Trust
Trust Centre
How Cardtly protects the information you give us, and the documents a procurement or legal team will ask for.
Last updated: 22 October 2026
Privacy PolicyWhat we collect, why, who processes it, where it is stored and for how long.POPIA operator agreementSection 5 of our terms: what we commit to when we process your leads and staff details for you.PAIA manualThe records we hold and how to request one, as section 51 of PAIA requires.Deleting an accountHow to remove an account and everything in it, readable without signing in.Security questionnaireSend us your procurement questionnaire or data processing agreement and we will complete it.
The short answers
| Question | Answer |
|---|---|
| Where is our information stored? | With Supabase, in its West Europe region, in the European Union. Storage only in South Africa is not offered as standard. |
| Who can see the leads our cards capture? | Only your account, or on a team account your organisation’s administrators. The database itself enforces this, not just the website. |
| Do you store card numbers? | No. Card payments are made on Paystack, and we never see the card number. |
| How do people sign in? | With a password, a one-time link emailed to them, or Sign in with Microsoft. Cardtly has no two-factor sign-in of its own; with Microsoft, your organisation’s own multi-factor and conditional access rules apply. |
| Can we take our information out, or delete it? | Yes, both self-service. Export gives a file of everything we hold about the account. Deletion is immediate from live systems, and encrypted backups are overwritten within 90 days. |
| What happens if there is a breach? | We notify the Information Regulator and the people affected as soon as reasonably possible, as POPIA section 22 requires, and, where we process the information for you, we tell you without undue delay. |
| Who is responsible under POPIA? | You are the responsible party for your leads and your staff’s card details, and Cardtly is your operator. Cardtly is the responsible party for account and billing details. |
| Is Cardtly certified? | Cardtly is not certified under ISO 27001 or SOC 2. The platforms we run on are independently audited: see below. |
How your information is protected
- Access enforced by the database. Row-level security refuses one customer's records to anyone else, so a fault in the website cannot expose them. Which fields a signed-in user may change is restricted in the database too.
- Encrypted in transit and at rest. HTTPS only, with browsers told to refuse an insecure connection to us for two years. The database, files and backups are encrypted at rest by Supabase.
- Browser protections. Other sites cannot frame our pages, files cannot be reinterpreted as code, and a card's address is not passed on to the sites it links to.
- Passwords and limits. Passwords are stored only as one-way hashes. Sign-in attempts are rate limited, and so is each key on our customer API.
- Logged administration. Administrative actions by Cardtly staff, and every change to a subscription, are recorded with who made them and when.
- No IP addresses for card visitors. We do not store the IP address of people who view a card, and the code used to count unique visitors changes daily and differs for every card.
- No card numbers. Payment card details are handled only by Paystack.
Our platforms’ certifications
Cardtly runs on platforms that are independently audited and publish their own reports. Their certifications cover their platforms, not Cardtly's own processes.
| Platform | What it does for us | What it states |
|---|---|---|
| Supabase | Database, sign-in and file storage | SOC 2 Type 2 |
| Vercel | Hosting | SOC 2 Type 2 and ISO 27001:2022 |
| Paystack | Card payments | PCI DSS Level 1 service provider |
Who processes information for us
The complete list of our service providers. What each one receives is set out in section 7 of our Privacy Policy, and we update it before a new provider starts processing personal information for us.
| Provider | What it does |
|---|---|
| Supabase | Database, sign-in and file storage |
| Vercel | Hosts the website and serves cards |
| Paystack | Card payments |
| Resend | Sends our email |
| OpenAI | The AI bio writer and paper card scanning, only when someone uses them |
| ipapi.co | Looks up the city a new account signed up from |
| Google Wallet passes, Firebase Analytics in the Android app, and Google Play | |
| Apple | The App Store |
| Microsoft | Sign in with Microsoft, for those who choose it |
Questions
Security questionnaires, data processing agreements and anything this page does not answer go to our Information Officer, Andre Nel, at andre@cardtly.com or 062 460 7440.
Cardtly (Pty) Ltd, registration number 2025/727173/07, 119 Pretoria Road, Benoni, Gauteng, South Africa.