Privacy Policy
Last updated: October 2026. You own your card. We don't sell or share your data for advertising, we don't track you around the web, and you can download or delete everything at any time.
Contactzy is a digital business card and link-in-bio service. This policy explains what personal data we process, why, on what legal basis, who receives it, how long we keep it and the rights you have. It applies to the website, the Contactzy app, wallet passes and our emails.
Who is responsible
BEEPFLOW, England, United Kingdom (“Contactzy”, “we”) is the controller of the personal data described here, except where we say below that we act for a card owner. Contact us about privacy at [email protected]. BEEPFLOW is a company registered in England and Wales, company number 16438551. Registered office: England.
Two roles: account holders and the people they meet
For account holders and card visitors, we decide how data is used and are the controller. When visitors send their details to a card owner through a card's contact form, or join a business's loyalty card, the card owner decides what to do with those details and is their controller; we store and process them only on the owner's behalf, under our data processing terms. If you shared your details with a card owner, contact them first; we will help them answer you, and we will pass on any request you send us.
What we collect, why, and for how long
| Data | What it includes | Why | Legal basis | Kept for |
|---|---|---|---|---|
| Account | Name, sign-in email, password (stored only as a bcrypt hash) | Create and run your account, sign you in | Contract | Until you delete your account |
| Card content | Title, company, phone, email, website, address, bio, social links, photos, logo, banner, language and colours | Publish your card page, QR code and wallet passes | Contract | Until you delete the card or account |
| Teams and events | Team name and brand kit, invited teammates' emails, event name, date and venue coordinates | Team features and event passes | Contract | Until you delete them |
| Payments | Your plan, renewal date and Stripe customer and subscription IDs. Card numbers go straight to Stripe; we never see them | Billing and receipts | Contract; legal obligation for tax records | Account lifetime; invoices as long as tax law requires |
| Card analytics | Event type and time, a one-way hash of a shortened IP address, country, device type, operating system, referring website and campaign source | Show card owners how their card performs and estimate unique visitors | Legitimate interests | Hashes and referring sites are removed after 13 months; the anonymous counts stay with the card |
| Security logs | IP address, the email entered and whether a sign-in or form attempt succeeded | Protect accounts from abuse | Legitimate interests | 30 days |
| Support | Name, email, topic and message | Answer your questions | Legitimate interests | 24 months |
| Product news | Your opt-in choice and when you made it | Send occasional product emails, only if you opted in | Consent | Until you unsubscribe |
| Wallet passes | For Apple Wallet: an anonymous device identifier and push token; for Google Wallet: the pass contents | Keep saved passes up to date | Contract; legitimate interests for visitors who save someone's card | Until the pass is removed or the card is deleted |
| App sessions | Device platform, app version and a hash of a shortened IP address for each signed-in phone | List and secure your signed-in devices | Contract | Until 30 days after you sign the device out |
| Referrals and partners | Which account invited which, rewards granted, partner commissions and payouts | Grant rewards and pay commissions | Contract; legal obligation for payouts | Account lifetime; financial records as long as tax law requires |
Where we rely on legitimate interests, our interest is running a secure, reliable service and giving card owners basic statistics; we keep the data minimal so it does not override your rights. You can object at any time (see Your rights).
Details visitors share with card owners
On cards with the contact form switched on, a visitor can send their name, email, phone, company and a message. Visitors who join a loyalty card give a name, email or phone number and collect stamps. We store these for the card owner, show them only in the owner's dashboard, and keep them until the owner deletes them, the visitor deletes their loyalty card (removed for good after 30 days), or the owner deletes their account. A hash of a shortened IP address is kept with each submission to stop abuse.
Public cards
Everything you put on your card is public by design. Anyone with the link can view it, save it as a contact or read it through our public JSON API, and search engines may index it. Hide your card under Public access in your dashboard to stop this.
Card analytics, Do Not Track and Global Privacy Control
We never store a visitor's full IP address or browser identifier with analytics. If a browser sends a Do Not Track or Global Privacy Control signal, we still count the visit but record it without any hash or referring site. Card owners see only totals and never a visitor's identity.
Cookies and local storage
We only use what the service needs to work and the preferences you set yourself. There are no analytics, advertising or tracking cookies, no marketing pixels and no third-party scripts, so we do not ask for cookie consent. Stripe sets its own cookies on its checkout pages.
| Name | Purpose | Lasts |
|---|---|---|
sm_owner | Keeps you signed in | 30 days |
sm_card | Remembers which of your cards you are editing | 30 days |
cz_app | Marks pages opened from the Contactzy app | 30 days |
sidebar_state | Remembers whether the dashboard sidebar is open | 7 days |
sm_admin, sm_gate, sm_admin_view, sm_partner_view | Staff and partner access to the admin console; never set for other visitors | 4 hours to 90 days |
sm-theme (local storage) | Your light or dark theme choice | Until you clear it |
contactzy.offline (local storage) | A card you chose to keep for offline use | Until you clear it |
Who receives your data
We do not sell personal data, and we do not share it for cross-context behavioural advertising. We use these service providers, each bound by a data processing agreement and allowed to use the data only to provide their service to us:
- Cloudflare: network delivery and protection for every request (global).
- Hostinger: email delivery.
- Stripe: payment processing (United States and other countries).
- Google: Google Wallet passes, which receive the card fields shown on the pass (global).
- Apple: update notices for saved Apple Wallet passes, which receive only a push token (United States).
- Search engines using IndexNow (such as Bing): the web address of a public card when it is published or renamed.
Our database and uploaded files are stored on our own server in United Kingdom. We may disclose data when the law requires it, to protect people or the service from harm, or as part of a merger or sale, in which case this policy will continue to apply.
International transfers
Some providers above process data outside your country, including outside the European Economic Area and the United Kingdom. Where a country does not have an adequacy decision, transfers rely on the European Commission's Standard Contractual Clauses (and the UK addendum), or on the EU-US Data Privacy Framework where the provider is certified. Ask us for a copy of the safeguards at [email protected].
Your rights
Wherever you live, you can:
- Access and take your data: download everything in one file under Settings → Your data, or ask us for a copy.
- Correct it: edit your card and account at any time.
- Delete it: delete your account yourself from the app or the website (see Delete your account), or ask us.
- Object or restrict: object to processing based on legitimate interests, or ask us to pause using your data while a concern is resolved.
- Withdraw consent: unsubscribe from product news with the link in any such email or under Settings. Withdrawing does not affect what happened before.
- Complain: to your local data protection authority, for example the authority where you live or work in the EU, or the Information Commissioner's Office in the UK. We would appreciate the chance to help first.
Email [email protected] to use any right we do not offer in the product. We answer within one month (sooner where the law requires), free of charge, and may ask you to confirm you own the account first. We do not make decisions about you based solely on automated processing.
California and other US states
In the last 12 months we collected identifiers (name, email, IP address), commercial information (your plan), internet activity (card analytics), coarse location (country) and professional information (what you put on your card), from you, your visitors and your devices, for the purposes in the table above. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics. You may ask to know, access, correct and delete your personal information, and we will not treat you differently for using these rights. An authorised agent may make a request for you with your written permission.
Other countries
If you are in the UK, Switzerland, Brazil, Canada, Australia or another country with a privacy law, you have the rights that law gives you, and you can use them in the same way through [email protected].
The Contactzy app
The app talks only to our servers and contains no analytics or advertising software. Camera images used to scan a QR code or a business card are processed on your phone. When you save someone to your contacts, the app writes to your phone's address book; it never reads or uploads your contacts. Your sign-in is kept in the phone's secure storage.
Security
All traffic is encrypted in transit. Passwords are stored only as bcrypt hashes, sign-in and form endpoints are rate limited, staff access sits behind a separate access key, and staff actions are written to an audit log. Database snapshots are kept on our server for up to 14 days for disaster recovery and then deleted. If a breach puts your data at risk, we will notify the relevant authority within 72 hours where required and tell you without undue delay.
Children
Contactzy is for people aged 16 and older, and you confirm your age when you sign up. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
If we make material changes we will update the date at the top and, for significant changes, tell you by email or on your dashboard before they take effect.
Contact
Privacy questions and requests: [email protected]. Postal contact: BEEPFLOW, England, United Kingdom.