Privacy Policy for Cardova

Effective Date: June 30, 2025

1. Introduction

Cardova is committed to protecting your privacy. This policy explains what personal data we collect, how we use it, how we keep it secure, and your rights as a user. Cardova is designed with privacy in mind and aims to minimize data collection wherever possible.

2. Data We Collect

Account Information: When you sign up, we collect your email address and password. If you use passwordless login, only your email is required.
Profile Information:
- When creating a digital business card, you may choose to provide personal details such as your name, job title, company, phone number, website, LinkedIn, and other contact information.
- This data is used solely to generate your card and is stored locally in your browser using client-side storage (e.g., localStorage). Cardova does not transmit this information to our servers or database by default.
- If you choose to add your card to Apple Wallet or Google Wallet, the relevant information is securely sent to a Vercel serverless function, which processes the data to generate a compatible pass. This information may be temporarily handled by our infrastructure but is not stored in our database unless explicitly required for the pass creation. No profile information is shared with third parties beyond what is necessary to complete the wallet integration.
Payment Information: If you purchase credits, your email and purchase details are sent to Stripe for payment processing. Cardova does not store your credit card information.
Wallet Integration:
- If you choose to add your card to Apple Wallet or Google Wallet, the information you provide (such as name, email, company, etc.) is securely processed by a Vercel serverless function.
- For Apple Wallet: A .pkpass file is generated and downloaded directly to your device. The pass is stored locally and added manually by you; no data is sent to Apple during this process.
- For Google Wallet: A signed JWT (JSON Web Token) is generated that contains the card data. When you click "Save to Google Wallet," this data is sent to Google via their Wallet API to create your pass.
- No information is stored in our database unless required for pass generation, and we do not retain or share this data beyond the generation process.
Session Data & Cookies: We use cookies only to manage authentication and user sessions. No tracking or analytics cookies are used.

3. Analytics & Tracking

Cardova uses Umami for cookieless, privacy-friendly analytics.
No personal data is collected or stored for analytics purposes.
Umami does not use cookies or persistent identifiers to track users across sessions.
Analytics data is fully anonymized and used only to improve the website experience.

4. How We Use Your Data

To create and manage your account
To generate and deliver your digital business cards
To process payments and manage credits
To enable Apple Wallet and Google Wallet integrations
To provide customer support

5. Data Storage & Security

Supabase: User accounts, card templates, and credits are securely stored in Supabase, a GDPR-compliant cloud database. Passwords are hashed and never stored in plain text.
Analytics: Cardova uses Umami for cookieless, privacy-friendly analytics. No personal data is collected or stored for analytics purposes, and no data is sold or shared for advertising.
Encryption: All data in transit is encrypted using HTTPS. Sensitive operations (such as authentication and payments) use secure, industry-standard protocols.

6. Third-Party Services

Stripe: Used for payment processing. Your payment details are handled directly by Stripe and are never stored on Cardova servers.
Apple Wallet & Google Wallet: If you choose to add your card to a wallet, relevant information is sent to Apple or Google to generate the pass. Cardova does not store your wallet credentials.
Supabase: Used for authentication, user management, and data storage.
Vercel: Cardova is hosted on Vercel, which also provides the serverless functions used for wallet integrations and other backend operations. Data may be temporarily processed by Vercel infrastructure as part of these services, but is not stored unless required for the operation.

7. Cookies

Cardova uses cookies only for authentication and session management. No third-party or tracking cookies are used.

8. User Rights

You have the right to access, correct, or delete your personal data at any time. You can delete your account or request data deletion by contacting support.
You may request a copy of your data or ask for corrections if any information is inaccurate.

9. Data Retention

Your data is retained as long as your account is active. You may delete your account at any time, which will remove your personal data from our systems (subject to legal requirements).

10. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated effective date.

11. Contact

For questions or requests regarding your privacy, contact us at: support@getcardova.com