1. Who is responsible
Verve Air, the provider of card4u.pro, is the controller of the personal data described here. Contact us about privacy at info@card4u.pro. For company cards, the company that manages the cards decides what employee details are published, and we process them on its behalf.
2. What we collect
- Account: name, email address and your password (stored only as a secure hash – we never see it).
- Card content you choose to publish: name, job title, company, phone numbers, email, website, address, short bio, social links, profile photo, logo and cover image. A published card is public.
- Private contact phone (optional, never shown on the card): used only to text you a link to add your card to your phone’s Wallet.
- Wallet passes: when you add your card to Apple Wallet, your device sends us an anonymous device identifier and a push token so we can update the pass; for Google Wallet we store when the pass was created.
- Card statistics: counts of card views, contact saves and Wallet adds per card. We do not store visitors’ IP addresses or identities for these.
- Contact form: your name, email, company (optional), topic and message, plus your IP address to prevent spam.
3. Why we use it (legal basis)
- To provide the service you signed up for – your account, cards and Wallet passes (performance of a contract).
- To answer your messages and support requests (our legitimate interest, or steps before a contract).
- To keep the service secure and prevent abuse, e.g. spam limits (our legitimate interest).
- To meet legal obligations, such as tax records once payments apply.
We do not sell personal data, show advertising, or use your data for profiling.
4. Cookies
We use one cookie: a secure login cookie that keeps you signed in (up to 30 days). It is strictly necessary, so no consent banner is needed. We use no analytics or advertising cookies.
5. Who processes data for us
We use trusted providers, only for what is needed to run card4u:
- Cloudflare – hosting, database and image storage (images are stored in the EU).
- Apple – Apple Wallet passes and their update notifications.
- Google – Google Wallet passes, when you choose to add one; and Google Fonts for cards that use a custom design font.
- Twilio – sending SMS install links to your private contact phone.
- Resend – sending email notifications to our team.
Some of these providers may process data outside the EU; where they do, they are bound by the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism.
6. How long we keep it
- Account and card data: while your account exists. Deleting a card or your account removes its data.
- Company cards: while the company keeps them; the company can delete them at any time.
- Contact messages: until your request is handled, and no longer than 24 months.
- Backups may keep data for a short time after deletion before being overwritten.
7. Your rights
Under the GDPR you can ask to access, correct, delete or receive a copy of your personal data, and to object to or restrict its use. Most of your data you can change yourself in your dashboard. For anything else, email info@card4u.pro – we reply within one month.
You can also complain to the Hellenic Data Protection Authority (www.dpa.gr) or the authority in your EU country.
8. Security
All traffic is encrypted (HTTPS), passwords are hashed, Wallet passes are cryptographically signed, and access to admin features is restricted.
9. Children
card4u is not intended for children under 16, and we do not knowingly collect their data.
10. Changes
We may update this policy; the date at the top shows the latest version. We will tell account holders about significant changes. See also our Terms of Service.