Privacy Policy

Last updated 3 July 2026 · UK GDPR & Data Protection Act 2018

What we collect and why

Account: your name, email and a hashed password — to run your account. Passwords are stored only as one-way hashes.
Card page content: whatever you choose to publish (photo, details, links, documents on your public shelf). Publishing it is your choice and you can edit or remove it at any time.
Private vault documents: stored outside the public web space, never listed publicly, served only to you when logged in or via share links you create. Every access is logged so you can see who opened what, and when.
Leads: details a visitor submits through your card's "swap details" form are stored and emailed to the card owner. If the visitor leaves an email address we send them one confirmation email with the owner's card link — no marketing, no list.
Usage analytics: we log card-page views (with truncated technical data such as IP and tap source) so owners can see how their card performs. We don't run third-party ad trackers.
Orders: name, email and order details. Payment is processed by Stripe — card numbers never touch our servers.

Directory, perks & connections

Appearing in the members directory or perks wall is opt-in and reversible from your dashboard. Connections ("card swaps") are visible to the two members involved.

Legal bases

Performance of a contract (running your card and account), legitimate interests (service analytics, fraud prevention), and consent where we ask for it (directory listing). We don't sell personal data — to anyone, ever.

Where data lives

Data is hosted in UK data centres. Emails are sent through our authenticated UK mail provider. Uploaded files are held outside the public web root and streamed through the application.

Retention

Your content stays while your account is active. Delete your account (email us) and your cards, profile, documents and leads are removed. Expired document share links stop working automatically.

Your rights

Access, rectification, erasure, restriction, portability and objection — email hello@card1.net and we'll act within one month. You can complain to the ICO (ico.org.uk) if you're unhappy with our answer.

Card owners as controllers of their leads

If you collect leads through your card, you are the data controller for those leads; Card1 processes them for you (storage, delivery, export). Use your leads lawfully — contact people about what they asked about, and stop when they ask.

Cookies

One first-party session cookie to keep you logged in. No advertising cookies, no cross-site tracking.

Card1 sets two cookies, both first-party, and neither of them tracks you across other websites:

We do not use advertising cookies, analytics cookies, or any third-party tracking pixels on this website. Because both cookies are either strictly necessary or set at your explicit request, we do not ask for prior consent under the Privacy and Electronic Communications Regulations — but we do tell you about them, which is what the notice at the bottom of the page is for.

If we ever add analytics or advertising, this section will change and you will be asked to opt in before anything loads.

Marketing email. If you have a Card1 account we may email you about the product. Every marketing email carries a one-click unsubscribe that works without signing in, and we act on it immediately. Transactional email about your own account — receipts, sign-in codes, your card — is not marketing and continues regardless, because you need it.