Privacy Policy

Cardtly is a digital business card platform operated by Cardtly (Pty) Ltd, a company registered in South Africa (registration number 2025/727173/07). This policy explains how we handle personal information about the people who use Cardtly, the people who view and interact with Cardtly cards, and the people whose details are captured through them.

We process personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA). Questions about this policy, or requests about your information, go to our Information Officer at andre@cardtly.com.

POPIA separates the responsible party, who decides why and how personal information is processed, from the operator, who processes it on someone else's behalf. Cardtly is one or the other depending on whose information it is, and this is the single most useful thing for an organisation to understand before using us.

Where we act as your operator, we process that information only to run the service for you, and our obligations to you are set out in the data protection section of our Terms of Service. You remain responsible for having a lawful reason to collect it and for telling people how you will use it.

Account information. Your name and email address, and a password if you use one, which is stored only as a one-way hash by our authentication provider. We never see or keep the password itself. You can instead sign in with a one-time link emailed to you, or with a Microsoft work or school account. If you use Microsoft, you sign in on Microsoft's own page, Microsoft sends us your name and email address, and no Cardtly password exists; your organisation's own Microsoft security settings, such as multi-factor authentication, apply to that sign-in.

Where you signed up from. When you create an account we look up the approximate city, region and country of your internet connection, using the IP address it arrived from, and store that on your profile. The lookup is done by ipapi.co (see section 7). We do not store the IP address itself on your profile.

Card content. Everything you put on your card: name, job title, company, phone and WhatsApp numbers, email, address, website, bio, photographs, logos, gallery images and captions, links and social profiles. This is published at your card's address and is public by design (see section 5).

People who view your card. When someone opens a card or taps something on it, we record that it happened, which link or button they used, their device type, browser and operating system, and the website that sent them, reduced to the site's address rather than the full page. We do not store the IP address of people who view a card. To count unique visitors we derive a one-way code from the connection and browser that is different for every card and changes every day, so it cannot be used to follow a person between cards or from one day to the next.

Details people submit through a card. When a visitor saves your contact and shares their own, fills in a lead form, requests a meeting, or answers a questionnaire, we store what they submit (typically their name, email, phone number, company and message) so that you can follow up.

Team account information. For organisations: the organisation's details, its companies and departments, which fields are locked, the cards issued to staff, and any sales activity that staff choose to record in the activity log (the company, contact and subject of an email, LinkedIn contact or networking event).

Payment information. Card payments are handled by Paystack. We never see or store your card number. We keep your subscription status, a Paystack customer reference, and the email used for billing. Organisations invoiced directly also have their invoices, quotes and billing contact stored with us.

Accepting a quote or signing a purchase order. When someone accepts a quote through the link we send, we record the name and email address they type, when they accepted, and the IP address and browser it came from, as evidence of the acceptance. A purchase order signed through its link records the same, plus the signer's job title and the signature they draw.

Physical NFC card orders. If you order a physical card, we store your name, delivery address and phone number so that it can be made and delivered.

Reseller applications. If you apply to resell Cardtly, we store the business and contact details you send us (your business name, registration and VAT numbers, address, contact person, email, phone and what you tell us about your plans) so that we can review the application and, if we approve it, set up and invoice your reseller account. A reseller sees the names, seats and admin email address of the client teams it creates, and the names, titles and card links of their staff when ordering printed NFC cards for them.

AI features. If you use the bio writer, the details you give it are sent to generate a suggestion. If you scan a paper business card, the photograph is sent to be read, and the details on it are returned to you as a contact. Both are processed by OpenAI (see section 7).

Cookies and similar storage. We use first-party cookies to keep you signed in and to remember your settings, and your browser's local storage to avoid counting the same card view twice. We do not use advertising cookies or third-party tracking cookies on our website.

The mobile apps. See section 13.

POPIA requires a lawful reason for processing. These are ours:

We do not sell personal information. We do not use it for advertising. We do not use your information, or information captured through your card, to train AI models. We do not make decisions about anyone based solely on automated processing.

A card is public by its link. Anyone who has your card's address can see what is on it, exactly as if they had been handed a printed card. Put nothing on a card that you would not print on one. In particular, do not put special personal information (such as health, religion or political views) or information about children on a card.

Cards are listed in the Cardtly Network by default. The Network is a public directory of Cardtly cards. You can remove your card from it at any time in your card settings, and an organisation can remove every card on its team account at once.

Being featured on our home page is opt-in. We only feature a card there if its owner has switched that on.

What is not public: who viewed your card, who saved it, the contacts it captured, and anything in your account or dashboard.

When an organisation gives its staff Cardtly cards, the organisation is the responsible party for those cards and for the leads they capture, and Cardtly is its operator. In practice this means:

• The organisation's administrators can see and edit the team's cards, see the contacts those cards capture, see card analytics, and see the activity log staff choose to record.
• Administrators decide which details on a card staff may change and which are fixed.
• When someone leaves, the organisation keeps the card and the contacts it captured. It can archive the card, which takes it offline, or reissue it to someone else.
• Staff with questions about how their employer uses this information should start with their employer, who can also exercise the rights in section 10 on their behalf.

We use a small number of service providers to run Cardtly. Each is bound by its own published data protection terms and receives only what it needs for the job below.

OpenAI states that it does not use data sent through its API to train its models. Links to each provider's own policy: Supabase, Vercel, Paystack, Resend, OpenAI, ipapi.co, Google, Apple, Microsoft.

We will update this list, and the date at the top of this page, before a new provider starts processing personal information for us.

We may also disclose information where the law requires it, to enforce our Terms of Service, or to protect the rights, property or safety of Cardtly, our users or others.

Our database and uploaded files are hosted by Supabase in its West Europe region, in the European Union. Personal information stored by Cardtly is therefore processed outside South Africa. Our other providers may process the information they receive in other countries, including the United States, and our website is served through a global network.

POPIA section 72 allows this where the recipient is bound by law or binding rules that give protection substantially similar to POPIA's, or where the transfer is needed to provide the service you asked for. We rely on both. The European Union's General Data Protection Regulation is at least as strict as POPIA.

If your organisation requires personal information to be stored only in South Africa, tell us before you sign up. That is not something we offer as standard today.

Deleting your account is immediate. It removes your account, cards, the contacts they captured, any organisation you own with its team cards, your orders and subscription records, and the photographs and logos you uploaded, from our live systems straight away. Copies can remain in encrypted backups until those are overwritten, within 90 days, and are not used for anything in the meantime.

We may keep a record for longer where the law requires it, for example for tax. Paystack keeps its own record of the payments you made, under its own obligations.

Under POPIA you may:

• Access the personal information we hold about you, and ask who it has been shared with.
• Correct it if it is wrong or incomplete, or delete it.
• Object to processing based on our legitimate interest, and to direct marketing.
• Withdraw consent where processing is based on consent.
• Complain to the Information Regulator at inforegulator.org.za.

Export and deletion are self-service. In Dashboard, Settings, under Account, “Download my data” gives you everything we hold about your account as a machine-readable JSON file: your profile, cards, organisations, the contacts your cards captured, orders, bookings and billing history. Security tokens and payment authorisation codes are redacted, because they are credentials rather than information about you. Deletion is on the same screen, and cancels any active subscription before anything is removed. There are also instructions for deleting an account that you can read without signing in.

If a Cardtly user captured your details, that user or their organisation is the responsible party. You can ask them directly, or email us and we will pass your request on and help them deal with it.

For anything else, email andre@cardtly.com. We respond within 30 days, and may need to confirm your identity first.

What protects the information we hold:

• Access enforced by the database. Row-level security in the database itself refuses one customer's records to anyone else, so a fault in the website cannot expose them. Which columns a signed-in user may change is restricted in the database too.
• Encryption. HTTPS only in transit, enforced so browsers will not attempt an insecure connection. Our database, files and backups are encrypted at rest by our hosting provider.
• Passwords are stored only as one-way hashes, and sign-in attempts are rate limited.
• Logged administration. Administrative actions by Cardtly staff, and every change to a subscription, are recorded with who made them and when.
• No card numbers. Payment card details are handled only by Paystack.

We are not currently certified under ISO 27001 or SOC 2. If your procurement process needs a security questionnaire completed, email us.

If a breach affects personal information, we will notify the Information Regulator and the people affected as soon as reasonably possible, as POPIA section 22 requires. Where we hold the information as your operator, we will notify you without undue delay so that you can meet your own obligations.

We send service emails: sign-in and password resets, trial and payment notices, alerts when your card captures a lead or receives a request, and a weekly summary of your card's activity, which you can unsubscribe from. We do not send marketing newsletters, and we do not pass your details to anyone to market to you.

If you contact the people your card captures, you are responsible for doing so lawfully, including POPIA section 69's rules on direct marketing by electronic communication.

The Cardtly apps for Android and iOS open the same service as the website, so everything above applies to them. In addition:

Android. The Android app uses Firebase Analytics, provided by Google, which collects app usage and device information such as the device model, operating system and app versions, and approximate country. It does not collect your advertising ID: those permissions are removed from the app. The app may ask for:

• NFC, to read a Cardtly tag or write your card to a blank one. Tags are never scanned in the background.
• Contacts, only to save a card you receive into your phone's contacts when you tap Save Contact. We never read your existing contacts.

iOS. The iOS app does not include Firebase or any third-party analytics. It may ask for:

• Camera, to scan a paper business card.
• Contacts, to save cards you receive into your phone's contacts. We never read your existing contacts.
• Photos, to choose a picture for your card or a card to scan, and to save your QR code or virtual background to your photos.

Every permission is optional and is only requested when you use the feature that needs it.

Cardtly is a professional tool for adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has created an account, contact us and we will delete it.

We update this policy when what we do changes. The date at the top shows the last update. When a change is material we will email account holders and show a notice on the website.

Cardtly (Pty) Ltd
Registration number 2025/727173/07
119 Pretoria Road, Benoni, Gauteng, South Africa
Telephone 062 460 7440
Information Officer: andre@cardtly.com

You also have the right to complain to the Information Regulator (South Africa) at inforegulator.org.za.