reports: kept after the card is gone, because a record of what was reported and what was done about it is the only defence either side has later. A report holds the address complained about, what was said, and the reporter’s email if they chose to leave one.
• Rate-limit counters: minutes, in memory, then gone.

The service is for working professionals and is not intended for anyone under 16. We do not knowingly hold information about a child. If you believe a card belongs to one, report it at /report and it will be taken down.

If this document changes in a way that affects what we collect or who sees it, we will email account holders before the change takes effect, not after. The date at the top is the date the current wording started applying.