Privacy Policy

Last updated: September 2026

This Privacy Policy explains what information VCF.cards ("we", "us", "our") collects when you use our service, how we use it, and the choices you have. By creating an account or using the service, you agree to the practices described here.

1. Information we collect

Account information. When you register we collect your name, email address and password (stored only as a secure one-way hash). We never see or store your raw password.

Card / profile content. The details you add to your digital business card — such as job title, company, phone numbers, website, address, social links and profile photo. Team member details added by business account owners fall under the same rules.

Usage data. When someone visits your public profile page we record the visitor's IP address, user agent, and the referring page so you can see profile-view analytics in your dashboard. We also record technical data about your own visits (such as browser type) to keep the service working and secure.

Payment data. When you subscribe, payment processing is handled entirely by Stripe. We store only the records needed to run your subscription (e.g. plan, billing dates, invoice status) — never your card number, which never touches our servers.

Communications. If you contact us or send us an email, we keep a record of that correspondence so we can help you.

2. How we use your information

We use your information to: provide and maintain the service (including rendering your profile page and generating your vCard and QR code); process payments and manage subscriptions; send transactional emails such as account verification, password resets and billing notices; show you your own analytics; prevent abuse, fraud and technical faults; and improve the service. We never sell your personal data, and we never use the content of your cards for advertising.

3. Public profiles and what you choose to publish

Your digital business card is, by design, public. Everything you add to it — your name, contact details, photo, company, links — is visible to anyone who has your profile URL (e.g. /u/your-slug or a team card URL) or scans your QR code. Only share details you are comfortable being public. You can edit or remove any field at any time from your dashboard, and team members can do the same for their own cards.

Note that the vCard file we generate contains the same public contact information as your profile page. People who already saved your card may keep that data on their own devices even if you later change or delete it — we cannot retrieve data that others have downloaded.

4. Profile-view analytics

Visits to public profiles generate an aggregate analytics record (IP address, date, referrer) associated with the card owner so they can see how often their card is viewed. These records are used for the views chart and recent-views list in the dashboard, are not used for any advertising, and are not associated with any other personal data about the visitor. We do not set tracking cookies on profile pages.

5. Payments and billing

All payments are processed by Stripe through their hosted checkout and billing portal. Your card details are entered on Stripe's pages and processed under Stripe's Privacy Policy. We retain only the invoice and subscription records required to operate your account and satisfy tax/accounting obligations.

6. Cookies and local storage

We use a strictly necessary session cookie to keep you logged in and a small cookie or local-storage entry to remember your language preference. If you choose "remember me" at login, we use a securely rotated token cookie. We do not use advertising or third-party tracking cookies, and we do not build behavioural profiles of visitors.

7. Data sharing and third parties

We share your data only with the service providers required to run the service, under appropriate contracts: Stripe (payments and billing), our email delivery service (transactional email), and our hosting provider (server infrastructure). We do not sell, rent or trade your personal data to anyone. We may disclose information where required by law, or to protect our rights, users or the security of the service.

8. Data retention

We keep your account and card data while your account is active, and for a reasonable period after deletion to allow recovery and to meet legal obligations (for example, invoice records are kept as long as required by tax law). Profile-view analytics are retained for a limited period. You may delete your account at any time from your account settings, which removes your profile from the public site.

9. Your rights

Depending on your location (including under the GDPR or CCPA), you may have the right to: access the personal data we hold about you, correct it, request deletion or export of your data, withdraw consent where processing is based on consent, and object to or restrict certain processing. To exercise any of these rights, contact us using the details below — we will respond within the period required by applicable law. Where we process data on behalf of team members, the account owner is responsible for that processing.

10. Security

We use HTTPS encryption in transit, hash passwords with a strong one-way algorithm, rotate remember-me tokens, and restrict API access to tokens that only you can generate and revoke. No system is completely secure, but we take reasonable measures to protect your data and will notify you of any breach affecting your data as required by law.

11. Children

The service is intended for users aged 16 or over (or the minimum age in your country of residence). We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. International transfers

Your data may be stored and processed on servers located outside your country of residence. Where we transfer personal data across borders we rely on appropriate safeguards (such as standard contractual clauses) to protect it.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced by updating the "Last updated" date above and, where significant, by notifying you in the dashboard or by email. Continued use of the service after changes take effect means you accept the updated policy.

14. Contact

For any privacy question or request, use our contact form. We will do our best to respond promptly.